Binary Authorization: globalPolicyEvaluationMode

products/binaryauthorization/api.yaml

@@ -155,6 +155,15 @@ objects:
       - !ruby/object:Api::Type::String
         name: description
         description: A descriptive comment.
+      - !ruby/object:Api::Type::Enum
+        name: globalPolicyEvaluationMode
+        description: |
+          Controls the evaluation of a Google-maintained global admission policy
+          for common system-level images. Images not covered by the global
+          policy will be subject to the project admission policy.
+        values:
+          - :ENABLE
+          - :DISABLE
       - !ruby/object:Api::Type::Array
         name: admissionWhitelistPatterns
         description: |

products/binaryauthorization/terraform.yaml

@@ -63,7 +63,16 @@ overrides: !ruby/object:Overrides::ResourceOverrides
       vars:
         attestor_name: "test-attestor"
         note_name: "test-attestor-note"
+     - !ruby/object:Provider::Terraform::Examples
+      name: "binary_authorization_policy_global_evaluation"
+      primary_resource_id: "policy"
+      skip_test: true
+      vars:
+        attestor_name: "test-attestor"
+        note_name: "test-attestor-note"
     properties:
+      globalPolicyEvaluationMode: !ruby/object:Overrides::Terraform::PropertyOverride
+        default_from_api: true
       clusterAdmissionRules: !ruby/object:Overrides::Terraform::PropertyOverride
         is_set: true
         set_hash_func: |-

templates/terraform/examples/binary_authorization_policy_global_evaluation.tf.erb

@@ -0,0 +1,27 @@
+resource "google_binary_authorization_policy" "<%= ctx[:primary_resource_id] %>" {
+
+  default_admission_rule {
+    evaluation_mode = "REQUIRE_ATTESTATION"
+    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
+    require_attestations_by = ["${google_binary_authorization_attestor.attestor.name}"]
+  }
+
+  global_policy_evaluation_mode = "ENABLE"
+
+}
+
+resource "google_container_analysis_note" "note" {
+  name = "<%= ctx[:vars]["note_name"] %>"
+  attestation_authority {
+    hint {
+      human_readable_name = "My attestor"
+    }
+  }
+}
+
+resource "google_binary_authorization_attestor" "attestor" {
+  name = "<%= ctx[:vars]["attestor_name"] %>"
+  attestation_authority_note {
+    note_reference = "${google_container_analysis_note.note.name}"
+  }
+}

third_party/terraform/tests/resource_binaryauthorization_policy_test.go.erb

@@ -54,7 +54,7 @@ func TestAccBinaryAuthorizationPolicy_full(t *testing.T) {
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccBinaryAuthorizationPolicyFull(pid, pname, org, billingId, note, attestor),
+				Config: testAccBinaryAuthorizationPolicyFull(pid, pname, org, billingId, note, attestor, "ENABLE"),
 			},
 			{
 				ResourceName:      "google_binary_authorization_policy.policy",
@@ -125,7 +125,15 @@ func TestAccBinaryAuthorizationPolicy_update(t *testing.T) {
 				ImportStateVerify: true,
 			},
 			{
-				Config: testAccBinaryAuthorizationPolicyFull(pid, pname, org, billingId, note, attestor),
+				Config: testAccBinaryAuthorizationPolicyFull(pid, pname, org, billingId, note, attestor, "ENABLE"),
+			},
+			{
+				ResourceName:      "google_binary_authorization_policy.policy",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccBinaryAuthorizationPolicyFull(pid, pname, org, billingId, note, attestor, "DISABLE"),
 			},
 			{
 				ResourceName:      "google_binary_authorization_policy.policy",
@@ -211,7 +219,7 @@ resource "google_binary_authorization_policy" "policy" {
 }
 
 <% unless version == 'ga' -%>
-func testAccBinaryAuthorizationPolicyFull(pid, pname, org, billing, note, attestor string) string {
+func testAccBinaryAuthorizationPolicyFull(pid, pname, org, billing, note, attestor, gpmode string) string {
 	return fmt.Sprintf(`
 // Use a separate project since each project can only have one policy
 resource "google_project" "project" {
@@ -269,8 +277,10 @@ resource "google_binary_authorization_policy" "policy" {
     enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
     require_attestations_by = ["${google_binary_authorization_attestor.attestor.name}"]
   }
+
+  global_policy_evaluation_mode = "%s"
 }
-`, pid, pname, org, billing, note, attestor)
+`, pid, pname, org, billing, note, attestor, gpmode)
 }
 
 func testAccBinaryAuthorizationPolicy_separateProject(pid, pname, org, billing, note, attestor string) string {