Container supply chain security in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Binary Authorization on a GKE cluster.

GCP

gcloud container clusters update my-cluster --enable-[1]

Drag options to blanks, or click blank then click option'

Alogging

Bautoscaling

Cbinary-authorization

Dmonitoring

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing Binary Authorization with autoscaling or monitoring features.

Using incorrect flag names.

Enabling binary-authorization activates supply chain security for container images on the cluster.

2fill in blank

medium

Complete the command to create a new attestor for Binary Authorization.

GCP

gcloud container binauthz attestors create my-attestor --project=my-project --attestation-authority-note=[1]

Drag options to blanks, or click blank then click option'

Amy-note

Bmy-cluster

Cmy-image

Dmy-key

Attempts:

3 left

💡 Hint

Common Mistakes

Using cluster or image names instead of the note name.

Confusing keys with notes.

The attestation-authority-note links the attestor to a specific note in Container Analysis.

3fill in blank

hard

Fix the error in the policy binding to allow the attestor service account to attest images.

GCP

gcloud projects add-iam-policy-binding my-project --member='serviceAccount:[1]' --role='roles/containeranalysis.attestor'

Drag options to blanks, or click blank then click option'

[e-mail]

[e-mail]

[e-mail]

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect service account names.

Confusing roles or members.

The service account for the attestor must be correctly specified to grant attestation permissions.

4fill in blank

hard

Fill both blanks to define a policy that enforces attestation on images from a specific registry.

GCP

"apiVersion: binaryauthorization.googleapis.com/v1
kind: Policy
metadata:
  name: default
spec:
  admissionWhitelistPatterns:
  - namePattern: 'gcr.io/my-project/[1]'
  clusterAdmissionRules:
    my-cluster:
      evaluationMode: [2]
      enforcementMode: ENFORCED"

Drag options to blanks, or click blank then click option'

Amy-app

BALWAYS_ALLOW

CREQUIRE_ATTESTATION

DNEVER_ALLOW

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect evaluation modes like ALWAYS_ALLOW.

Wrong image path patterns.

The namePattern specifies the container image path, and evaluationMode set to REQUIRE_ATTESTATION enforces attestation checks.

5fill in blank

hard

Fill all three blanks to create a container analysis note with a public key for attestation verification.

GCP

gcloud container binauthz attestors create my-attestor \
  --project=my-project \
  --attestation-authority-note=[1] \
  --attestation-authority-note-project=my-project \
  --public-keys=ascii-armored-pgp-key=[2],id=[3]

Drag options to blanks, or click blank then click option'

Amy-note

B-----BEGIN PGP PUBLIC KEY BLOCK-----\n...

C1234567890abcdef

Dmy-key

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect key formats or missing the key ID.

Confusing note names with key names.

The note name, the ASCII armored PGP public key, and the key ID are required to create an attestor for verifying signatures.