Get started using the Google Cloud console (GKE)

This tutorial shows how to configure and test a Binary Authorization policy that requires attestations. This type of policy secures your container-based software supply chain by defining who can deploy container images on Google Kubernetes Engine (GKE) and which container images GKE is allowed to deploy.

At deploy time, Binary Authorization uses attestors to verify digital signatures in attestations. The attestations were created by signers as part of the build process.

In this tutorial, the GKE cluster, attestations, and attestors are all located in a single project. A single-project configuration is mostly useful for testing or experimenting with the service. For a more real-world example, see multi-project configuration.

The steps below describe tasks that you perform from Google Cloud console, as well as some tasks you perform using gcloud commands. To perform these steps using gcloud, see Get started using the Google Cloud CLI.

Objectives

In this tutorial, you learn how to:

  • Create a (GKE) cluster with Binary Authorization enabled
  • Create an attestor that the Binary Authorization enforcer uses to verify the signature on an attestation
  • Configure a policy that requires an attestation
  • Create a cryptographic key pair to sign attestations and later verify them
  • Sign a container image digest, creating a signature
  • Create an attestation using the signature
  • Test the policy by deploying a container image to GKE

Costs

In this document, you use the following billable components of Google Cloud:

To generate a cost estimate based on your projected usage, use the pricing calculator.

New Google Cloud users might be eligible for a free trial.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Container Registry, Artifact Analysis and Binary Authorization APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  5. Install the Google Cloud CLI.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. To initialize the gcloud CLI, run the following command: 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Container Registry, Artifact Analysis and Binary Authorization APIs.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the APIs

  11. Install the Google Cloud CLI.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. To initialize the gcloud CLI, run the following command: 

    gcloud init
  14. Install kubectl.

Set the default project

To facilitate commands that follow, store your Google Cloud project ID in an environment variable as follows:

PROJECT_ID=PROJECT_ID

where PROJECT_ID is the name of your project.

If the default project is not selected, set it now:

gcloud config set project ${PROJECT_ID}

Create a cluster with Binary Authorization enabled

Create the cluster

Now you can create a GKE cluster with Binary Authorization enabled. Here, you create a cluster named test-cluster in the GKE zone us-central1-a.

To create the cluster, follow these steps:

  1. Visit the GKE menu in Google Cloud console.

    Go to GKE

  2. Click Create Cluster.

  3. Enter test-cluster in the Name field.

  4. Select Zonal in the Location type options.

  5. Select us-central1-a from the Zone drop-down list.

  6. Click Availability, networking, security, and additional features.

  7. In the Security section, select Enable Binary Authorization.

  8. Select Enforce-only.

  9. Click Create.

Configure kubectl

You must also update the local kubeconfig file for your kubectl installation. This provides the credentials and endpoint information required to access the cluster in GKE.

To update the local kubeconfig file, follow these steps:

gcloud container clusters get-credentials \
    --zone us-central1-a \
    test-cluster

View the default policy

A policy in Binary Authorization is a set of rules that govern the deployment of container images. You can have one policy per project. By default, the policy is configured to allow all container images to be deployed.

To view the default policy, follow these steps:

  1. Go to the Binary Authorization page in the Google Cloud console.

    Go to Binary Authorization