Enforce Binary Authorization for trusted GKE container image deployments

SrednjaNivo 2Automatskagke

Opis

Use Binary Authorization to enforce trusted image deployment policies for GKE Standard clusters. The policy should allow only approved container images to be deployed, based on defined admission rules such as approved image locations, trusted build or promotion processes, and required attestations where appropriate. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

Kako se proverava

Metod provere: Komanda ljuske

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(binaryAuthorization.evaluationMode)') || exit 1
if case "$v" in PROJECT_SINGLETON_POLICY_ENFORCE|POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: binaryAuthorization.evaluationMode=$v"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Enable Binary Authorization enforcement on the GKE Standard cluster when the audit shows that the cluster is not using an enforcing evaluation mode. Use PROJECT_SINGLETON_POLICY_ENFORCE to enforce the project Binary Authorization policy. If the cluster also uses continuous validation with policy bindings, use POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE instead. Monitoring only modes should not be used as the remediation target for this control. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE Export the current Binary Authorization policy to a local YAML file. The trusted image deployment rules are edited in this policy file, not directly in the GKE cluster configuration.

Svojstva

Operativni sistemi: Bilo koji
Oznake: gkemanaged-servicesregistry
Referenca: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.1.3 Enforce Binary Authorization for trusted GKE container image deployments

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target gke --level 2