Querying the Cluster Component Protection Policy Templates

Function

This API is used to query the cluster protection policy templates.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

• If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
• If you are using identity policy-based authorization, no identity policy-based permission required for calling this API.

URI

GET /v5/{project_id}/container/clusters/protection-policy-templates

Request Parameters

Response Parameters

Status code: 200

Example Requests

None

Example Responses

Status code: 200

Request succeeded.

{
  "total_num" : 10,
  "data_list" : [ {
    "id" : "string",
    "template_name" : "string",
    "template_type" : "string",
    "description" : "string",
    "target_kind" : "Deployment;ReplicaSet;CronJob",
    "tag" : "string",
    "level" : "string",
    "constraint_template" : {
      "kind" : "ConstraintTemplate",
      "apiVersion" : "templates.gatekeeper.sh/v1",
      "metadata" : {
        "name" : "k8spspprocmount",
        "creationTimestamp" : null,
        "annotations" : {
          "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
          "description-chinese" : "Restrict the proc types that can be mounted to a pod.",
          "level" : "3",
          "metadata.gatekeeper.sh/title" : "Proc Mount",
          "metadata.gatekeeper.sh/version" : "1.0.0",
          "name-chinese" : "K8sPSPProcMount",
          "tag" : "Container/ApplicationSecurityPolicies",
          "tag-chinese" : "Container/Application security policy",
          "targetKind" : "Pod",
          "type" : "security"
        }
      },
      "spec" : {
        "crd" : {
          "spec" : {
            "names" : {
              "kind" : "K8sPSPProcMount"
            },
            "validation" : {
              "openAPIV3Schema" : {
                "description" : "Controls the allowed `procMount` types for the container. Corresponds to the `allowedProcMountTypes` field in a PodSecurityPolicy. For more information, see https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes",
                "type" : "object",
                "properties" : {
                  "exemptImages" : {
                    "description" : "Any container that uses an image that matches an entry in this list will be excluded from enforcement. Prefix-matching can be signified with `*`. For example: `my-image-*`.\nIt is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) in order to avoid unexpectedly exempting images from an untrusted repository.",
                    "type" : "array",
                    "items" : {
                      "type" : "string"
                    }
                  },
                  "procMount" : {
                    "description" : "Defines the strategy for the security exposure of certain paths in `/proc` by the container runtime. Setting to `Default` uses the runtime defaults, where `Unmasked` bypasses the default behavior.",
                    "type" : "string",
                    "enum" : [ "Default", "Unmasked" ]
                  }
                }
              }
            }
          }
        },
        "targets" : [ {
          "target" : "admission.k8s.gatekeeper.sh",
          "rego" : "package k8spspprocmount\nimport data.lib.exempt_container.is_exempt\nviolation[{\"msg\": msg, \"details\": {}}] {\n    c := input_containers[_]\n    not is_exempt(c)\n    allowedProcMount := get_allowed_proc_mount(input)\n    not input_proc_mount_type_allowed(allowedProcMount, c)\n    msg := sprintf(\"ProcMount type is not allowed, container: %v. Allowed procMount types: %v\", [c.name, allowedProcMount])\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"default\"\n    lower(c.securityContext.procMount) == \"default\"\n}\ninput_proc_mount_type_allowed(allowedProcMount, c) {\n    allowedProcMount == \"unmasked\"\n}\ninput_containers[c] {\n    c := input.review.object.spec.containers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.initContainers[_]\n    c.securityContext.procMount\n}\ninput_containers[c] {\n    c := input.review.object.spec.ephemeralContainers[_]\n    c.securityContext.procMount\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not arg.parameters.procMount\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    not valid_proc_mount(arg.parameters.procMount)\n    out = \"default\"\n}\nget_allowed_proc_mount(arg) = out {\n    out = lower(arg.parameters.procMount)\n}\nvalid_proc_mount(str) {\n    lower(str) == \"default\"\n}\nvalid_proc_mount(str) {\n    lower(str) == \"unmasked\"\n}",
          "libs" : [ "package lib.exempt_container\nis_exempt(container) {\n    exempt_images := object.get(object.get(input, \"parameters\", {}), \"exemptImages\", [])\n    img := container.image\n    exemption := exempt_images[_]\n    _matches_exemption(img, exemption)\n}\n_matches_exemption(img, exemption) {\n    not endswith(exemption, \"*\")\n    exemption == img\n}\n_matches_exemption(img, exemption) {\n    endswith(exemption, \"*\")\n    prefix := trim_suffix(exemption, \"*\")\n    startswith(img, prefix)\n}" ]
        } ]
      },
      "status" : { }
    }
  } ]
}

Status Codes

Error Codes

See Error Codes.