Skip to main content

Ensure Use Of Binary Authorization

More Info:​

Binary Authorization helps to protect supply-chain security by only allowing images with verifiable cryptographically signed metadata into the cluster.

Risk Level​

Medium

Address​

Operational Excellence, Performance Efficiency, Reliability, Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Using Console

To remediate the "Ensure Use Of Binary Authorization" misconfiguration in GCP using the GCP console, you can follow the below steps:

  1. Open the Google Cloud Console and navigate to the "Binary Authorization" page.

  2. Click the "Create Policy" button to create a new policy.

  3. In the "Create Policy" dialog box, enter a name for the policy and select the "Enforce for all images" option.

  4. In the "Policy" section, click the "Add Rule" button to add a new rule.

  5. In the "Add Rule" dialog box, select the "Require Attestation" option and choose the attestation provider you want to use.

  6. Click the "Save" button to save the rule.

  7. Repeat steps 4-6 to add additional rules as needed.

  8. Click the "Create" button to create the policy.

  9. Once the policy is created, you can assign it to a cluster or node pool by navigating to the "Cluster" or "Node Pools" page and clicking the "Edit" button for the cluster or node pool you want to assign the policy to.

  10. In the "Security" section, select the policy you just created from the "Binary Authorization Policy" dropdown menu.

  11. Click the "Save" button to save the changes.

By following these steps, you will be able to remediate the "Ensure Use Of Binary Authorization" misconfiguration in GCP using the GCP console.

Using CLI

To remediate the "Ensure Use of Binary Authorization" misconfiguration on GCP using GCP CLI, follow these steps:

  1. Open the Cloud Shell in the GCP console.

  2. Run the following command to enable the Binary Authorization API:

gcloud services enable binaryauthorization.googleapis.com
  1. Create a policy that requires all container images to be signed. You can do this by creating a policy file in YAML format with the following content:
globalPolicyEvaluationMode: REQUIRE_ATTESTATION
defaultAdmissionRule:
  enforcementMode: ALWAYS_DENY
  evaluationMode: REQUIRE_ATTESTATION

  1. Save the policy file to your local machine.

  2. Upload the policy file to the Binary Authorization policy library using the following command:

gcloud beta container binauthz policy import <PATH_TO_POLICY_FILE> --project <PROJECT_ID>

Replace <PATH_TO_POLICY_FILE> with the path to the policy file on your local machine, and <PROJECT_ID> with the ID of your GCP project.

  1. Configure your Kubernetes cluster to use Binary Authorization by adding the following annotation to the pod spec in your deployment YAML file:
annotations:
  container.binauthz.io/enabled: "true"
  1. Apply the updated deployment YAML file to your Kubernetes cluster using the following command:
kubectl apply -f <PATH_TO_DEPLOYMENT_YAML_FILE>

Replace <PATH_TO_DEPLOYMENT_YAML_FILE> with the path to the updated deployment YAML file on your local machine.

  1. Verify that Binary Authorization is enabled by running the following command:
gcloud beta container binauthz policy export --project <PROJECT_ID>

This command should return the policy file that you uploaded in step 5.

By following these steps, you have remediated the "Ensure Use of Binary Authorization" misconfiguration on GCP using GCP CLI.

Using Python

To remediate the "Ensure Use of Binary Authorization" misconfiguration in GCP, you can use the following Python code:

  1. First, you need to enable the Binary Authorization API in your GCP project. You can do this by running the following command:
from google.cloud import services
services.enable('binaryauthorization.googleapis.com')
  1. Next, you need to create a policy that enforces the use of binary authorization for all container images. You can do this by running the following code:
from google.cloud import binaryauthorization_v1beta1 as binaryauthorization

# Create a policy that requires binary authorization for all container images
policy_client = binaryauthorization.PolicyServiceClient()
policy = policy_client.create_policy(
    parent='projects/PROJECT_ID',
    policy={
        'name': 'projects/PROJECT_ID/policy',
        'globalPolicyEvaluationMode': binaryauthorization.enums.GlobalPolicyEvaluationMode.GLOBAL_POLICY_EVALUATION_MODE_ENABLED,
        'admissionWhitelistPatterns': [
            {
                'namePattern': '*',
                'versionPattern': '*'
            }
        ],
        'defaultAdmissionRule': {
            'evaluationMode': binaryauthorization.enums.AdmissionRule.EvaluationMode.REQUIRE_ATTESTATION,
            'requireAttestationsBy': [
                {
                    'humanReadableName': 'Google-signed Attestation',
                    'contentType': binaryauthorization.enums.AttestationAuthority.AttestationContentType.ATTESTATION_CONTENT_TYPE_GOOGLE_BINARY_AUTHORITY_V1_BLOB,
                    'pgpKeyId': ''
                }
            ]
        }
    }
)

Note that you will need to replace PROJECT_ID with your actual GCP project ID.

  1. Finally, you need to configure your Kubernetes Engine cluster to use binary authorization. You can do this by adding the following annotation to your Kubernetes deployment YAML file:
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment
  annotations:
    container.apparmor.security.beta.kubernetes.io/my-container: runtime/default
    beta.cloud.google.com/binary-authorization: '{"name":"projects/PROJECT_ID/policy"}'
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: my-container
        image: gcr.io/my-project/my-image:latest

Again, you will need to replace PROJECT_ID with your actual GCP project ID.

Once you have completed these steps, your GCP project will be configured to enforce the use of binary authorization for all container images.

Using Terraform
resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

  # ... other required cluster arguments (networking, node pools, etc.) ...

  # Enable Binary Authorization enforcement on this cluster
  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }
}

# Optional: define the project-level Binary Authorization policy that the cluster will enforce.
# Adjust as needed for your org’s attestations and images.
resource "google_binary_authorization_policy" "project_policy" {
  project = "GCP_PROJECT_ID"             # replace with your project ID

  admission_whitelist_patterns {
    name_pattern = "gcr.io/google_containers/*"
  }

  # Example: require attestations for a specific image
  default_admission_rule {
    evaluation_mode  = "REQUIRE_ATTESTATION"
    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
    require_attestations_by = [
      "projects/GCP_PROJECT_ID/attestors/ATTESTOR_NAME", # replace with your attestor
    ]
  }
}

Changing binary_authorization.evaluation_mode on an existing google_container_cluster is an in-place update and should not force replacement of the cluster.

To verify, terraform plan should show an in-place update (~) to google_container_cluster.GKE_CLUSTER adding the binary_authorization block (or changing evaluation_mode to PROJECT_SINGLETON_POLICY_ENFORCE), and (if added) a new + google_binary_authorization_policy.project_policy resource.

Additional Reading:​