Enforce image provenance using Binary Authorization for GKE

LowLevel 2Manual reviewgke

Description

Use Binary Authorization for GKE to enforce image provenance and deploy time trust policies before container images are admitted to the cluster. Policies should allow only approved images, trusted registries, or images with required attestations from approved build, security, or release processes. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review the GKE Standard cluster and confirm that Binary Authorization enforcement is enabled and confirm it does not simply allow all images and that it requires approved images, trusted registries, or attestations from trusted attestors where appropriate. Binary Authorization works with Standard clusters and evaluates the configured policy at deploy time.

How it is fixed

Fix method: Guidance or infrastructure patch

Enable Binary Authorization enforcement for the GKE Standard cluster and configure the policy to block unapproved images at deploy time. Use approved image rules, trusted registries, or attestation based requirements aligned to the build, security scan, and release approval process. Validate the policy in dry run or a lower environment before enforcing broadly in production.

Properties

Operating systems: Any
Tags: gkepoliciesregistry
Reference: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.5.1 Enforce image provenance using Binary Authorization for GKE