Question

Your team runs a GKE production cluster and wants to guarantee that only container images that have passed an automated vulnerability scan and were built by your official Cloud Build pipeline can be deployed. Images built on developer laptops or without a scan must be rejected at deploy time. Which approach best meets this requirement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations, and have Cloud Build create a signed attestation only after the image passes the vulnerability scan.

Answer

Configure Artifact Registry to reject any image push that has critical vulnerabilities, relying on the registry scan gate to block bad images from being deployed.

Answer

Add a Cloud Build step that runs a script to delete images with vulnerabilities from Artifact Registry before the deployment stage executes.

Answer

Use a GKE admission webhook that checks the image tag naming convention to confirm the image came from the official pipeline.