Binary Authorization concepts

This page contains information about concepts related to Binary Authorization.

Policies

A Binary Authorization policy, also known as a project-singleton policy, is a set of rules that govern the deployment of container images.

Continuous validation (CV), uses a different type of policy, called a platform policy.

A policy has the following parts:

You can configure a policy using one of the following:

  • Google Cloud console
  • gcloud commands

When you use gcloud commands, you export and modify a definition of the policy in YAML format before importing it back to your project. The YAML format reflects the internal structure of a policy in Binary Authorization storage. For more information about this format, see Policy YAML Reference.

Each Google Cloud project can have exactly one policy. You must configure the policy in the project where you run your deployment platform. In a single-project configuration, the policy and all subordinate resources—attestors and attestations—reside in the same project. To establish separation of duties, you can use a multi-project configuration. In this configuration, the deployment platform can run in one project, attestors can reside in another project, and attestations can reside in still another project.

To set up and use Binary Authorization on supported platforms, see Set up by platform.

See an example multi-project setup for GKE.

Rules