Question

A financial services company runs microservices on GKE and must satisfy an auditor requirement that only container images built and scanned by the approved CI/CD pipeline can be deployed to production clusters. Developers must not be able to run arbitrary or manually pushed images. Which Google Cloud approach best enforces this control at deploy time?

Accepted Answer

Enable Binary Authorization on the production clusters with a policy requiring attestations signed by the trusted build and scan attestors before any image can be deployed.

Answer

Restrict IAM so that only the CI/CD service account has the Kubernetes Engine Developer role on the production namespace.

Answer

Enable vulnerability scanning in Artifact Registry and configure alerts when images with critical CVEs are pushed.

Answer

Use a VPC Service Controls perimeter around the GKE clusters to prevent images from outside the organization being pulled.