You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/governance/policy/concepts/effects.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -207,7 +207,7 @@ definitions as `constraintTemplate` is deprecated.
207
207
- An empty or missing value causes policy evaluation to include all labels and selectors, except
208
208
namespaces defined in _excludedNamespaces_.
209
209
-**scope** (optional)
210
-
- A _string_ that includes the [scope](https://open-policy-agent.github.io/gatekeeper/website/docs/howto/#the-match-field) property to allow specifying if cluster-scoped or namespaced-scoped resources are matched.
210
+
- A _string_ that includes the [scope](https://open-policy-agent.github.io/gatekeeper/website/docs/howto/#the-match-field) property to allow specifying if cluster-scoped or namespaced-scoped resources are matched.
211
211
-**apiGroups** (required when using _templateInfo_)
212
212
- An _array_ that includes the
213
213
[API groups](https://kubernetes.io/docs/reference/using-api/#api-groups) to match. An empty
@@ -284,11 +284,11 @@ related resources to match.
284
284
However, an [audit](#audit) effect should be considered instead.
285
285
286
286
> [!NOTE]
287
-
>
287
+
>
288
288
> **Type** and **Name** segments can be combined to generically retrieve nested resources.
289
-
>
290
-
> To retrieve a specific resource, you can use `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/nestedResourceName"`.
291
-
>
289
+
>
290
+
> To retrieve a specific resource, you can use `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/nestedResourceName"`.
291
+
>
292
292
> To retrieve a collection of nested resources, a wildcard character `?` can be provided in place of the last name segment. For example, `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/?"`. This can be combined with field functions to access resources related to the evaluated resource, such as `"name": "[concat(field('name'), '/?')]"`."
293
293
294
294
-**ResourceGroupName** (optional)
@@ -587,11 +587,11 @@ related resources to match and the template deployment to execute.
587
587
becomes _required_ and must be `[field('name')]`, or `[field('fullName')]` for a child resource.
588
588
589
589
> [!NOTE]
590
-
>
590
+
>
591
591
> **Type** and **Name** segments can be combined to generically retrieve nested resources.
592
-
>
593
-
> To retrieve a specific resource, you can use `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/nestedResourceName"`.
594
-
>
592
+
>
593
+
> To retrieve a specific resource, you can use `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/nestedResourceName"`.
594
+
>
595
595
> To retrieve a collection of nested resources, a wildcard character `?` can be provided in place of the last name segment. For example, `"type": "Microsoft.ExampleProvider/exampleParentType/exampleNestedType"` and `"name": "parentResourceName/?"`. This can be combined with field functions to access resources related to the evaluated resource, such as `"name": "[concat(field('name'), '/?')]"`."
596
596
597
597
-**ResourceGroupName** (optional)
@@ -721,7 +721,7 @@ of that policy's assignments.
721
721
> Policy definitions that use the **Disabled** effect have the default compliance state **Compliant** after assignment.
722
722
723
723
An alternative to the **Disabled** effect is **enforcementMode**, which is set on the policy assignment.
724
-
When **enforcementMode** is **Disabled**_**, resources are still evaluated. Logging, such as Activity
724
+
When **enforcementMode** is **Disabled**, resources are still evaluated. Logging, such as Activity
725
725
logs, and the policy effect don't occur. For more information, see
0 commit comments