Enforce Binary Authorization for trusted GKE container image deployments

How it is checked

Audit method: Shell command

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(binaryAuthorization.evaluationMode)') || exit 1
if case "$v" in PROJECT_SINGLETON_POLICY_ENFORCE|POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: binaryAuthorization.evaluationMode=$v"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enable Binary Authorization enforcement on the GKE Standard cluster when the audit shows that the cluster is not using an enforcing evaluation mode. Use PROJECT_SINGLETON_POLICY_ENFORCE to enforce the project Binary Authorization policy. If the cluster also uses continuous validation with policy bindings, use POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE instead. Monitoring only modes should not be used as the remediation target for this control. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE Export the current Binary Authorization policy to a local YAML file. The trusted image deployment rules are edited in this policy file, not directly in the GKE cluster configuration.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke --level 2