<?php
# Generated by the protocol buffer compiler.  DO NOT EDIT!
# source: google/cloud/binaryauthorization/v1beta1/resources.proto

namespace Google\Cloud\BinaryAuthorization\V1beta1;

use Google\Protobuf\Internal\GPBType;
use Google\Protobuf\Internal\RepeatedField;
use Google\Protobuf\Internal\GPBUtil;

/**
 * A [policy][google.cloud.binaryauthorization.v1beta1.Policy] for Binary Authorization.
 *
 * Generated from protobuf message <code>google.cloud.binaryauthorization.v1beta1.Policy</code>
 */
class Policy extends \Google\Protobuf\Internal\Message
{
    /**
     * Output only. The resource name, in the format `projects/&#42;&#47;policy`. There is
     * at most one policy per project.
     *
     * Generated from protobuf field <code>string name = 1 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     */
    private $name = '';
    /**
     * Optional. A descriptive comment.
     *
     * Generated from protobuf field <code>string description = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $description = '';
    /**
     * Optional. Controls the evaluation of a Google-maintained global admission
     * policy for common system-level images. Images not covered by the global
     * policy will be subject to the project admission policy. This setting
     * has no effect when specified inside a global admission policy.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.Policy.GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $global_policy_evaluation_mode = 0;
    /**
     * Optional. Admission policy allowlisting. A matching admission request will
     * always be permitted. This feature is typically used to exclude Google or
     * third-party infrastructure images from Binary Authorization policies.
     *
     * Generated from protobuf field <code>repeated .google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern admission_whitelist_patterns = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $admission_whitelist_patterns;
    /**
     * Optional. Per-cluster admission rules. Cluster spec format:
     * `location.clusterId`. There can be at most one admission rule per cluster
     * spec.
     * A `location` is either a compute zone (e.g. us-central1-a) or a region
     * (e.g. us-central1).
     * For `clusterId` syntax restrictions see
     * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> cluster_admission_rules = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $cluster_admission_rules;
    /**
     * Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
     *   `[a-z.-]+`, e.g. `some-namespace`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_namespace_admission_rules = 10 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $kubernetes_namespace_admission_rules;
    /**
     * Optional. Per-kubernetes-service-account admission rules. Service account
     * spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_service_account_admission_rules = 8 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $kubernetes_service_account_admission_rules;
    /**
     * Optional. Per-istio-service-identity admission rules. Istio service
     * identity spec format:
     * `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
     * `<domain>/ns/<namespace>/sa/<serviceaccount>`
     * e.g. `spiffe://example.com/ns/test-ns/sa/default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> istio_service_identity_admission_rules = 9 [(.google.api.field_behavior) = OPTIONAL];</code>
     */
    private $istio_service_identity_admission_rules;
    /**
     * Required. Default admission rule for a cluster without a per-cluster, per-
     * kubernetes-service-account, or per-istio-service-identity admission rule.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.AdmissionRule default_admission_rule = 4 [(.google.api.field_behavior) = REQUIRED];</code>
     */
    private $default_admission_rule = null;
    /**
     * Output only. Time when the policy was last updated.
     *
     * Generated from protobuf field <code>.google.protobuf.Timestamp update_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     */
    private $update_time = null;

    /**
     * Constructor.
     *
     * @param array $data {
     *     Optional. Data for populating the Message object.
     *
     *     @type string $name
     *           Output only. The resource name, in the format `projects/&#42;&#47;policy`. There is
     *           at most one policy per project.
     *     @type string $description
     *           Optional. A descriptive comment.
     *     @type int $global_policy_evaluation_mode
     *           Optional. Controls the evaluation of a Google-maintained global admission
     *           policy for common system-level images. Images not covered by the global
     *           policy will be subject to the project admission policy. This setting
     *           has no effect when specified inside a global admission policy.
     *     @type array<\Google\Cloud\BinaryAuthorization\V1beta1\AdmissionWhitelistPattern>|\Google\Protobuf\Internal\RepeatedField $admission_whitelist_patterns
     *           Optional. Admission policy allowlisting. A matching admission request will
     *           always be permitted. This feature is typically used to exclude Google or
     *           third-party infrastructure images from Binary Authorization policies.
     *     @type array|\Google\Protobuf\Internal\MapField $cluster_admission_rules
     *           Optional. Per-cluster admission rules. Cluster spec format:
     *           `location.clusterId`. There can be at most one admission rule per cluster
     *           spec.
     *           A `location` is either a compute zone (e.g. us-central1-a) or a region
     *           (e.g. us-central1).
     *           For `clusterId` syntax restrictions see
     *           https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
     *     @type array|\Google\Protobuf\Internal\MapField $kubernetes_namespace_admission_rules
     *           Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
     *             `[a-z.-]+`, e.g. `some-namespace`
     *     @type array|\Google\Protobuf\Internal\MapField $kubernetes_service_account_admission_rules
     *           Optional. Per-kubernetes-service-account admission rules. Service account
     *           spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
     *     @type array|\Google\Protobuf\Internal\MapField $istio_service_identity_admission_rules
     *           Optional. Per-istio-service-identity admission rules. Istio service
     *           identity spec format:
     *           `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
     *           `<domain>/ns/<namespace>/sa/<serviceaccount>`
     *           e.g. `spiffe://example.com/ns/test-ns/sa/default`
     *     @type \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule $default_admission_rule
     *           Required. Default admission rule for a cluster without a per-cluster, per-
     *           kubernetes-service-account, or per-istio-service-identity admission rule.
     *     @type \Google\Protobuf\Timestamp $update_time
     *           Output only. Time when the policy was last updated.
     * }
     */
    public function __construct($data = NULL) {
        \GPBMetadata\Google\Cloud\Binaryauthorization\V1Beta1\Resources::initOnce();
        parent::__construct($data);
    }

    /**
     * Output only. The resource name, in the format `projects/&#42;&#47;policy`. There is
     * at most one policy per project.
     *
     * Generated from protobuf field <code>string name = 1 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     * @return string
     */
    public function getName()
    {
        return $this->name;
    }

    /**
     * Output only. The resource name, in the format `projects/&#42;&#47;policy`. There is
     * at most one policy per project.
     *
     * Generated from protobuf field <code>string name = 1 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     * @param string $var
     * @return $this
     */
    public function setName($var)
    {
        GPBUtil::checkString($var, True);
        $this->name = $var;

        return $this;
    }

    /**
     * Optional. A descriptive comment.
     *
     * Generated from protobuf field <code>string description = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return string
     */
    public function getDescription()
    {
        return $this->description;
    }

    /**
     * Optional. A descriptive comment.
     *
     * Generated from protobuf field <code>string description = 6 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param string $var
     * @return $this
     */
    public function setDescription($var)
    {
        GPBUtil::checkString($var, True);
        $this->description = $var;

        return $this;
    }

    /**
     * Optional. Controls the evaluation of a Google-maintained global admission
     * policy for common system-level images. Images not covered by the global
     * policy will be subject to the project admission policy. This setting
     * has no effect when specified inside a global admission policy.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.Policy.GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return int
     */
    public function getGlobalPolicyEvaluationMode()
    {
        return $this->global_policy_evaluation_mode;
    }

    /**
     * Optional. Controls the evaluation of a Google-maintained global admission
     * policy for common system-level images. Images not covered by the global
     * policy will be subject to the project admission policy. This setting
     * has no effect when specified inside a global admission policy.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.Policy.GlobalPolicyEvaluationMode global_policy_evaluation_mode = 7 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param int $var
     * @return $this
     */
    public function setGlobalPolicyEvaluationMode($var)
    {
        GPBUtil::checkEnum($var, \Google\Cloud\BinaryAuthorization\V1beta1\Policy\GlobalPolicyEvaluationMode::class);
        $this->global_policy_evaluation_mode = $var;

        return $this;
    }

    /**
     * Optional. Admission policy allowlisting. A matching admission request will
     * always be permitted. This feature is typically used to exclude Google or
     * third-party infrastructure images from Binary Authorization policies.
     *
     * Generated from protobuf field <code>repeated .google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern admission_whitelist_patterns = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\RepeatedField
     */
    public function getAdmissionWhitelistPatterns()
    {
        return $this->admission_whitelist_patterns;
    }

    /**
     * Optional. Admission policy allowlisting. A matching admission request will
     * always be permitted. This feature is typically used to exclude Google or
     * third-party infrastructure images from Binary Authorization policies.
     *
     * Generated from protobuf field <code>repeated .google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern admission_whitelist_patterns = 2 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array<\Google\Cloud\BinaryAuthorization\V1beta1\AdmissionWhitelistPattern>|\Google\Protobuf\Internal\RepeatedField $var
     * @return $this
     */
    public function setAdmissionWhitelistPatterns($var)
    {
        $arr = GPBUtil::checkRepeatedField($var, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionWhitelistPattern::class);
        $this->admission_whitelist_patterns = $arr;

        return $this;
    }

    /**
     * Optional. Per-cluster admission rules. Cluster spec format:
     * `location.clusterId`. There can be at most one admission rule per cluster
     * spec.
     * A `location` is either a compute zone (e.g. us-central1-a) or a region
     * (e.g. us-central1).
     * For `clusterId` syntax restrictions see
     * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> cluster_admission_rules = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\MapField
     */
    public function getClusterAdmissionRules()
    {
        return $this->cluster_admission_rules;
    }

    /**
     * Optional. Per-cluster admission rules. Cluster spec format:
     * `location.clusterId`. There can be at most one admission rule per cluster
     * spec.
     * A `location` is either a compute zone (e.g. us-central1-a) or a region
     * (e.g. us-central1).
     * For `clusterId` syntax restrictions see
     * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> cluster_admission_rules = 3 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array|\Google\Protobuf\Internal\MapField $var
     * @return $this
     */
    public function setClusterAdmissionRules($var)
    {
        $arr = GPBUtil::checkMapField($var, \Google\Protobuf\Internal\GPBType::STRING, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule::class);
        $this->cluster_admission_rules = $arr;

        return $this;
    }

    /**
     * Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
     *   `[a-z.-]+`, e.g. `some-namespace`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_namespace_admission_rules = 10 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\MapField
     */
    public function getKubernetesNamespaceAdmissionRules()
    {
        return $this->kubernetes_namespace_admission_rules;
    }

    /**
     * Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
     *   `[a-z.-]+`, e.g. `some-namespace`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_namespace_admission_rules = 10 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array|\Google\Protobuf\Internal\MapField $var
     * @return $this
     */
    public function setKubernetesNamespaceAdmissionRules($var)
    {
        $arr = GPBUtil::checkMapField($var, \Google\Protobuf\Internal\GPBType::STRING, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule::class);
        $this->kubernetes_namespace_admission_rules = $arr;

        return $this;
    }

    /**
     * Optional. Per-kubernetes-service-account admission rules. Service account
     * spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_service_account_admission_rules = 8 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\MapField
     */
    public function getKubernetesServiceAccountAdmissionRules()
    {
        return $this->kubernetes_service_account_admission_rules;
    }

    /**
     * Optional. Per-kubernetes-service-account admission rules. Service account
     * spec format: `namespace:serviceaccount`. e.g. `test-ns:default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> kubernetes_service_account_admission_rules = 8 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array|\Google\Protobuf\Internal\MapField $var
     * @return $this
     */
    public function setKubernetesServiceAccountAdmissionRules($var)
    {
        $arr = GPBUtil::checkMapField($var, \Google\Protobuf\Internal\GPBType::STRING, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule::class);
        $this->kubernetes_service_account_admission_rules = $arr;

        return $this;
    }

    /**
     * Optional. Per-istio-service-identity admission rules. Istio service
     * identity spec format:
     * `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
     * `<domain>/ns/<namespace>/sa/<serviceaccount>`
     * e.g. `spiffe://example.com/ns/test-ns/sa/default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> istio_service_identity_admission_rules = 9 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @return \Google\Protobuf\Internal\MapField
     */
    public function getIstioServiceIdentityAdmissionRules()
    {
        return $this->istio_service_identity_admission_rules;
    }

    /**
     * Optional. Per-istio-service-identity admission rules. Istio service
     * identity spec format:
     * `spiffe://<domain>/ns/<namespace>/sa/<serviceaccount>` or
     * `<domain>/ns/<namespace>/sa/<serviceaccount>`
     * e.g. `spiffe://example.com/ns/test-ns/sa/default`
     *
     * Generated from protobuf field <code>map<string, .google.cloud.binaryauthorization.v1beta1.AdmissionRule> istio_service_identity_admission_rules = 9 [(.google.api.field_behavior) = OPTIONAL];</code>
     * @param array|\Google\Protobuf\Internal\MapField $var
     * @return $this
     */
    public function setIstioServiceIdentityAdmissionRules($var)
    {
        $arr = GPBUtil::checkMapField($var, \Google\Protobuf\Internal\GPBType::STRING, \Google\Protobuf\Internal\GPBType::MESSAGE, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule::class);
        $this->istio_service_identity_admission_rules = $arr;

        return $this;
    }

    /**
     * Required. Default admission rule for a cluster without a per-cluster, per-
     * kubernetes-service-account, or per-istio-service-identity admission rule.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.AdmissionRule default_admission_rule = 4 [(.google.api.field_behavior) = REQUIRED];</code>
     * @return \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule|null
     */
    public function getDefaultAdmissionRule()
    {
        return $this->default_admission_rule;
    }

    public function hasDefaultAdmissionRule()
    {
        return isset($this->default_admission_rule);
    }

    public function clearDefaultAdmissionRule()
    {
        unset($this->default_admission_rule);
    }

    /**
     * Required. Default admission rule for a cluster without a per-cluster, per-
     * kubernetes-service-account, or per-istio-service-identity admission rule.
     *
     * Generated from protobuf field <code>.google.cloud.binaryauthorization.v1beta1.AdmissionRule default_admission_rule = 4 [(.google.api.field_behavior) = REQUIRED];</code>
     * @param \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule $var
     * @return $this
     */
    public function setDefaultAdmissionRule($var)
    {
        GPBUtil::checkMessage($var, \Google\Cloud\BinaryAuthorization\V1beta1\AdmissionRule::class);
        $this->default_admission_rule = $var;

        return $this;
    }

    /**
     * Output only. Time when the policy was last updated.
     *
     * Generated from protobuf field <code>.google.protobuf.Timestamp update_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     * @return \Google\Protobuf\Timestamp|null
     */
    public function getUpdateTime()
    {
        return $this->update_time;
    }

    public function hasUpdateTime()
    {
        return isset($this->update_time);
    }

    public function clearUpdateTime()
    {
        unset($this->update_time);
    }

    /**
     * Output only. Time when the policy was last updated.
     *
     * Generated from protobuf field <code>.google.protobuf.Timestamp update_time = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];</code>
     * @param \Google\Protobuf\Timestamp $var
     * @return $this
     */
    public function setUpdateTime($var)
    {
        GPBUtil::checkMessage($var, \Google\Protobuf\Timestamp::class);
        $this->update_time = $var;

        return $this;
    }

}