Get started using the Google Cloud CLI (GKE)

This tutorial shows how to configure and test a Binary Authorization policy that requires attestations. This type of policy secures your container-based software supply chain by verifying that a container image has a signed attestation before allowing deployment of the image.

At deploy time, Binary Authorization uses attestors to verify digital signatures in attestations. The attestations are created by signers, usually as part of a continuous integration (CI) pipeline.

In this tutorial, the GKE cluster, attestations, and attestors are all located in a single project. A single-project configuration is mostly useful for testing or experimenting with the service. For a more real-world example, see multi-project configuration.

The following steps describe tasks that you perform at the command line. To follow these steps using Google Cloud console, see Get started using the Google Cloud console.

Objectives

In this tutorial, you do the following:

  • Create a Google Kubernetes Engine (GKE) cluster with Binary Authorization enabled
  • Create an attestor that the Binary Authorization enforcer uses to verify the signature on an attestation
  • Configure a policy that requires an attestation
  • Create a cryptographic key pair to sign attestations and later verify them
  • Sign a container image digest, creating a signature
  • Create an attestation using the signature
  • Test the policy by deploying a container image to GKE

Costs

In this document, you use the following billable components of Google Cloud:

To generate a cost estimate based on your projected usage, use the pricing calculator.

New Google Cloud users might be eligible for a free trial.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Install the Google Cloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command: 

    gcloud init

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.