Skip to main content

Minimize Container Registries To Only Approved Ones

More Info:​

Use Binary Authorization to allowlist (whitelist) only approved container registries

Risk Level​

Medium

Address​

Best Practice, Operational Excellence, Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Minimize Container Registries To Only Approved Ones" for GCP using GCP console, please follow the below steps:

  1. Login to the GCP console (https://console.cloud.google.com/).
  2. Navigate to the Container Registry page by clicking on "Navigation menu > Container Registry".
  3. Click on the Registry that you want to modify.
  4. Click on the "Permissions" tab.
  5. Click on the "Add Member" button.
  6. In the "New members" field, enter the email address of the user or group that you want to grant permissions to.
  7. In the "Select a role" field, choose the appropriate role that you want to grant to the user or group. For example, you can choose "Storage Object Viewer" to allow users to view the images in the registry.
  8. Click on the "Add" button to add the user or group to the registry with the selected role.

Repeat steps 5-8 for all the users or groups that need access to the registry. By doing this, you are minimizing the container registries to only approved ones.

Using CLI

To remediate the misconfiguration "Minimize Container Registries To Only Approved Ones" in GCP using GCP CLI, you can follow the below steps:

  1. Open the terminal and authenticate into your GCP account using the following command:

    gcloud auth login

  2. Once you are authenticated, set the project where the container registry is located using the following command:

    gcloud config set project [PROJECT_ID]

  3. Now, list all the container registries in the project using the following command:

    gcloud container images list

  4. Identify the container registries that are not approved and need to be minimized.

  5. Delete the unwanted container registry using the following command:

    gcloud container images delete [IMAGE_NAME] --force-delete-tags --quiet

    Replace [IMAGE_NAME] with the name of the container image that you want to delete.

  6. Repeat the above step for all the unwanted container registries.

  7. Once you have deleted all the unwanted container registries, verify that only approved container registries are present using the following command:

    gcloud container images list

    This will list all the container registries present in the project.

By following the above steps, you can remediate the misconfiguration "Minimize Container Registries To Only Approved Ones" in GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Minimize Container Registries To Only Approved Ones" in GCP using Python, you can follow the below steps:

  1. First, you need to get the list of all the container registries in your GCP project using the Google Cloud SDK and Python. You can use the following command to get the list of container registries:
gcloud container images list

  1. Next, you need to create a list of approved container registries that are allowed in your GCP project.

  2. Then, you can loop through the list of container registries and check if each registry is in the approved list or not. If it is not in the approved list, then you can delete that container registry using the following command:

gcloud container images delete [IMAGE_NAME] --force-delete-tags
  1. You can write a Python script to automate this process. Here is an example script:
import subprocess

# List of approved container registries
approved_registries = ['gcr.io/my-project']

# Get the list of all container registries
registries = subprocess.check_output(['gcloud', 'container', 'images', 'list']).splitlines()

# Loop through the list of container registries
for registry in registries:
    # Check if the registry is in the approved list
    if registry not in approved_registries:
        # Delete the container registry
        subprocess.call(['gcloud', 'container', 'images', 'delete', registry, '--force-delete-tags'])
  1. You can run this script periodically to ensure that only approved container registries are present in your GCP project.
Using Terraform
resource "google_binary_authorization_policy" "project_policy" {
  project = "YOUR_PROJECT_ID" # replace with your GCP project ID

  default_admission_rule {
    evaluation_mode  = "REQUIRE_ATTESTATION"
    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"

    # Only allow images from these approved registries/patterns.
    # Replace with your own approved registries.
    allowed_image_patterns = [
      "gcr.io/YOUR_APPROVED_PROJECT/*",
      "us-docker.pkg.dev/YOUR_APPROVED_PROJECT/*",
    ]

    # Configure at least one attestor if you use REQUIRE_ATTESTATION.
    # Replace with your Binary Auth attestor resource(s).
    require_attestations_by = [
      "projects/YOUR_PROJECT_ID/attestors/YOUR_ATTESTOR_NAME",
    ]
  }
}

resource "google_container_cluster" "gke_cluster" {
  name     = "YOUR_GKE_CLUSTER_NAME"   # replace
  location = "YOUR_GKE_LOCATION"       # replace (region or zone)
  project  = "YOUR_PROJECT_ID"         # replace

  # ... your existing GKE configuration (networking, node pools, etc.) ...

  binary_authorization {
    # Enforce the project-wide Binary Authorization policy created above
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }
}

This attaches Binary Authorization enforcement to the GKE cluster and configures the project-wide Binary Authorization policy to only admit images from the specified approved registries (and with required attestations). This change updates the existing cluster in place (no forced replacement), though nodes may be reconfigured during the update.

To verify, terraform plan should show:

  • a google_binary_authorization_policy.project_policy to be created or updated with allowed_image_patterns set to your approved registries, and
  • a change on google_container_cluster.gke_cluster adding or updating the binary_authorization block with evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE".

Additional Reading:​