Ensure Use Of Binary Authorization

#!/usr/bin/env bash
#
# Report Binary Authorization usage for all GKE clusters in a project.
# Requires:
#   - gcloud (with container and binauthz components)
#   - jq
#
# Usage:
#   PROJECT_ID=your-project-id ./check_binauthz.sh

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-}"
if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: Set PROJECT_ID environment variable to the GCP project ID." >&2
  exit 1
fi

echo "Checking Binary Authorization status for all GKE clusters in project: ${PROJECT_ID}"
echo

# List all clusters (zonal and regional)
clusters_json="$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format=json)"

if [[ -z "${clusters_json}" || "${clusters_json}" == "[]" ]]; then
  echo "No GKE clusters found in project ${PROJECT_ID}."
  exit 0
fi

echo "Cluster Binary Authorization evaluation mode:"
echo "--------------------------------------------"

# For each cluster, get binauthz evaluation mode
echo "${clusters_json}" | jq -r '.[] | [.name, .location] | @tsv' | \
while IFS=$'\t' read -r CLUSTER_NAME LOCATION; do
  # Fetch full cluster description to get binary authorization config
  desc_json="$(gcloud container clusters describe "${CLUSTER_NAME}" \
    --project "${PROJECT_ID}" \
    --region "${LOCATION}" \
    --format=json 2>/dev/null || \
    gcloud container clusters describe "${CLUSTER_NAME}" \
      --project "${PROJECT_ID}" \
      --zone "${LOCATION}" \
      --format=json 2>/dev/null || true)"

  if [[ -z "${desc_json}" ]]; then
    echo -e "${CLUSTER_NAME}\t${LOCATION}\tERROR\tCould not describe cluster"
    continue
  fi

  MODE="$(echo "${desc_json}" | \
    jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')"

  echo -e "${CLUSTER_NAME}\t${LOCATION}\t${MODE}"
done

echo
echo "Binary Authorization project-wide policy status:"
echo "-----------------------------------------------"

# Check if a Binary Authorization policy exists in this project
# EXIT_CODE 0: policy exists; 1: not found; other: error
if gcloud container binauthz policy export \
     --project "${PROJECT_ID}" \
     --format=json >/tmp/binauthz-policy-"${PROJECT_ID}".json 2>/dev/null; then
  echo "Policy found for project ${PROJECT_ID}:"
  jq '.defaultAdmissionRule.evaluationMode,
      .defaultAdmissionRule.requireAttestationsBy,
      .clusterAdmissionRules' \
    /tmp/binauthz-policy-"${PROJECT_ID}".json
else
  echo "No Binary Authorization policy configured for project ${PROJECT_ID}."
fi

cat <<'EOF'

Interpretation:

1) Cluster table (per line: CLUSTER_NAME, LOCATION, MODE)
   - PROJECT_SINGLETON_POLICY_ENFORCE:
       Binary Authorization is enforcing the project’s policy. This is the
       recommended configuration for strong supply-chain enforcement.
   - PROJECT_SINGLETON_POLICY_ALLOW_ALL:
       Binary Authorization is enabled but *not enforcing*; all images are
       allowed. This is a weak configuration and should be reviewed.
   - DISABLED or NOT_SET:
       Binary Authorization is not in use for this cluster. This is typically
       considered a problem for this control.

2) Project-wide policy section:
   - If a policy is present, review:
       - defaultAdmissionRule.evaluationMode
       - defaultAdmissionRule.requireAttestationsBy
       - clusterAdmissionRules
     Ensure that at least key clusters/namespaces are protected with
     ENFORCED_BLOCK_AND_AUDIT_LOG and appropriate attestors.
   - If "No Binary Authorization policy configured" appears, but any cluster
     shows PROJECT_SINGLETON_POLICY_ENFORCE, that cluster will fail to admit
     images until a policy is created. If both policy and ENFORCE are absent,
     Binary Authorization is effectively not protecting the cluster.

This script does NOT change configuration; it only reports the current state
so you can decide where to enable Binary Authorization and how strict the
policy should be.
EOF