Binary Authorization: globalPolicyEvaluationMode

products/binaryauthorization/api.yaml

@@ -155,6 +155,15 @@ objects:
       - !ruby/object:Api::Type::String
         name: description
         description: A descriptive comment.
+      - !ruby/object:Api::Type::Enum
+        name: globalPolicyEvaluationMode
+        description: |
+          Controls the evaluation of a Google-maintained global admission policy
+          for common system-level images. Images not covered by the global
+          policy will be subject to the project admission policy.
+        values:
+          - :ENABLE
+          - :DISABLE
       - !ruby/object:Api::Type::Array
         name: admissionWhitelistPatterns
         description: |

products/binaryauthorization/terraform.yaml

@@ -63,7 +63,16 @@ overrides: !ruby/object:Overrides::ResourceOverrides
       vars:
         attestor_name: "test-attestor"
         note_name: "test-attestor-note"
+     - !ruby/object:Provider::Terraform::Examples
+      name: "binary_authorization_policy_global_evaluation"
+      primary_resource_id: "policy"
+      skip_test: true
+      vars:
+        attestor_name: "test-attestor"
+        note_name: "test-attestor-note"
     properties:
+      globalPolicyEvaluationMode: !ruby/object:Overrides::Terraform::PropertyOverride
+        default_from_api: true
       clusterAdmissionRules: !ruby/object:Overrides::Terraform::PropertyOverride
         is_set: true
         set_hash_func: |-

templates/terraform/examples/binary_authorization_policy_global_evaluation.tf.erb

@@ -0,0 +1,27 @@
+resource "google_binary_authorization_policy" "<%= ctx[:primary_resource_id] %>" {
+
+  default_admission_rule {
+    evaluation_mode = "REQUIRE_ATTESTATION"
+    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
+    require_attestations_by = ["${google_binary_authorization_attestor.attestor.name}"]
+  }
+
+  global_policy_evaluation_mode = "ENABLE"
+
+}
+
+resource "google_container_analysis_note" "note" {
+  name = "<%= ctx[:vars]["note_name"] %>"
+  attestation_authority {
+    hint {
+      human_readable_name = "My attestor"
+    }
+  }
+}
+
+resource "google_binary_authorization_attestor" "attestor" {
+  name = "<%= ctx[:vars]["attestor_name"] %>"
+  attestation_authority_note {
+    note_reference = "${google_container_analysis_note.note.name}"
+  }
+}