Ensure Only Trusted Container Images Are Used

More Info:

Use Binary Authorization to enforce that only signed, attested container images can be deployed to the cluster. This prevents running untrusted or unverified images.

Risk Level

Medium

Address

Security

Compliance Standards

CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

Identify current Binary Authorization status
- On any machine with gcloud access:
```
gcloud container clusters describe CLUSTER_NAME \
  --location LOCATION \
  --project PROJECT_ID \
  --format=json | jq '.binaryAuthorization'
```
- Review whether enabled is true and what evaluationMode is set to (DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE, or PROJECT_SINGLETON_POLICY_ALLOW_ALWAYS).
Retrieve and review the current Binary Authorization policy
- On any machine with gcloud access:
```
gcloud container binauthz policy export --project PROJECT_ID > binauthz-policy.yaml
```
- Open binauthz-policy.yaml and verify:
  - Required attestors are defined for relevant images/projects.
  - Any admissionWhitelistPatterns are strictly limited and justified.
  - The default rule enforces attestation for images that should be trusted only when signed.
Compare policy against organizational requirements
- With security and platform owners, confirm:
  - Which registries and image paths are allowed.
  - Which teams/signing keys/attestors must sign images.
  - Any exceptions (e.g., third‑party images) are explicitly listed and documented in the policy rather than broadly whitelisting entire registries.
Update the Binary Authorization policy as needed
- Edit binauthz-policy.yaml to:
  - Add/remove attestors and adjust admission rules so only properly signed images are allowed.
  - Tighten or remove unnecessary whitelist patterns.
- Import the updated policy:
```
gcloud container binauthz policy import binauthz-policy.yaml --project PROJECT_ID
```
Enable or strengthen Binary Authorization on the cluster
- Choose an appropriate evaluation mode (typically PROJECT_SINGLETON_POLICY_ENFORCE for full enforcement after testing):
```
gcloud container clusters update CLUSTER_NAME \
  --location LOCATION \
  --project PROJECT_ID \
  --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE
```
- For staged rollout, you may temporarily use PROJECT_SINGLETON_POLICY_ALLOW_ALWAYS to log decisions before enforcing.
Verify configuration and perform a deployment test
- Re‑check cluster configuration:
```
gcloud container clusters describe CLUSTER_NAME \
  --location LOCATION \
  --project PROJECT_ID \
  --format=json | jq '.binaryAuthorization'
```
- Attempt to deploy:
  - One unsigned image that should be blocked (confirm admission is denied).
  - One properly signed/attested image (confirm admission is allowed).

Using kubectl

kubectl cannot configure Binary Authorization or enforce trusted images because this control is managed at the GKE control-plane / cloud-provider level. To enable and configure Binary Authorization, make the changes via the Google Cloud console, gcloud CLI, or IaC as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Report Binary Authorization status for all GKE clusters in a project.
# Requirements:
#   - gcloud, jq
#   - Authenticated with privileges to list and describe clusters & binauthz policy
#
# Usage:
#   ./report-binauthz.sh <PROJECT_ID>
#

set -euo pipefail

PROJECT_ID="${1:-}"

if [[ -z "$PROJECT_ID" ]]; then
  echo "Usage: $0 <PROJECT_ID>" >&2
  exit 1
fi

echo "Project: $PROJECT_ID"
echo "Timestamp: $(date -Iseconds)"
echo "========================================"

# List all regions/zones that have clusters
LOCATIONS=$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format='value(location)' | sort -u)

if [[ -z "$LOCATIONS" ]]; then
  echo "No clusters found in project ${PROJECT_ID}"
  exit 0
fi

# Try to fetch the Binary Authorization policy once (may not exist)
echo
echo "=== Project-level Binary Authorization Policy ==="
if gcloud container binauthz policy export --project "${PROJECT_ID}" >/tmp/binauthz-policy.yaml 2>/dev/null; then
  echo "Binary Authorization policy FOUND for project ${PROJECT_ID}"
  echo "Policy summary:"
  # Show only high-level fields; detailed review is manual
  grep -E '^(defaultAdmissionRule|clusterAdmissionRules:|globalPolicyEvaluationMode:)' -n \
    /tmp/binauthz-policy.yaml || true
else
  echo "No Binary Authorization policy configured for project ${PROJECT_ID}"
fi
echo "========================================"
echo

# For each cluster, show Binary Authorization configuration
for LOCATION in ${LOCATIONS}; do
  echo "=== LOCATION: ${LOCATION} ==="
  CLUSTERS=$(gcloud container clusters list \
    --project "${PROJECT_ID}" \
    --location "${LOCATION}" \
    --format='value(name)')

  if [[ -z "$CLUSTERS" ]]; then
    echo "  No clusters in ${LOCATION}"
    continue
  fi

  for CLUSTER in ${CLUSTERS}; do
    echo
    echo "Cluster: ${CLUSTER}"

    # Describe the cluster's Binary Authorization block
    DESC_JSON=$(gcloud container clusters describe "${CLUSTER}" \
      --project "${PROJECT_ID}" \
      --location "${LOCATION}" \
      --format=json)

    echo "${DESC_JSON}" | jq '.binaryAuthorization // {}'

    # Simple classification to highlight potential issues
    EVAL_MODE=$(echo "${DESC_JSON}" | jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')

    case "${EVAL_MODE}" in
      ENABLED|PROJECT_SINGLETON_POLICY_ENFORCE)
        STATUS="ENFORCED"
        ;;
      DISABLED)
        STATUS="DISABLED"
        ;;
      *)
        STATUS="UNKNOWN_OR_NOT_SET"
        ;;
    esac

    echo "  Evaluation mode: ${EVAL_MODE}  => Status: ${STATUS}"

    # Flag clusters without enforcement
    if [[ "${STATUS}" != "ENFORCED" ]]; then
      echo "  WARNING: Binary Authorization is NOT enforced on this cluster."
    fi
  done

  echo
done

echo "========================================"
echo "Review guidance:"
echo " - For each cluster, .binaryAuthorization.evaluationMode should indicate enforcement (e.g. ENABLED or PROJECT_SINGLETON_POLICY_ENFORCE)."
echo " - A problem is indicated when:"
echo "     * .binaryAuthorization is null or empty, OR"
echo "     * evaluationMode is DISABLED or NOT_SET, OR"
echo "     * No project-level Binary Authorization policy exists."
echo " - Policy contents (attestors, rules, exceptions) must be reviewed manually against your trust requirements."

How to interpret output (what indicates a problem)

For a cluster, any of the following indicate a potential finding for “only trusted container images are used”:
- .binaryAuthorization is {} or null.
- evaluationMode is DISABLED, NOT_SET, or missing.
- The script prints: WARNING: Binary Authorization is NOT enforced on this cluster.
At the project level:
- If No Binary Authorization policy configured for project is shown, clusters cannot enforce a meaningful Binary Authorization policy and should be reviewed and fixed via the cloud console/CLI/IaC.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​