Binary Authorization for containers in GCP - Mini Project: Build & Apply

Binary Authorization for Containers on Google Cloud

📖 Scenario: You are working on a Google Cloud project where you want to ensure that only trusted container images are deployed to your Kubernetes clusters. To do this, you will set up Binary Authorization, a security feature that enforces image signing policies before deployment.

🎯 Goal: Set up Binary Authorization by creating a policy that requires container images to be signed by a trusted authority before deployment to Google Kubernetes Engine (GKE).

📋 What You'll Learn

Create a Binary Authorization policy with a trusted attestor

Configure the attestor with a public key

Apply the policy to the Google Cloud project

Enable enforcement of the policy on GKE clusters

💡 Why This Matters

🌍 Real World

Binary Authorization helps organizations prevent untrusted or vulnerable container images from running in their Kubernetes clusters, improving security and compliance.

💼 Career

Cloud engineers and security specialists use Binary Authorization to enforce security policies in containerized environments, a critical skill for secure cloud deployments.

1

Create a Binary Authorization policy JSON file

Create a JSON file named policy.json with the following content exactly: a defaultAdmissionRule that requires attestation with enforcement mode set to ENFORCED_BLOCK_AND_AUDIT_LOG.

GCP

{
  "defaultAdmissionRule": {
    "enforcementMode": "ENFORCED_BLOCK_AND_AUDIT_LOG",
    "requireAttestationsBy": []
  }
}
# Create the policy.json file with the above content

Hint

This JSON defines the default rule that enforces image attestation before deployment.

2

Add a trusted attestor to the policy

Modify the policy.json file to add a trusted attestor by adding its full resource name projects/my-project/attestors/my-attestor inside the requireAttestationsBy list.

GCP

{
  "defaultAdmissionRule": {
    "enforcementMode": "ENFORCED_BLOCK_AND_AUDIT_LOG",
    "requireAttestationsBy": [
      "projects/my-project/attestors/my-attestor"
    ]
  }
}
# Add the attestor resource name inside requireAttestationsBy

Hint

The attestor resource name must be inside the requireAttestationsBy array.

3

Create a trusted attestor with a public key

Use the gcloud command to create an attestor named my-attestor in project my-project with a public key file located at public_key.pem. Write the exact command starting with gcloud container binauthz attestors create my-attestor and include the project flag and public key file.

GCP

# Your command here to create the attestor with the public key

Hint

Use the gcloud container binauthz attestors create command with the correct flags.

4

Apply the Binary Authorization policy to the project

Use the gcloud command to update the Binary Authorization policy for project my-project by applying the policy.json file. Write the exact command starting with gcloud container binauthz policy import policy.json and include the project flag.

GCP

# Your command here to import the policy.json file

Hint

Use the gcloud container binauthz policy import command to apply the policy.

Practice

1. What is the main purpose of Binary Authorization in Google Cloud?

easy

A. To allow only trusted container images to run

B. To speed up container deployment

C. To monitor network traffic between containers

D. To automatically scale container clusters

Solution

1. Step 1: Understand Binary Authorization's role

   Binary Authorization is designed to protect cloud environments by ensuring only trusted container images are deployed.

2. Step 2: Identify the main function

   It uses policies and signatures to verify container images before they run, preventing untrusted code execution.

3. Final Answer:

   To allow only trusted container images to run -> Option A

4. Quick Check:

   Binary Authorization = Trusted container enforcement [OK]

Hint: Binary Authorization controls which containers can run [OK]

Common Mistakes:

• Confusing it with scaling or monitoring tools
• Thinking it speeds up deployment
• Assuming it manages network traffic

2. Which of the following is the correct way to enable Binary Authorization on a Google Kubernetes Engine (GKE) cluster?

easy

A. gcloud container clusters create my-cluster --enable-binauthz

B. gcloud container clusters create my-cluster --enable-auth-binary

C. gcloud container clusters create my-cluster --enable-binary-auth

D. gcloud container clusters create my-cluster --enable-binary-authorization

Solution

1. Step 1: Recall the correct flag for enabling Binary Authorization

   The official gcloud command uses the flag --enable-binary-authorization to enable this feature on a GKE cluster.

2. Step 2: Compare options

   Only gcloud container clusters create my-cluster --enable-binary-authorization uses the exact correct flag syntax; others are incorrect or invalid flags.

3. Final Answer:

   gcloud container clusters create my-cluster --enable-binary-authorization -> Option D

4. Quick Check:

   Enable Binary Authorization flag = --enable-binary-authorization [OK]

Hint: Look for the full phrase 'binary-authorization' in the flag [OK]

Common Mistakes:

• Using shortened or incorrect flag names
• Mixing up flag order or syntax
• Assuming 'binauthz' is the flag

3. Consider this policy snippet for Binary Authorization:

{
  "attestors": ["projects/my-project/attestors/my-attestor"],
  "defaultAdmissionRule": {
    "enforcementMode": "ENFORCED",
    "requireAttestationsBy": ["projects/my-project/attestors/my-attestor"]
  }
}

What happens if a container image is not signed by the specified attestor?

medium

A. The container image will be deployed but logged

B. The container image will be blocked from deployment

C. The container image will be deployed without checks

D. The container image will be automatically signed

Solution

1. Step 1: Analyze the enforcement mode

   The policy sets "enforcementMode" to "ENFORCED", meaning only images meeting the policy are allowed.

2. Step 2: Check attestation requirement

   The policy requires attestations by the specified attestor. Unsigned images do not meet this requirement.

3. Final Answer:

   The container image will be blocked from deployment -> Option B

4. Quick Check:

   Enforced mode + missing signature = block deployment [OK]

Hint: Enforced mode means no unsigned images allowed [OK]

Common Mistakes:

• Confusing enforcement with audit mode
• Thinking unsigned images are allowed with logs
• Assuming automatic signing happens

4. You configured Binary Authorization but your container deployments are failing unexpectedly. Which of the following is a likely cause?

medium

A. The attestor's public key is not correctly configured

B. The cluster does not have enough CPU resources

C. The container image is too large

D. The network firewall blocks container traffic

Solution

1. Step 1: Identify Binary Authorization failure reasons

   Binary Authorization failures often happen if the attestor's public key is missing or misconfigured, preventing signature verification.

2. Step 2: Eliminate unrelated causes

   CPU resources, image size, and network firewall issues do not directly cause Binary Authorization failures.

3. Final Answer:

   The attestor's public key is not correctly configured -> Option A

4. Quick Check:

   Signature verification fails if attestor key is wrong [OK]

Hint: Check attestor keys first when deployments fail [OK]

Common Mistakes:

• Blaming resource or network issues for auth failures
• Ignoring attestor key setup
• Assuming image size affects authorization

5. You want to test your Binary Authorization policy without blocking any container deployments. Which mode should you use and why?

hard

A. Disabled mode, to turn off Binary Authorization temporarily

B. Enforced mode, to block all untrusted images immediately

C. Audit mode, to log policy violations without blocking deployments

D. Strict mode, to require multiple attestations

Solution

1. Step 1: Understand Binary Authorization modes

   Audit mode allows policy violations to be logged but does not block container deployments, ideal for testing.

2. Step 2: Compare other modes

   Enforced mode blocks untrusted images, Disabled mode turns off checks, and Strict mode is not a standard mode.

3. Final Answer:

   Audit mode, to log policy violations without blocking deployments -> Option C

4. Quick Check:

   Audit mode = test without blocking [OK]

Hint: Use audit mode to test policies safely [OK]

Common Mistakes:

• Confusing audit with enforced mode
• Thinking disabled mode logs violations
• Assuming strict mode exists