Ensure Use Of Binary Authorization

More Info:

Binary Authorization Helps To Protect Supply-Chain Security By Only Allowing Images With Verifiable Cryptographically Signed Metadata Into The Cluster.

Risk Level

Medium

Address

Security

Compliance Standards

CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

Identify current Binary Authorization evaluation mode
- Run on any machine with gcloud and IAM access to the project:
```
gcloud container clusters describe <CLUSTER_NAME> \
  --zone <COMPUTE_ZONE> \
  --format="value(binaryAuthorization.evaluationMode)"
```
- If the value is DISABLED, Binary Authorization is not in use for this cluster.
List and inspect the Binary Authorization policy in the project
- Check if a project-level policy exists:
```
gcloud container binauthz policy export
```
- Review the exported YAML to see:
  - If defaultAdmissionRule.enforcementMode is ENFORCED_BLOCK_AND_AUDIT_LOG or only DRYRUN_AUDIT_LOG_ONLY.
  - Which images/attestors are enforced or exempted via clusterAdmissionRules or imageAllowlist.
Decide intended enforcement level and scope
- In consultation with your security and application teams, determine:
  - Whether you are ready for full enforcement (PROJECT_SINGLETON_POLICY_ENFORCE) vs audit-only.
  - Which registries/images must be allowed and which must require attestations.
- Update the exported policy YAML locally to reflect the desired rules and enforcementMode values.
Apply (import) the updated Binary Authorization policy
- Save the updated policy to a file, for example: /tmp/binauthz-policy.yaml.
- Import it to the project:
```
gcloud container binauthz policy import /tmp/binauthz-policy.yaml
```

Enable Binary Authorization on the GKE cluster

Choose an evaluation mode consistent with your decision in step 3. Examples:

Enforce project policy:

gcloud container clusters update <CLUSTER_NAME> \
  --zone <COMPUTE_ZONE> \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE

Audit-only (if you are not ready to block yet):

gcloud container clusters update <CLUSTER_NAME> \
  --zone <COMPUTE_ZONE> \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_AUDIT_LOG_ONLY

Verify configuration and observe impact
- Confirm the cluster is using Binary Authorization:
```
gcloud container clusters describe <CLUSTER_NAME> \
  --zone <COMPUTE_ZONE> \
  --format="value(binaryAuthorization.evaluationMode)"
```
- Optionally, deploy a test workload with an image that should be denied or only audited, and review audit logs in Cloud Logging under Kubernetes Engine and Binary Authorization logs to verify enforcement/audit behavior matches expectations.

Using kubectl

kubectl cannot configure Binary Authorization because it is a GKE control-plane / project-level setting managed via gcloud, the GCP console, or IaC. To enable and configure Binary Authorization, follow the guidance in the Manual Steps section using the Google Cloud tools.

Automation

#!/usr/bin/env bash
#
# Report Binary Authorization usage for all GKE clusters in a project.
# Requires:
#   - gcloud (with container and binauthz components)
#   - jq
#
# Usage:
#   PROJECT_ID=your-project-id ./check_binauthz.sh

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-}"
if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: Set PROJECT_ID environment variable to the GCP project ID." >&2
  exit 1
fi

echo "Checking Binary Authorization status for all GKE clusters in project: ${PROJECT_ID}"
echo

# List all clusters (zonal and regional)
clusters_json="$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format=json)"

if [[ -z "${clusters_json}" || "${clusters_json}" == "[]" ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID}."
  exit 0
fi

echo "Cluster Binary Authorization evaluation mode:"
echo "--------------------------------------------"

# For each cluster, get binauthz evaluation mode
echo "${clusters_json}" | jq -r '.[] | [.name, .location] | @tsv' | \
while IFS=$'\t' read -r CLUSTER_NAME LOCATION; do
  # Fetch full cluster description to get binary authorization config
  desc_json="$(gcloud container clusters describe "${CLUSTER_NAME}" \
    --project "${PROJECT_ID}" \
    --region "${LOCATION}" \
    --format=json 2>/dev/null || \
    gcloud container clusters describe "${CLUSTER_NAME}" \
      --project "${PROJECT_ID}" \
      --zone "${LOCATION}" \
      --format=json 2>/dev/null || true)"

  if [[ -z "${desc_json}" ]]; then
    echo -e "${CLUSTER_NAME}\t${LOCATION}\tERROR\tCould not describe cluster"
    continue
  fi

  MODE="$(echo "${desc_json}" | \
    jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')"

  echo -e "${CLUSTER_NAME}\t${LOCATION}\t${MODE}"
done

echo
echo "Binary Authorization project-wide policy status:"
echo "-----------------------------------------------"

# Check if a Binary Authorization policy exists in this project
# EXIT_CODE 0: policy exists; 1: not found; other: error
if gcloud container binauthz policy export \
     --project "${PROJECT_ID}" \
     --format=json >/tmp/binauthz-policy-"${PROJECT_ID}".json 2>/dev/null; then
  echo "Policy found for project ${PROJECT_ID}:"
  jq '.defaultAdmissionRule.evaluationMode,
      .defaultAdmissionRule.requireAttestationsBy,
      .clusterAdmissionRules' \
    /tmp/binauthz-policy-"${PROJECT_ID}".json
else
  echo "No Binary Authorization policy configured for project ${PROJECT_ID}."
fi

cat <<'EOF'

Interpretation:

1) Cluster table (per line: CLUSTER_NAME, LOCATION, MODE)
   - PROJECT_SINGLETON_POLICY_ENFORCE:
       Binary Authorization is enforcing the project’s policy. This is the
       recommended configuration for strong supply-chain enforcement.
   - PROJECT_SINGLETON_POLICY_ALLOW_ALL:
       Binary Authorization is enabled but *not enforcing*; all images are
       allowed. This is a weak configuration and should be reviewed.
   - DISABLED or NOT_SET:
       Binary Authorization is not in use for this cluster. This is typically
       considered a problem for this control.

2) Project-wide policy section:
   - If a policy is present, review:
       - defaultAdmissionRule.evaluationMode
       - defaultAdmissionRule.requireAttestationsBy
       - clusterAdmissionRules
     Ensure that at least key clusters/namespaces are protected with
     ENFORCED_BLOCK_AND_AUDIT_LOG and appropriate attestors.
   - If "No Binary Authorization policy configured" appears, but any cluster
     shows PROJECT_SINGLETON_POLICY_ENFORCE, that cluster will fail to admit
     images until a policy is created. If both policy and ENFORCE are absent,
     Binary Authorization is effectively not protecting the cluster.

This script does NOT change configuration; it only reports the current state
so you can decide where to enable Binary Authorization and how strict the
policy should be.
EOF

Additional Reading:

https://cloud.google.com/binary-authorization/

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​