Detections
Analytics

5.1.3 Enforce Binary Authorization for trusted GKE container image deployments

Information

Use Binary Authorization to enforce trusted image deployment policies for GKE Autopilot clusters. The policy should allow only approved container images to be deployed, based on defined admission rules such as approved image locations, trusted build or promotion processes, and required signed approvals where appropriate. Binary Authorization works with both Autopilot and Standard clusters.

Unrestricted image deployment can allow users or automation pipelines to run unapproved, vulnerable, tampered, or externally sourced images in the cluster. Binary Authorization integrates with GKE admission control to evaluate container images before deployment and enforce centrally managed policy decisions, such as requiring an image to come from an approved registry path or requiring a signed approval that verifies the image passed required build, scan, approval, or release controls.

Solution

Enable Binary Authorization enforcement on the GKE Autopilot cluster when the audit shows that the cluster is not using an enforcing evaluation mode. Use PROJECT_SINGLETON_POLICY_ENFORCE to enforce the project Binary Authorization policy. If the cluster also uses continuous validation with policy bindings, use POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE instead. Monitoring only modes should not be used as the remediation target for this control.

gcloud container clusters update $CLUSTER_NAME \\
 --location=$LOCATION \\
 --project=$PROJECT_ID \\
 --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE

Export the current Binary Authorization policy to a local YAML file. The trusted image deployment rules are edited in this policy file, not directly in the GKE cluster configuration.

gcloud container binauthz policy export \\
 --project=$PROJECT_ID > policy.yaml

 - Edit policy.yaml and update the defaultAdmissionRule or the applicable rule under clusterAdmissionRules so that trusted image controls are enforced. For signed approval based enforcement, set evaluationMode to REQUIRE_ATTESTATION set enforcementMode to ENFORCED_BLOCK_AND_AUDIT_LOG, and set requireAttestationsBy to the approved attestor resource.

defaultAdmissionRule:
 evaluationMode: REQUIRE_ATTESTATION
 enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
 requireAttestationsBy:
 - projects/$PROJECT_ID/attestors/$ATTESTOR_NAME
globalPolicyEvaluationMode: ENABLE

 - Import the updated Binary Authorization policy after review and approval.

gcloud container binauthz policy import policy.yaml \\
 --project=$PROJECT_ID

After remediation, test deployment behavior with both an approved image and an unapproved image. Approved images should be admitted, while images that do not meet the Binary Authorization policy should be blocked and logged.

Impact:

Enforcing Binary Authorization can block workloads that do not meet the defined image trust policy, including images from unapproved registry locations or images that are missing required signed approvals.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(5), 800-53|CM-10, CSCv7|5.2, CSCv7|5.3

Plugin: GCP

Control ID: 50a508b4a1ad0ec77ea2c9a590c05dc0b012ddf46c1630569776d58bb98e324d