Question

Your platform team runs a Cloud Build pipeline that builds container images, pushes them to Artifact Registry, and then deploys to a GKE cluster via Cloud Deploy. A recent security audit found that a developer was able to manually deploy an image that had never passed through the official build pipeline. Leadership now requires that only images produced by your trusted Cloud Build pipeline can ever be deployed to the production GKE cluster, and that this rule is enforced at admission time regardless of who or what initiates the deployment. Which approach best satisfies this requirement?

Accepted Answer

Enable Binary Authorization on the production cluster with a policy that requires attestations, and configure Cloud Build to create a signed attestation for each image it builds using a dedicated attestor.

Answer

Restrict IAM so that only the Cloud Build service account has the Kubernetes Engine Developer role on the production cluster, preventing developers from deploying manually.

Answer

Enable vulnerability scanning in Artifact Registry and configure Cloud Deploy to block promotion of any image with critical vulnerabilities.

Answer

Use a VPC Service Controls perimeter around the production project so that only the Cloud Build private pool can push and deploy images.