1type: google.api.Service
2config_version: 3
3name: binaryauthorization.googleapis.com
4title: Binary Authorization API
5
6apis:
7- name: google.cloud.binaryauthorization.v1beta1.BinauthzManagementServiceV1Beta1
8- name: google.cloud.binaryauthorization.v1beta1.SystemPolicyV1Beta1
9
10documentation:
11  summary: |-
12    The management interface for Binary Authorization, a system providing
13    policy control for images deployed to Kubernetes Engine clusters, Anthos
14    clusters on VMware, and Cloud Run.
15  rules:
16  - selector: google.iam.v1.IAMPolicy.GetIamPolicy
17    description: |-
18      Gets the access control policy for a resource. Returns an empty policy
19      if the resource exists and does not have a policy set.
20
21  - selector: google.iam.v1.IAMPolicy.SetIamPolicy
22    description: |-
23      Sets the access control policy on the specified resource. Replaces
24      any existing policy.
25
26      Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED`
27      errors.
28
29  - selector: google.iam.v1.IAMPolicy.TestIamPermissions
30    description: |-
31      Returns permissions that a caller has on the specified resource. If the
32      resource does not exist, this will return an empty set of
33      permissions, not a `NOT_FOUND` error.
34
35      Note: This operation is designed to be used for building
36      permission-aware UIs and command-line tools, not for authorization
37      checking. This operation may "fail open" without warning.
38
39http:
40  rules:
41  - selector: google.iam.v1.IAMPolicy.GetIamPolicy
42    get: '/v1beta1/{resource=projects/*/policy}:getIamPolicy'
43    additional_bindings:
44    - get: '/v1beta1/{resource=projects/*/attestors/*}:getIamPolicy'
45  - selector: google.iam.v1.IAMPolicy.SetIamPolicy
46    post: '/v1beta1/{resource=projects/*/policy}:setIamPolicy'
47    body: '*'
48    additional_bindings:
49    - post: '/v1beta1/{resource=projects/*/attestors/*}:setIamPolicy'
50      body: '*'
51  - selector: google.iam.v1.IAMPolicy.TestIamPermissions
52    post: '/v1beta1/{resource=projects/*/policy}:testIamPermissions'
53    body: '*'
54    additional_bindings:
55    - post: '/v1beta1/{resource=projects/*/attestors/*}:testIamPermissions'
56      body: '*'
57
58authentication:
59  rules:
60  - selector: 'google.cloud.binaryauthorization.v1beta1.BinauthzManagementServiceV1Beta1.*'
61    oauth:
62      canonical_scopes: |-
63        https://www.googleapis.com/auth/cloud-platform
64  - selector: google.cloud.binaryauthorization.v1beta1.SystemPolicyV1Beta1.GetSystemPolicy
65    oauth:
66      canonical_scopes: |-
67        https://www.googleapis.com/auth/cloud-platform
68  - selector: 'google.iam.v1.IAMPolicy.*'
69    oauth:
70      canonical_scopes: |-
71        https://www.googleapis.com/auth/cloud-platform
72