This document provides an overview of Binary Authorization.
What is Binary Authorization?
Binary Authorization is a Google Cloud product that you can use to implement software supply-chain security measures when you develop and deploy container-based applications.
What does Binary Authorization do?
You can use Binary Authorization to do the following:
Monitor: You can configure continuous validation (CV) with check-based platform policies (Preview) to periodically monitor that container images associated with running Pods conform to a policy that you define. If images don't conform with the policy, CV produces log entries in Cloud Logging.
Enforce: You can configure Binary Authorization enforcement to enforce that images that are being deployed to one of the supported container-based platforms conform with a policy that you define. Images that conform with the policy are allowed to be deployed; otherwise, they are disallowed from being deployed.
What platforms does Binary Authorization support?
Binary Authorization supports the following platforms:
- Google Kubernetes Engine (GKE): runs images in clusters that are hosted on Google Cloud.
- Cloud Run: runs containerized applications on a fully managed serverless platform.
- Cloud Service Mesh: manages a reliable service mesh that is on-premises or on Google Cloud.
- Google Distributed Cloud software: runs the images in GKE clusters that you host on your own hardware.