Binary Authorization

Google Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed to GKE or Cloud Run. It works by requiring cryptographic attestations that images have passed required security checks before they can be deployed.

Key Features:

1. Attestation-based - Requires signed attestations from authorized attestors before allowing deployment.

2. Policy enforcement - Define policies that specify which images and attestors are trusted.

3. CI/CD integration - Integrate with Cloud Build to automatically attest images after security checks pass.

4. Break-glass - Emergency bypass mechanism with full audit trail for production incidents.

5. Dry-run mode - Test policies without blocking deployments to validate before enforcing.

The below example shows how to set up Binary Authorization with an attestor and policy.

It gives the following output,

Attestor [my-attestor] created.
Key added to attestor successfully.

Attestation created for:
  Image: gcr.io/my-project/my-app@sha256:abc123...
  Attestor: my-attestor
  Status: SIGNED

Deployment to GKE: ALLOWED (attestation verified)

Binary Authorization Workflow:

1. Developer pushes code to Cloud Source Repositories or GitHub.

2. Cloud Build triggers and runs tests, vulnerability scans, and compliance checks.

3. If all checks pass, Cloud Build creates a cryptographic attestation.

4. When deploying to GKE, Binary Authorization policy verifies the attestation exists.

5. If attestation is missing or invalid, deployment is blocked.