---
title: "PUT /v1/{+name}"
method: PUT
path: "/v1/{+name}"
tags: ["projects"]
---

# PUT /v1/{+name}

`PUT /v1/{+name}`

Replaces a platform policy. Returns `NOT_FOUND` if the policy doesn't exist.

## Path parameters

- `name` string, required

## Request body

- PlatformPolicy — A Binary Authorization platform policy for deployments on various platforms.
  - `name` string — Output only. The relative resource name of the Binary Authorization platform policy, in the form of `projects/*/platforms/*/policies/*`.
  - `updateTime` string, google-datetime — Output only. Time when the policy was last updated.
  - `description` string — Optional. A description comment about the policy.
  - `etag` string — Optional. Used to prevent updating the policy when another request has updated it since it was retrieved.
  - `gkePolicy` GkePolicy — A Binary Authorization policy for a GKE cluster. This is one type of policy that can occur as a `PlatformPolicy`.
    - `imageAllowlist` ImageAllowlist — Images that are exempted from normal checks based on name pattern only.
      - `allowPattern` string[] — Required. A disjunction of image patterns to allow. If any of these patterns match, then the image is considered exempted by this allowlist.
    - `checkSets` CheckSet[] — Optional. The `CheckSet` objects to apply, scoped by namespace or namespace and service account. Exactly one `CheckSet` will be evaluated for a given Pod (unless the list is empty, in which case the behavior is "always allow"). If multiple `CheckSet` objects have scopes that match the namespace and service account of the Pod being evaluated, only the `CheckSet` with the MOST SPECIFIC scope will match. `CheckSet` objects must be listed in order of decreasing specificity, i.e. if a scope matches a given service account (which must include the namespace), it must come before a `CheckSet` with a scope matching just that namespace. This property is enforced by server-side validation. The purpose of this restriction is to ensure that if more than one `CheckSet` matches a given Pod, the `CheckSet` that will be evaluated will always be the first in the list to match (because if any other matches, it must be less specific). If `check_sets` is empty, the default behavior is to allow all images. If `check_sets` is non-empty, the last `check_sets` entry must always be a `CheckSet` with no scope set, i.e. a catchall to handle any situation not caught by the preceding `CheckSet` objects.
      - `scope` Scope — A scope specifier for `CheckSet` objects.
        - `kubernetesServiceAccount` string — Optional. Matches a single Kubernetes service account, e.g. `my-namespace:my-service-account`. `kubernetes_service_account` scope is always more specific than `kubernetes_namespace` scope for the same namespace.
        - `kubernetesNamespace` string — Optional. Matches all Kubernetes service accounts in the provided namespace, unless a more specific `kubernetes_service_account` scope already matched.
      - `displayName` string — Optional. A user-provided name for this `CheckSet`. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
      - `imageAllowlist` ImageAllowlist — Images that are exempted from normal checks based on name pattern only.
        - `allowPattern` string[] — Required. A disjunction of image patterns to allow. If any of these patterns match, then the image is considered exempted by this allowlist.
      - `checks` Check[] — Optional. The checks to apply. The ultimate result of evaluating the check set will be "allow" if and only if every check in `checks` evaluates to "allow". If `checks` is empty, the default behavior is "always allow".
        - `slsaCheck` SlsaCheck — A SLSA provenance attestation check, which ensures that images are built by a trusted builder using source code from its trusted repositories only.
          - `rules` VerificationRule[] — Specifies a list of verification rules for the SLSA attestations. An image is considered compliant with the SlsaCheck if any of the rules are satisfied.
            - `trustedBuilder` 'BUILDER_UNSPECIFIED' | 'GOOGLE_CLOUD_BUILD' — Each verification rule is used for evaluation against provenances generated by a specific builder (group). For some of the builders, such as the Google Cloud Build, users don't need to explicitly specify their roots of trust in the policy since the evaluation service can automatically fetch them based on the builder (group).
            - `trustedSourceRepoPatterns` string[] — List of trusted source code repository URL patterns. These patterns match the full repository URL without its scheme (e.g. `https://`). The patterns must not include schemes. For example, the pattern `source.cloud.google.com/my-project/my-repo-name` matches the following URLs: - `source.cloud.google.com/my-project/my-repo-name` - `git+ssh://source.cloud.google.com/my-project/my-repo-name` - `https://source.cloud.google.com/my-project/my-repo-name` A pattern matches a URL either exactly or with `*` wildcards. `*` can be used in only two ways: 1. trailing `*` after hosturi/ to match varying endings; 2. trailing `**` after hosturi/ to match `/` as well. `*` and `**` can only be used as wildcards and can only occur at the end of the pattern after a `/`. (So it's not possible to match a URL that contains literal `*`.) For example: - `github.com/my-project/my-repo` is valid to match a single repo - `github.com/my-project/*` will match all direct repos in `my-project` - `github.com/**` matches all repos in GitHub
            - `attestationSource` AttestationSource — Specifies the locations for fetching the provenance attestations.
              - …
            - `configBasedBuildRequired` boolean — If true, require the image to be built from a top-level configuration. `trusted_source_repo_patterns` specifies the repositories containing this configuration.
            - `customConstraints` string — Optional. A CEL expression for specifying custom constraints on the provenance payload. This can be used when users want to specify expectations on provenance fields that are not covered by the general check. For example, users can use this field to require that certain parameters should never be used during the build process.
        - `displayName` string — Optional. A user-provided name for this check. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
        - `vulnerabilityCheck` VulnerabilityCheck — An image vulnerability check, which rejects images that violate the configured vulnerability rules.
          - `allowedCves` string[] — Optional. A list of specific CVEs to ignore even if the vulnerability level violates `maximumUnfixableSeverity` or `maximumFixableSeverity`. CVEs are listed in the format of Container Analysis note id. For example: - CVE-2021-20305 - CVE-2020-10543 The CVEs are applicable regardless of note provider project, e.g., an entry of `CVE-2021-20305` will allow vulnerabilities with a note name of either `projects/goog-vulnz/notes/CVE-2021-20305` or `projects/CUSTOM-PROJECT/notes/CVE-2021-20305`.
          - `maximumUnfixableSeverity` 'MAXIMUM_ALLOWED_SEVERITY_UNSPECIFIED' | 'BLOCK_ALL' | 'MINIMAL' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'ALLOW_ALL' — Required. The threshold for severity for which a fix isn't currently available. This field is required and must be set.
          - `blockedCves` string[] — Optional. A list of specific CVEs to always raise warnings about even if the vulnerability level meets `maximumUnfixableSeverity` or `maximumFixableSeverity`. CVEs are listed in the format of Container Analysis note id. For example: - CVE-2021-20305 - CVE-2020-10543 The CVEs are applicable regardless of note provider project, e.g., an entry of `CVE-2021-20305` will block vulnerabilities with a note name of either `projects/goog-vulnz/notes/CVE-2021-20305` or `projects/CUSTOM-PROJECT/notes/CVE-2021-20305`.
          - `maximumFixableSeverity` 'MAXIMUM_ALLOWED_SEVERITY_UNSPECIFIED' | 'BLOCK_ALL' | 'MINIMAL' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'ALLOW_ALL' — Required. The threshold for severity for which a fix is currently available. This field is required and must be set.
          - `containerAnalysisVulnerabilityProjects` string[] — Optional. The projects where vulnerabilities are stored as Container Analysis Occurrences. Each project is expressed in the resource format of `projects/[PROJECT_ID]`, e.g., `projects/my-gcp-project`. An attempt will be made for each project to fetch vulnerabilities, and all valid vulnerabilities will be used to check against the vulnerability policy. If no valid scan is found in all projects configured here, an error will be returned for the check. Maximum number of `container_analysis_vulnerability_projects` allowed in each `VulnerabilityCheck` is 10.
        - `imageAllowlist` ImageAllowlist — Images that are exempted from normal checks based on name pattern only.
          - `allowPattern` string[] — Required. A disjunction of image patterns to allow. If any of these patterns match, then the image is considered exempted by this allowlist.
        - `imageFreshnessCheck` ImageFreshnessCheck — An image freshness check, which rejects images that were uploaded before the set number of days ago to the supported repositories.
          - `maxUploadAgeDays` integer — Required. The max number of days that is allowed since the image was uploaded. Must be greater than zero.
        - `trustedDirectoryCheck` TrustedDirectoryCheck — A trusted directory check, which rejects images that do not come from the set of user-configured trusted directories.
          - `trustedDirPatterns` string[] — Required. List of trusted directory patterns. A pattern is in the form "registry/path/to/directory". The registry domain part is defined as two or more dot-separated words, e.g., `us.pkg.dev`, or `gcr.io`. Additionally, `*` can be used in three ways as wildcards: 1. leading `*` to match varying prefixes in registry subdomain (useful for location prefixes); 2. trailing `*` after registry/ to match varying endings; 3. trailing `**` after registry/ to match "/" as well. For example: -- `gcr.io/my-project/my-repo` is valid to match a single directory -- `*-docker.pkg.dev/my-project/my-repo` or `*.gcr.io/my-project` are valid to match varying prefixes -- `gcr.io/my-project/*` will match all direct directories in `my-project` -- `gcr.io/my-project/**` would match all directories in `my-project` -- `gcr.i*` is not allowed since the registry is not completely specified -- `sub*domain.gcr.io/nginx` is not valid because only leading `*` or trailing `*` are allowed. -- `*pkg.dev/my-project/my-repo` is not valid because leading `*` can only match subdomain -- `**-docker.pkg.dev` is not valid because one leading `*` is allowed, and that it cannot match `/`
        - `sigstoreSignatureCheck` SigstoreSignatureCheck — A Sigstore signature check, which verifies the Sigstore signature associated with an image.
          - `sigstoreAuthorities` SigstoreAuthority[] — Required. The authorities required by this check to verify the signature. A signature only needs to be verified by one authority to pass the check.
            - `displayName` string — Optional. A user-provided name for this `SigstoreAuthority`. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
            - `publicKeySet` SigstorePublicKeySet — A bundle of Sigstore public keys, used to verify Sigstore signatures. A signature is authenticated by a `SigstorePublicKeySet` if any of the keys verify it.
              - …
        - `simpleSigningAttestationCheck` SimpleSigningAttestationCheck — Require a signed [DSSE](https://github.com/secure-systems-lab/dsse) attestation with type SimpleSigning.
          - `attestationAuthenticators` AttestationAuthenticator[] — Required. The authenticators required by this check to verify an attestation. Typically this is one or more PKIX public keys for signature verification. Only one authenticator needs to consider an attestation verified in order for an attestation to be considered fully authenticated. In otherwords, this list of authenticators is an "OR" of the authenticator results. At least one authenticator is required.
            - `displayName` string — Optional. A user-provided name for this `AttestationAuthenticator`. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
            - `pkixPublicKeySet` PkixPublicKeySet — A bundle of PKIX public keys, used to authenticate attestation signatures. Generally, a signature is considered to be authenticated by a `PkixPublicKeySet` if any of the public keys verify it (i.e. it is an "OR" of the keys).
              - …
          - `containerAnalysisAttestationProjects` string[] — Optional. The projects where attestations are stored as Container Analysis Occurrences, in the format `projects/[PROJECT_ID]`. Only one attestation needs to successfully verify an image for this check to pass, so a single verified attestation found in any of `container_analysis_attestation_projects` is sufficient for the check to pass. A project ID must be used, not a project number. When fetching Occurrences from Container Analysis, only `AttestationOccurrence` kinds are considered. In the future, additional Occurrence kinds may be added to the query. Maximum number of `container_analysis_attestation_projects` allowed in each `SimpleSigningAttestationCheck` is 10.
        - `alwaysDeny` boolean — Optional. A special-case check that always denies. Note that this still only applies when the scope of the `CheckSet` applies and the image isn't exempted by an image allowlist. This check is primarily useful for testing, or to set the default behavior for all unmatched scopes to "deny".

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/binaryauthorization.md) · [All operations](https://skmtc.dev/google/apis/binaryauthorization/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/binaryauthorization/revisions/4e59b7e236cd/schema)