Use legacy continuous validation

This page is intended for users of legacy continuous validation (legacy CV) (deprecated).

Legacy continuous validation is a feature of Binary Authorization that periodically checks container images associated with running Pods for continued compliance with your Binary Authorization project-singleton policy. Legacy CV logs findings to Cloud Logging.

Legacy CV does not terminate running Pods.

Limitations

Legacy CV has the following limitations:

  • Legacy CV only supports Pods deployed on Google Kubernetes Engine (GKE).
  • Legacy CV does not support Binary Authorization policies that specify specific rules for Cloud Service Mesh service identities, Kubernetes service accounts, or Kubernetes namespaces.

Before you begin

  1. Ensure that you have set up Binary Authorization for Google Kubernetes Engine in a project. legacy CV logs policy conformance events from Pods in all clusters in the project.

  2. Ensure that the gcloud CLI is updated to the latest version

Required permissions

Identity and Access Management (IAM) roles include permissions and can be assigned to users, groups, and service accounts. The following roles include the listed permissions for CV:

Role name Legacy CV permissions Description
roles/binaryauthorization.policyEditor binaryauthorization.continuousValidationConfig.update Enable and disable CV.

To set the required IAM permissions, run the following commands:

PROJECT_NUMBER=$(gcloud projects list \
  --filter="projectId:ATTESTATION_PROJECT_ID" \
  --format="value(PROJECT_NUMBER)")
SERVICE_ACCOUNT="service-$PROJECT_NUMBER@gcp-sa-binaryauthorization.iam.gserviceaccount.com"

gcloud projects add-iam-policy-binding ATTESTATION_PROJECT_ID \
    --member="serviceAccount:$SERVICE_ACCOUNT" \
    --role='roles/containeranalysis.occurrences.viewer'

Enable legacy CV

Console

To enable legacy CV by using the Google Cloud console, do the following:

  1. In the Google Cloud console, go to the Binary Authorization Policy page.

    Go to Binary Authorization Policy

  2. Click the Policy tab.

  3. Click Edit Policy.

  4. Expand the Additional settings for GKE and Anthos deployments section.

  5. Select the Enable Continuous Validation checkbox.

  6. Click Save Policy.

REST API

To enable legacy CV using the REST API, do the following:

  1. Store your project ID:

    DEPLOYER_PROJECT_ID=DEPLOYER_PROJECT_ID

    Replace DEPLOYER_PROJECT_ID with the ID of the project where you run GKE.

  2. Get the OAuth token for Google Cloud.

    BEARER_TOKEN=$(gcloud auth print-access-token)

    The token is only valid for a short time.

  3. Enable legacy CV:

    curl "https://binaryauthorization.googleapis.com/v1alpha2/projects/${DEPLOYER_PROJECT_ID}/continuousValidationConfig" -X PUT -H "authorization: Bearer $BEARER_TOKEN" -H "Content-Type: application/json" --data '{"enforcementPolicyConfig": {"enabled": "true"}}'

Legacy CV is now configured to log events.

The Logging log entry is similar to the following example:

{
"insertId": "6054e143-0000-2562-aa64-883d24f57e70",
"jsonPayload": {
  "@type": "type.googleapis.com/google.cloud.binaryauthorization.v1beta1.ContinuousValidationEvent",
  "podEvent": {
    "images": [
      {
        "description": "Image <var>IMAGE_NAME@IMAGE_DIGEST</var> denied by
        attestor projects/<var>ATTESTOR_PROJECT_ID</var>/attestors/<var>ATTESTOR_NAME</var>:
        No attestations found that were valid and signed by a key trusted by
        the attestor",
        "image": "<var>IMAGE_NAME@IMAGE_DIGEST</var>",
        "result": "DENY"
      }
    ],
    "verdict": "VIOLATES_POLICY",
    "deployTime": "2021-03-19T17:00:08Z",
    "pod": "<var>POD_NAME</var>"
  }
},
"resource": {
  "type": "k8s_cluster",
  "labels": {
    "cluster_name": "<var>CLUSTER_NAME</var>",
    "location":