Policy Document.

GET

/api/secret_management/namespaces/{namespace}/secret_policys/{name}/get_policy_document

curl --request GET \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/secret_management/namespaces/example/secret_policys/example/get_policy_document \
  --header 'Authorization: <Authorization>'

• F5 Distributed Cloud Console

GetPolicyDocument API returns secret policy document for the given policy that contains information about all the rules in the policy and policy_id. This document can be given to F5 Distributed Cloud secret management tool to do secret encryption.

Examples of this operation.

Authorizations

• ApiToken

Parameters

Path Parameters

namespace

required

string

Namespace

x-required Namespace of the secret policy.

name

required

string

Name

x-required Name of the secret policy.

Responses

200

A successful response.

Media typeapplication/json

GetPolicyDocumentResponse

Policy Document contains the information about the secret policy and all the secret policy rules for the policy. This document can be given to F5 Distributed Cloud secret management tool to do secret encryption.

object

data

object

name

name

Name of the policy.

string

>= 6 characters <= 1024 characters

namespace

namespace

Namespace of the policy.

string

>= 6 characters <= 1024 characters

policy_id

policy_id

PolicyID for the policy. PolicyID is an integer ID which uniquely identifies the policy in given tenant.

string format: uint64

<= 1024 characters

policy_info

object

algo

string

default: FIRST_MATCH

Allowed values: FIRST_MATCH DENY_OVERRIDES ALLOW_OVERRIDES

rules

Rules

A list of references to secret_policy_rule objects. The order of evaluation of the rules depends on the rule combining algorithm.

Array<object>

Secret Policy Rule Specifications

A secret_policy_rule object consists of an unordered list of predicates and an action. The predicates are evaluated against a set of input fields that are extracted from client certificate. A rule is considered to match if all predicates in the rule evaluate to true for that request. Any predicates that are not specified in a rule are implicitly considered to be true. If a rule is matched, the action specified for the rule is enforced for that request.

A secret_policy_rule can be part of exactly one secret_policy and must belong to the same namespace as the secret policy.

object

action

string

default: DENY

Allowed values: DENY ALLOW NEXT_POLICY

client_name

client name

Exclusive with [client_name_matcher client_selector] The name of the client trying to access the secret. Name of the client will be extracted from client TLS certificate. This predicate evaluates to true if client name matches the configured name.

string

<= 256 characters

client_name_matcher

object

exact_values

exact values

A list of exact values to match the input against.

Array<string>

<= 64 items

regex_values

regex values

A list of regular expressions to match the input against.

Array<string>

<= 16 items

transformers

transformers

An ordered list of transformers (starting from index 0) to be applied to the path before matching.

Array<string>

<= 9 items

Allowed values: LOWER_CASE UPPER_CASE BASE64_DECODE NORMALIZE_PATH REMOVE_WHITESPACE URL_DECODE TRIM_LEFT TRIM_RIGHT TRIM

client_selector

object

expressions

expressions

Expressions contains the Kubernetes style label expression for selections. Required: YES.

Array<string>

<= 1 items

tenant

tenant

Tenant for the policy.

string

>= 6 characters <= 1024 characters

Example

{
  "data": {
    "policy_info": {
      "algo": "FIRST_MATCH",
      "rules": [
        {
          "action": "DENY",
          "client_name_matcher": {
            "transformers": [
              "LOWER_CASE"
            ]
          }
        }
      ]
    }
  }
}

401

Returned when operation is not authorized.

Media typeapplication/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

Media typeapplication/json

string format: string

Example^generated

example

404

Returned when resource is not found.

Media typeapplication/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

Media typeapplication/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

Media typeapplication/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

Media typeapplication/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

Media typeapplication/json

string format: string

Example^generated

example