Get the effective policy by type and scope. The effective policy is a combination of the policy provided for the given scope (if exist) and the effective policies of its parent scopes.

curl -X POST http://localhost:8080/api/v1/policies/effective \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "workloadType": {
    "version": "v1",
    "kind": "Deployment",
    "group": "apps"
  },
  "scope": "project",
  "projectId": "1230001"
}'

{
  "rules": [
    {
      "enforcements": [
        {
          "set": {
            "containerPort": 1234,
            "protocol": "TCP"
          }
        },
        {
          "required": true
        }
      ],
      "field": "environmentVariables-ConfigMapName",
      "itemSelector": "environmentVariables-FromConfigMap",
      "scope": "cluster",
      "selectorParams": {
        "name": "worker-1"
      },
      "specSelector": "appContainerByName"
    },
    {
      "enforcements": [
        {
          "set": {
            "value": true
          }
        }
      ],
      "field": "allowPrivilegeEscalation",
      "scope": "department",
      "specSelector": "allAppContainers"
    }
  ]
}

Authentication

AuthorizationBearer

Bearer authentication

Request

This endpoint expects an object.

workloadTypeobjectRequired

Specifies the Group, Version, and Kind (GVK) of the Kubernetes resource that defines the workload.

scopeenumRequired

Allowed values:

clusterIdstring or nullOptionalformat: "uuid"

The id of the cluster the policy applies to. Required when the scope is cluster.

departmentIdstring or nullOptionalformat: ".*">=1 character

The id of the department the policy applies to. Required when the scope is department.

projectIdstring or nullOptionalformat: ".*"

The id of the project the policy applies to. Required when the scope is project.

Response

Policy found.

effectiveRuleslist of objectsOptional

The merged rule set in effect for this policy, including rules inherited from broader scopes (cluster, then department, then project). Each entry adds the sourceOfRule indicating where the rule was defined. Returned in responses only; not accepted in requests.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

503

Service Unavailable Error