This document provides an overview of Binary Authorization.
What is Binary Authorization?
Binary Authorization is a Google Cloud product that you can use to implement software supply-chain security measures when you develop and deploy container-based applications.
What does Binary Authorization do?
You can use Binary Authorization to do the following:
Monitor: You can configure continuous validation (CV) with check-based platform policies (Preview) to periodically monitor that container images associated with running Pods conform to a policy that you define. If images don't conform with the policy, CV produces log entries in Cloud Logging.
Enforce: You can configure Binary Authorization enforcement to enforce that images that are being deployed to one of the supported container-based platforms conform with a policy that you define. Images that conform with the policy are allowed to be deployed; otherwise, they are disallowed from being deployed.
What platforms does Binary Authorization support?
Binary Authorization supports the following platforms:
- Google Kubernetes Engine (GKE): runs images in clusters that are hosted on Google Cloud.
- Cloud Run: runs containerized applications on a fully managed serverless platform.
- Cloud Service Mesh: manages a reliable service mesh that is on-premises or on Google Cloud.
- Google Distributed Cloud software: runs the images in GKE clusters that you host on your own hardware.
Binary Authorization-related products
Binary Authorization is part of a deployment architecture that includes the following related products:
- Artifact Registry, Container Registry and other registries that store the images you want to deploy.
- Artifact Analysis provides vulnerability information that you can use with Binary Authorization to control deployment. Separately, Artifact Analysis stores trusted metadata that is used in the authorization process.
- Security monitoring, a dashboard you can use to assess your application security posture across interdependent Google Cloud products, including Binary Authorization.
- Cloud Build, which produces attestations and provenance that Binary Authorization can use for enforcement and monitoring.
- Cloud Deploy is a managed continuous-delivery service, which automates delivery of applications to a series of target environments in a defined sequence.
Binary Authorization is based on the Kritis specification, which is part of the Grafeas open source project.