Create a policy. [experimental] | NVIDIA Run:ai Documentation

curl -X POST http://localhost:8080/api/v1/policies \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "workloadType": {
    "version": "v1",
    "kind": "Deployment"
  },
  "scope": "system"
}'

{
  "createdAt": "2024-01-15T09:30:00Z",
  "createdBy": "string",
  "id": "string",
  "scope": "system",
  "updatedAt": "2024-01-15T09:30:00Z",
  "updatedBy": "string",
  "workloadType": {
    "version": "v1",
    "kind": "Deployment",
    "group": "apps"
  },
  "clusterId": "string",
  "departmentId": "string",
  "description": "a short description of the policy",
  "effectiveRules": [
    {
      "field": "containerPort",
      "specSelector": "containerByName",
      "enforcements": [
        {
          "set": {
            "containerPort": 1234,
            "protocol": "TCP"
          }
        }
      ],
      "sourceOfRule": {
        "scope": "project",
        "projectId": 3
      },
      "itemSelector": "string",
      "selectorParams": {
        "containerName": "my-container"
      },
      "allowOverride": true
    }
  ],
  "projectId": "string",
  "rules": [
    {
      "field": "containerPort",
      "specSelector": "containerByName",
      "enforcements": [
        {
          "set": {
            "containerPort": 1234,
            "protocol": "TCP"
          }
        }
      ],
      "itemSelector": "string",
      "selectorParams": {
        "containerName": "my-container"
      },
      "allowOverride": true
    }
  ],
  "status": {
    "phase": "Ready",
    "issues": [
      "configuration-issue-1",
      "configuration-issue-2"
    ]
  }
}

Create a policy for a specific workload type based on the provided specification.

Authentication

AuthorizationBearer

Bearer authentication

Request

This endpoint expects an object.

workloadTypeobjectRequired

Specifies the Group, Version, and Kind (GVK) of the Kubernetes resource that defines the workload.

scopeenumRequired

Allowed values:

descriptionstringOptionalformat: ".*"1-1023 characters

A description of the policy.

clusterIdstring or nullOptionalformat: "uuid"

The id of the cluster the policy applies to. Required when the scope is cluster.

departmentIdstring or nullOptionalformat: ".*">=1 character

The id of the department the policy applies to. Required when the scope is department.

projectIdstring or nullOptionalformat: ".*"

The id of the project the policy applies to. Required when the scope is project.

ruleslist of objectsOptional

The rules declared on this policy. Each rule targets a field in the workload spec and constrains its allowed values through its enforcements.

Response

The created policy.

createdAtdatetime

The timestamp for when the policy was created.

createdBystring>=1 character

Identifier of the user who created the policy.

idstringformat: "uuid"

The unique identifier for the policy.

scopeenum

Allowed values:

updatedAtdatetime

The timestamp for when the policy was last updated.

updatedBystring>=1 character

Identifier of the user who last updated the policy.

workloadTypeobject

Specifies the Group, Version, and Kind (GVK) of the Kubernetes resource that defines the workload.

clusterIdstring or nullOptionalformat: "uuid"

The id of the cluster the policy applies to. Required when the scope is cluster.

departmentIdstring or nullOptionalformat: ".*">=1 character

The id of the department the policy applies to. Required when the scope is department.

descriptionstringOptionalformat: ".*"1-1023 characters

A description of the policy.

effectiveRuleslist of objectsOptional

The merged rule set in effect for this policy, including rules inherited from broader scopes (cluster, then department, then project). Each entry adds the sourceOfRule indicating where the rule was defined. Returned in responses only; not accepted in requests.

projectIdstring or nullOptionalformat: ".*"

The id of the project the policy applies to. Required when the scope is project.

ruleslist of objectsOptional

The rules declared on this policy. Each rule targets a field in the workload spec and constrains its allowed values through its enforcements.

statusobject or nullOptional

Configuration issues detected by the server for this policy. Returned in responses only; not accepted in requests.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

503

Service Unavailable Error