Binary Authorization concepts

This page contains information about concepts related to Binary Authorization.

Policies

A Binary Authorization policy, also known as a project-singleton policy, is a set of rules that govern the deployment of container images.

Continuous validation (CV), uses a different type of policy, called a platform policy.

A policy has the following parts:

• Deployment rules
• List of exempt images

You can configure a policy using one of the following:

• Google Cloud console
• gcloud commands

When you use gcloud commands, you export and modify a definition of the policy in YAML format before importing it back to your project. The YAML format reflects the internal structure of a policy in Binary Authorization storage. For more information about this format, see Policy YAML Reference.

Each Google Cloud project can have exactly one policy. You must configure the policy in the project where you run your deployment platform. In a single-project configuration, the policy and all subordinate resources—attestors and attestations—reside in the same project. To establish separation of duties, you can use a multi-project configuration. In this configuration, the deployment platform can run in one project, attestors can reside in another project, and attestations can reside in still another project.

To set up and use Binary Authorization on supported platforms, see Set up by platform.

See an example multi-project setup for GKE.

Rules

When you configure a policy, you define its rules. Rules define constraints that images must satisfy before they can be deployed. A policy has one default rule and it can have specific rules, depending on the platform. For more information, see Supported rule types by platform.

Each rule can be configured with an evaluation mode and an enforcement mode, for example, a rule can require that an image have a signed attestation before it can be deployed.

Default rule

Each policy has a default rule. This rule applies to any deployment request that doesn't match a specific rule. In a policy YAML file, the default rule is specified in the defaultAdmissionRule node.

For more information about configuring the default rule, see Configuring a policy.

Specific rules

One or more specific rules can be added to a policy. This type of rule applies to images that are to be deployed to specific clusters, service account, or identity. Support for specific rules varies by platform. For more information, see Supported rule types by platform.

In a policy YAML file, each cluster-specific rule is specified in a clusterAdmissionRule node.

Supported rule types by platform

The following table shows which rule types are supported for each deployment platform.

Platform	Default rule	Specific rule
GKE	Supported	Clusters Kubernetes Namespaces Kubernetes Service Accounts
Cloud Run	Supported	Not supported
GKE attached clusters	Supported	Clusters Kubernetes Namespaces Kubernetes Service Accounts
GKE on AWS	Supported	Clusters Kubernetes Namespaces Kubernetes Service Accounts
Google Distributed Cloud	Supported	Clusters Kubernetes Namespaces Kubernetes Service Accounts
Google Distributed Cloud	Supported	Clusters Kubernetes Namespaces Kubernetes Service Accounts
Cloud Service Mesh	Supported	Cloud Service Mesh Service Identities

Evaluation modes

Each rule has an evaluation mode that specifies the type of constraint that Binary Authorization enforces for the rule. The evaluation mode for a rule is specified using the evaluationMode property in the policy YAML file.

There are three evaluation modes:

• Allow all images: allows all images to be deployed.
• Disallow all images: disallows all images from being deployed.
• Require attestations: requires a signer to digitally sign the image digest and create an attestation before deployment. At deploy time, the Binary Authorization enforcer uses an attestor to verify the signature in the attestation before deploying the associated image.

Enforcement modes

Each rule also has an enforcement mode, which specifies the action that is taken by GKE when an image does not conform to the rule. A rule can have the following enforcement modes:

• Block and Audit Log: Blocks the deployment of images that do not conform to the rule and writes a message to the audit log to indicate why the image was not deployed.

• Dry Run: Audit Log Only: Dry run mode is an enforcement mode in a policy that allows non-conformant images to be deployed, but writes details about the deployment to the Cloud Audit Logs. Dry run mode allows you to test a policy, for example in your production environment, before enforcement actually goes into effect.

Most production rules use the Block and Audit Log enforcement mode. Dry Run: Audit Log Only is primarily used for testing a policy in your environment before it goes into effect.

The enforcement mode for a rule is specified using the enforcementMode property in the policy YAML file.

For more information about messages written to Cloud Audit Logs, see View audit logs (GKE, Google Distributed Cloud, Cloud Service Mesh) or View audit logs (Cloud Run).

Continuous Validation

Continuous Validation (CV) is a feature of Binary Authorization that periodically checks images associated with running Pods for continued policy conformance.

Learn more about CV.

Exempt images