This page provides instructions for configuring a Binary Authorization policy by using the Google Cloud console. As an alternative, you can perform these tasks by using the Google Cloud CLI or the REST API. This step is part of setting up Binary Authorization.
A policy is a set of rules that govern the deployment of one or more container images.
Before you begin
Enable Binary Authorization for your platform:
Google Kubernetes Engine (GKE) users: Create a cluster with Binary Authorization enabled.
Cloud Run users: Enable Binary Authorization on your service.
If you intend to use attestations, we recommend that you create attestors before configuring the policy. You can create attestors using the Google Cloud console or through a command-line tool.
Select the project ID for the project in which you enabled Binary Authorization.
Set the default rule
This section applies to GKE, GKE Multi-Cloud, Distributed Cloud, Cloud Run, and Cloud Service Mesh.
A rule is the part of a policy that defines constraints that images must satisfy before they can be deployed. The default rule defines constraints that apply to all non-exempt container images that don't have their own cluster-specific rules. Every policy has a default rule.
To set the default rule, do the following:
In the Google Cloud console, go to the Binary Authorization page.
Click the Policy tab.
Click Edit Policy.
Set the evaluation mode for the default rule.
The evaluation mode specifies the type of constraint that Binary Authorization enforces at deploy time. To set the evaluation mode, select one of the following options:
- Allow all images: Allows all images to be deployed.
- Deny all images: Disallows all images from being deployed.
- Allow only images that have been approved by the following attestors: Allows an image to be deployed if the image has one or more attestations that can be verified by all of the attestors that you add to this rule. To learn about creating attestors, see Creating attestors.
If you selected Allow only images that have been approved by the following attestors:
Get the name or resource ID of your attestor.
In the Google Cloud console, on the Attestors page, you can view your existing attestors, or create a new one.
Click Add Attestors.
Select one of the following options:
Add by project and attestor name
The project refers to the project ID of the project that stores your attestors. An example of an attestor name is
build-qa.Add by attestor resource ID
A resource ID has the format:
projects/PROJECT_ID/attestors/ATTESTOR_NAME
Under Attestors, enter appropriate value(s) for the option you selected.
Click Add Another Attestor if you want to add additional attestors.
Click Add Attestor(s) to save the rule.
If you want to enable dry run mode, do the following:
Select Dry Run Mode.
Click Save Policy.
Set cluster-specific rules (optional)
This section applies to GKE, Distributed Cloud, and Cloud Service Mesh.
A policy can also have one or more cluster-specific rules. This type of rule applies to container images that are to be deployed to specific Google Kubernetes Engine (GKE) clusters only. Cluster-specific rules are an optional part of a policy.
Add a cluster-specific rule (GKE)
This section applies to GKE and Distributed Cloud.
To add a cluster-specific rule for a GKE cluster, do the following:
In the Google Cloud console, go to the Binary Authorization page.
Click the Policy tab.
Click Edit Policy.
Expand the Additional settings for GKE deployments section.
If no specific rule type is set, click Create Specific Rules.
To select the rule type, click Specific Rule Type.
To change the rule type, click Change.
Click Add Specific Rule.
In the Cluster resource ID field, enter the resource ID for the cluster.
The resource ID for the cluster has the format
LOCATION.NAME, for example,us-central1-a.test-cluster.Set the evaluation mode for the default rule.
The evaluation mode specifies the type of constraint that Binary Authorization enforces at deploy time. To set the evaluation mode, select one of the following options:
- Allow all images: Allows all images to be deployed.
- Deny all images: Disallows all images from being deployed.
- Allow only images that have been approved by the following attestors: Allows an image to be deployed if the image has one or more attestations that can be verified by all of the attestors that you add to this rule. To learn about creating attestors, see Creating attestors.
If you selected Allow only images that have been approved by the following attestors:
Get the name or resource ID of your attestor.
In the Google Cloud console, on the Attestors page, you can view your existing attestors, or create a new one.
Click Add Attestors.
Select one of the following options:
Add by project and attestor name
The project refers to the project ID of the project that stores your attestors. An example of an attestor name is
build-qa.Add by attestor resource ID
A resource ID has the format:
projects/PROJECT_ID/attestors/ATTESTOR_NAME
Under Attestors, enter appropriate value(s) for the option you selected.
Click Add Another Attestor if you want to add additional attestors.
Click Add Attestor(s) to save the rule.
Click Add to add the cluster-specific rule.
You might see a message that reads, "It looks like this cluster doesn't exist. This rule will still take effect if this cluster becomes available in GKE in the future." If so, click Add again to save the rule.
If you want to enable dry run mode, select Dry Run Mode.
Click Save Policy.