> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Use Of Binary Authorization

### More Info:

Binary Authorization helps to protect supply-chain security by only allowing images with verifiable cryptographically signed metadata into the cluster.

### Risk Level

Medium

### Address

Operational Excellence, Performance Efficiency, Reliability, Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Ensure Use Of Binary Authorization" misconfiguration in GCP using the GCP console, you can follow the below steps:

        1. Open the Google Cloud Console and navigate to the "Binary Authorization" page.

        2. Click the "Create Policy" button to create a new policy.

        3. In the "Create Policy" dialog box, enter a name for the policy and select the "Enforce for all images" option.

        4. In the "Policy" section, click the "Add Rule" button to add a new rule.

        5. In the "Add Rule" dialog box, select the "Require Attestation" option and choose the attestation provider you want to use.

        6. Click the "Save" button to save the rule.

        7. Repeat steps 4-6 to add additional rules as needed.

        8. Click the "Create" button to create the policy.

        9. Once the policy is created, you can assign it to a cluster or node pool by navigating to the "Cluster" or "Node Pools" page and clicking the "Edit" button for the cluster or node pool you want to assign the policy to.

        10. In the "Security" section, select the policy you just created from the "Binary Authorization Policy" dropdown menu.

        11. Click the "Save" button to save the changes.

        By following these steps, you will be able to remediate the "Ensure Use Of Binary Authorization" misconfiguration in GCP using the GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Ensure Use of Binary Authorization" misconfiguration on GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP console.

        2. Run the following command to enable the Binary Authorization API:

        ```
        gcloud services enable binaryauthorization.googleapis.com
        ```

        3. Create a policy that requires all container images to be signed. You can do this by creating a policy file in YAML format with the following content:

        ```
        globalPolicyEvaluationMode: REQUIRE_ATTESTATION
        defaultAdmissionRule:
          enforcementMode: ALWAYS_DENY
          evaluationMode: REQUIRE_ATTESTATION
        ```

        4. Save the policy file to your local machine.

        5. Upload the policy file to the Binary Authorization policy library using the following command:

        ```
        gcloud beta container binauthz policy import <PATH_TO_POLICY_FILE> --project <PROJECT_ID>
        ```

        Replace `<PATH_TO_POLICY_FILE>` with the path to the policy file on your local machine, and `<PROJECT_ID>` with the ID of your GCP project.

        6. Configure your Kubernetes cluster to use Binary Authorization by adding the following annotation to the pod spec in your deployment YAML file:

        ```
        annotations:
          container.binauthz.io/enabled: "true"
        ```

        7. Apply the updated deployment YAML file to your Kubernetes cluster using the following command:

        ```
        kubectl apply -f <PATH_TO_DEPLOYMENT_YAML_FILE>
        ```

        Replace `<PATH_TO_DEPLOYMENT_YAML_FILE>` with the path to the updated deployment YAML file on your local machine.

        8. Verify that Binary Authorization is enabled by running the following command:

        ```
        gcloud beta container binauthz policy export --project <PROJECT_ID>
        ```

        This command should return the policy file that you uploaded in step 5.

        By following these steps, you have remediated the "Ensure Use of Binary Authorization" misconfiguration on GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Ensure Use of Binary Authorization" misconfiguration in GCP, you can use the following Python code:

        1. First, you need to enable the Binary Authorization API in your GCP project. You can do this by running the following command:

        ```python theme={null}
        from google.cloud import services
        services.enable('binaryauthorization.googleapis.com')
        ```

        2. Next, you need to create a policy that enforces the use of binary authorization for all container images. You can do this by running the following code:

        ```python theme={null}
        from google.cloud import binaryauthorization_v1beta1 as binaryauthorization

        # Create a policy that requires binary authorization for all container images
        policy_client = binaryauthorization.PolicyServiceClient()
        policy = policy_client.create_policy(
            parent='projects/PROJECT_ID',
            policy={
                'name': 'projects/PROJECT_ID/policy',
                'globalPolicyEvaluationMode': binaryauthorization.enums.GlobalPolicyEvaluationMode.GLOBAL_POLICY_EVALUATION_MODE_ENABLED,
                'admissionWhitelistPatterns': [
                    {
                        'namePattern': '*',
                        'versionPattern': '*'
                    }
                ],
                'defaultAdmissionRule': {
                    'evaluationMode': binaryauthorization.enums.AdmissionRule.EvaluationMode.REQUIRE_ATTESTATION,
                    'requireAttestationsBy': [
                        {
                            'humanReadableName': 'Google-signed Attestation',
                            'contentType': binaryauthorization.enums.AttestationAuthority.AttestationContentType.ATTESTATION_CONTENT_TYPE_GOOGLE_BINARY_AUTHORITY_V1_BLOB,
                            'pgpKeyId': ''
                        }
                    ]
                }
            }
        )
        ```

        Note that you will need to replace `PROJECT_ID` with your actual GCP project ID.

        3. Finally, you need to configure your Kubernetes Engine cluster to use binary authorization. You can do this by adding the following annotation to your Kubernetes deployment YAML file:

        ```yaml theme={null}
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: my-deployment
          annotations:
            container.apparmor.security.beta.kubernetes.io/my-container: runtime/default
            beta.cloud.google.com/binary-authorization: '{"name":"projects/PROJECT_ID/policy"}'
        spec:
          replicas: 3
          selector:
            matchLabels:
              app: my-app
          template:
            metadata:
              labels:
                app: my-app
            spec:
              containers:
              - name: my-container
                image: gcr.io/my-project/my-image:latest
        ```

        Again, you will need to replace `PROJECT_ID` with your actual GCP project ID.

        Once you have completed these steps, your GCP project will be configured to enforce the use of binary authorization for all container images.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "GKE_CLUSTER" {
          name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
          location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

          # ... other required cluster arguments (networking, node pools, etc.) ...

          # Enable Binary Authorization enforcement on this cluster
          binary_authorization {
            evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
          }
        }

        # Optional: define the project-level Binary Authorization policy that the cluster will enforce.
        # Adjust as needed for your org’s attestations and images.
        resource "google_binary_authorization_policy" "project_policy" {
          project = "GCP_PROJECT_ID"             # replace with your project ID

          admission_whitelist_patterns {
            name_pattern = "gcr.io/google_containers/*"
          }

          # Example: require attestations for a specific image
          default_admission_rule {
            evaluation_mode  = "REQUIRE_ATTESTATION"
            enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
            require_attestations_by = [
              "projects/GCP_PROJECT_ID/attestors/ATTESTOR_NAME", # replace with your attestor
            ]
          }
        }
        ```

        Changing `binary_authorization.evaluation_mode` on an existing `google_container_cluster` is an in-place update and should not force replacement of the cluster.

        To verify, `terraform plan` should show an in-place update (`~`) to `google_container_cluster.GKE_CLUSTER` adding the `binary_authorization` block (or changing `evaluation_mode` to `PROJECT_SINGLETON_POLICY_ENFORCE`), and (if added) a new `+` `google_binary_authorization_policy.project_policy` resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/binary-authorization/](https://cloud.google.com/binary-authorization/)