> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Only Trusted Container Images Are Used

### More Info:

Use Binary Authorization to enforce that only signed, attested container images can be deployed to the cluster. This prevents running untrusted or unverified images.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Identify current Binary Authorization status**
           * On any machine with `gcloud` access:
             ```bash theme={null}
             gcloud container clusters describe CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --format=json | jq '.binaryAuthorization'
             ```
           * Review whether `enabled` is `true` and what `evaluationMode` is set to (`DISABLED`, `PROJECT_SINGLETON_POLICY_ENFORCE`, or `PROJECT_SINGLETON_POLICY_ALLOW_ALWAYS`).

        2. **Retrieve and review the current Binary Authorization policy**
           * On any machine with `gcloud` access:
             ```bash theme={null}
             gcloud container binauthz policy export --project PROJECT_ID > binauthz-policy.yaml
             ```
           * Open `binauthz-policy.yaml` and verify:
             * Required attestors are defined for relevant images/projects.
             * Any `admissionWhitelistPatterns` are strictly limited and justified.
             * The default rule enforces attestation for images that should be trusted only when signed.

        3. **Compare policy against organizational requirements**
           * With security and platform owners, confirm:
             * Which registries and image paths are allowed.
             * Which teams/signing keys/attestors must sign images.
             * Any exceptions (e.g., third‑party images) are explicitly listed and documented in the policy rather than broadly whitelisting entire registries.

        4. **Update the Binary Authorization policy as needed**
           * Edit `binauthz-policy.yaml` to:
             * Add/remove attestors and adjust admission rules so only properly signed images are allowed.
             * Tighten or remove unnecessary whitelist patterns.
           * Import the updated policy:
             ```bash theme={null}
             gcloud container binauthz policy import binauthz-policy.yaml --project PROJECT_ID
             ```

        5. **Enable or strengthen Binary Authorization on the cluster**
           * Choose an appropriate evaluation mode (typically `PROJECT_SINGLETON_POLICY_ENFORCE` for full enforcement after testing):
             ```bash theme={null}
             gcloud container clusters update CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE
             ```
           * For staged rollout, you may temporarily use `PROJECT_SINGLETON_POLICY_ALLOW_ALWAYS` to log decisions before enforcing.

        6. **Verify configuration and perform a deployment test**
           * Re‑check cluster configuration:
             ```bash theme={null}
             gcloud container clusters describe CLUSTER_NAME \
               --location LOCATION \
               --project PROJECT_ID \
               --format=json | jq '.binaryAuthorization'
             ```
           * Attempt to deploy:
             * One unsigned image that should be blocked (confirm admission is denied).
             * One properly signed/attested image (confirm admission is allowed).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot configure Binary Authorization or enforce trusted images because this control is managed at the GKE control-plane / cloud-provider level. To enable and configure Binary Authorization, make the changes via the Google Cloud console, gcloud CLI, or IaC as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Report Binary Authorization status for all GKE clusters in a project.
        # Requirements:
        #   - gcloud, jq
        #   - Authenticated with privileges to list and describe clusters & binauthz policy
        #
        # Usage:
        #   ./report-binauthz.sh <PROJECT_ID>
        #

        set -euo pipefail

        PROJECT_ID="${1:-}"

        if [[ -z "$PROJECT_ID" ]]; then
          echo "Usage: $0 <PROJECT_ID>" >&2
          exit 1
        fi

        echo "Project: $PROJECT_ID"
        echo "Timestamp: $(date -Iseconds)"
        echo "========================================"

        # List all regions/zones that have clusters
        LOCATIONS=$(gcloud container clusters list \
          --project "${PROJECT_ID}" \
          --format='value(location)' | sort -u)

        if [[ -z "$LOCATIONS" ]]; then
          echo "No clusters found in project ${PROJECT_ID}"
          exit 0
        fi

        # Try to fetch the Binary Authorization policy once (may not exist)
        echo
        echo "=== Project-level Binary Authorization Policy ==="
        if gcloud container binauthz policy export --project "${PROJECT_ID}" >/tmp/binauthz-policy.yaml 2>/dev/null; then
          echo "Binary Authorization policy FOUND for project ${PROJECT_ID}"
          echo "Policy summary:"
          # Show only high-level fields; detailed review is manual
          grep -E '^(defaultAdmissionRule|clusterAdmissionRules:|globalPolicyEvaluationMode:)' -n \
            /tmp/binauthz-policy.yaml || true
        else
          echo "No Binary Authorization policy configured for project ${PROJECT_ID}"
        fi
        echo "========================================"
        echo

        # For each cluster, show Binary Authorization configuration
        for LOCATION in ${LOCATIONS}; do
          echo "=== LOCATION: ${LOCATION} ==="
          CLUSTERS=$(gcloud container clusters list \
            --project "${PROJECT_ID}" \
            --location "${LOCATION}" \
            --format='value(name)')

          if [[ -z "$CLUSTERS" ]]; then
            echo "  No clusters in ${LOCATION}"
            continue
          fi

          for CLUSTER in ${CLUSTERS}; do
            echo
            echo "Cluster: ${CLUSTER}"

            # Describe the cluster's Binary Authorization block
            DESC_JSON=$(gcloud container clusters describe "${CLUSTER}" \
              --project "${PROJECT_ID}" \
              --location "${LOCATION}" \
              --format=json)

            echo "${DESC_JSON}" | jq '.binaryAuthorization // {}'

            # Simple classification to highlight potential issues
            EVAL_MODE=$(echo "${DESC_JSON}" | jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')

            case "${EVAL_MODE}" in
              ENABLED|PROJECT_SINGLETON_POLICY_ENFORCE)
                STATUS="ENFORCED"
                ;;
              DISABLED)
                STATUS="DISABLED"
                ;;
              *)
                STATUS="UNKNOWN_OR_NOT_SET"
                ;;
            esac

            echo "  Evaluation mode: ${EVAL_MODE}  => Status: ${STATUS}"

            # Flag clusters without enforcement
            if [[ "${STATUS}" != "ENFORCED" ]]; then
              echo "  WARNING: Binary Authorization is NOT enforced on this cluster."
            fi
          done

          echo
        done

        echo "========================================"
        echo "Review guidance:"
        echo " - For each cluster, .binaryAuthorization.evaluationMode should indicate enforcement (e.g. ENABLED or PROJECT_SINGLETON_POLICY_ENFORCE)."
        echo " - A problem is indicated when:"
        echo "     * .binaryAuthorization is null or empty, OR"
        echo "     * evaluationMode is DISABLED or NOT_SET, OR"
        echo "     * No project-level Binary Authorization policy exists."
        echo " - Policy contents (attestors, rules, exceptions) must be reviewed manually against your trust requirements."
        ```

        **How to interpret output (what indicates a problem)**

        * For a cluster, any of the following indicate a potential finding for “only trusted container images are used”:
          * `.binaryAuthorization` is `{}` or `null`.
          * `evaluationMode` is `DISABLED`, `NOT_SET`, or missing.
          * The script prints: `WARNING: Binary Authorization is NOT enforced on this cluster.`

        * At the project level:
          * If `No Binary Authorization policy configured for project` is shown, clusters cannot enforce a meaningful Binary Authorization policy and should be reviewed and fixed via the cloud console/CLI/IaC.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>