> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Use Of Binary Authorization

### More Info:

Binary Authorization Helps To Protect Supply-Chain Security By Only Allowing Images With Verifiable Cryptographically Signed Metadata Into The Cluster.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify current Binary Authorization evaluation mode**
           * Run on any machine with `gcloud` and IAM access to the project:
             ```bash theme={null}
             gcloud container clusters describe <CLUSTER_NAME> \
               --zone <COMPUTE_ZONE> \
               --format="value(binaryAuthorization.evaluationMode)"
             ```
           * If the value is `DISABLED`, Binary Authorization is not in use for this cluster.

        2. **List and inspect the Binary Authorization policy in the project**
           * Check if a project-level policy exists:
             ```bash theme={null}
             gcloud container binauthz policy export
             ```
           * Review the exported YAML to see:
             * If `defaultAdmissionRule.enforcementMode` is `ENFORCED_BLOCK_AND_AUDIT_LOG` or only `DRYRUN_AUDIT_LOG_ONLY`.
             * Which images/attestors are enforced or exempted via `clusterAdmissionRules` or `imageAllowlist`.

        3. **Decide intended enforcement level and scope**
           * In consultation with your security and application teams, determine:
             * Whether you are ready for full enforcement (`PROJECT_SINGLETON_POLICY_ENFORCE`) vs audit-only.
             * Which registries/images must be allowed and which must require attestations.
           * Update the exported policy YAML locally to reflect the desired rules and `enforcementMode` values.

        4. **Apply (import) the updated Binary Authorization policy**
           * Save the updated policy to a file, for example: `/tmp/binauthz-policy.yaml`.
           * Import it to the project:
             ```bash theme={null}
             gcloud container binauthz policy import /tmp/binauthz-policy.yaml
             ```

        5. **Enable Binary Authorization on the GKE cluster**
           * Choose an evaluation mode consistent with your decision in step 3. Examples:
             * Enforce project policy:
               ```bash theme={null}
               gcloud container clusters update <CLUSTER_NAME> \
                 --zone <COMPUTE_ZONE> \
                 --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE
               ```
             * Audit-only (if you are not ready to block yet):
               ```bash theme={null}
               gcloud container clusters update <CLUSTER_NAME> \
                 --zone <COMPUTE_ZONE> \
                 --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_AUDIT_LOG_ONLY
               ```

        6. **Verify configuration and observe impact**
           * Confirm the cluster is using Binary Authorization:
             ```bash theme={null}
             gcloud container clusters describe <CLUSTER_NAME> \
               --zone <COMPUTE_ZONE> \
               --format="value(binaryAuthorization.evaluationMode)"
             ```
           * Optionally, deploy a test workload with an image that should be denied or only audited, and review audit logs in Cloud Logging under Kubernetes Engine and Binary Authorization logs to verify enforcement/audit behavior matches expectations.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot configure Binary Authorization because it is a GKE control-plane / project-level setting managed via gcloud, the GCP console, or IaC. To enable and configure Binary Authorization, follow the guidance in the Manual Steps section using the Google Cloud tools.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report Binary Authorization usage for all GKE clusters in a project.
        # Requires:
        #   - gcloud (with container and binauthz components)
        #   - jq
        #
        # Usage:
        #   PROJECT_ID=your-project-id ./check_binauthz.sh

        set -euo pipefail

        PROJECT_ID="${PROJECT_ID:-}"
        if [[ -z "${PROJECT_ID}" ]]; then
          echo "ERROR: Set PROJECT_ID environment variable to the GCP project ID." >&2
          exit 1
        fi

        echo "Checking Binary Authorization status for all GKE clusters in project: ${PROJECT_ID}"
        echo

        # List all clusters (zonal and regional)
        clusters_json="$(gcloud container clusters list \
          --project "${PROJECT_ID}" \
          --format=json)"

        if [[ -z "${clusters_json}" || "${clusters_json}" == "[]" ]]; then
          echo "No GKE clusters found in project ${PROJECT_ID}."
          exit 0
        fi

        echo "Cluster Binary Authorization evaluation mode:"
        echo "--------------------------------------------"

        # For each cluster, get binauthz evaluation mode
        echo "${clusters_json}" | jq -r '.[] | [.name, .location] | @tsv' | \
        while IFS=$'\t' read -r CLUSTER_NAME LOCATION; do
          # Fetch full cluster description to get binary authorization config
          desc_json="$(gcloud container clusters describe "${CLUSTER_NAME}" \
            --project "${PROJECT_ID}" \
            --region "${LOCATION}" \
            --format=json 2>/dev/null || \
            gcloud container clusters describe "${CLUSTER_NAME}" \
              --project "${PROJECT_ID}" \
              --zone "${LOCATION}" \
              --format=json 2>/dev/null || true)"

          if [[ -z "${desc_json}" ]]; then
            echo -e "${CLUSTER_NAME}\t${LOCATION}\tERROR\tCould not describe cluster"
            continue
          fi

          MODE="$(echo "${desc_json}" | \
            jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')"

          echo -e "${CLUSTER_NAME}\t${LOCATION}\t${MODE}"
        done

        echo
        echo "Binary Authorization project-wide policy status:"
        echo "-----------------------------------------------"

        # Check if a Binary Authorization policy exists in this project
        # EXIT_CODE 0: policy exists; 1: not found; other: error
        if gcloud container binauthz policy export \
             --project "${PROJECT_ID}" \
             --format=json >/tmp/binauthz-policy-"${PROJECT_ID}".json 2>/dev/null; then
          echo "Policy found for project ${PROJECT_ID}:"
          jq '.defaultAdmissionRule.evaluationMode,
              .defaultAdmissionRule.requireAttestationsBy,
              .clusterAdmissionRules' \
            /tmp/binauthz-policy-"${PROJECT_ID}".json
        else
          echo "No Binary Authorization policy configured for project ${PROJECT_ID}."
        fi

        cat <<'EOF'

        Interpretation:

        1) Cluster table (per line: CLUSTER_NAME, LOCATION, MODE)
           - PROJECT_SINGLETON_POLICY_ENFORCE:
               Binary Authorization is enforcing the project’s policy. This is the
               recommended configuration for strong supply-chain enforcement.
           - PROJECT_SINGLETON_POLICY_ALLOW_ALL:
               Binary Authorization is enabled but *not enforcing*; all images are
               allowed. This is a weak configuration and should be reviewed.
           - DISABLED or NOT_SET:
               Binary Authorization is not in use for this cluster. This is typically
               considered a problem for this control.

        2) Project-wide policy section:
           - If a policy is present, review:
               - defaultAdmissionRule.evaluationMode
               - defaultAdmissionRule.requireAttestationsBy
               - clusterAdmissionRules
             Ensure that at least key clusters/namespaces are protected with
             ENFORCED_BLOCK_AND_AUDIT_LOG and appropriate attestors.
           - If "No Binary Authorization policy configured" appears, but any cluster
             shows PROJECT_SINGLETON_POLICY_ENFORCE, that cluster will fail to admit
             images until a policy is created. If both policy and ENFORCE are absent,
             Binary Authorization is effectively not protecting the cluster.

        This script does NOT change configuration; it only reports the current state
        so you can decide where to enable Binary Authorization and how strict the
        policy should be.
        EOF
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/binary-authorization/](https://cloud.google.com/binary-authorization/)