Question

A financial services company runs a CI/CD pipeline that pushes container images to Artifact Registry. Security requires that any image with a CRITICAL OS-package vulnerability must never be promoted to the production GKE cluster, while HIGH and below can proceed with tracking. The team already uses Binary Authorization with an attestor. What is the most effective way to automatically enforce this severity-based gate before deployment?

Accepted Answer

Enable Artifact Registry automatic vulnerability scanning, then use a Cloud Build step that queries the scan results via the Container Analysis API and only creates the Binary Authorization attestation when no CRITICAL vulnerabilities are found

Answer

Configure a GKE admission webhook that scans the running pod's filesystem at startup and evicts the pod if a CRITICAL vulnerability is detected

Answer

Rely on Security Command Center Container Threat Detection to alert the security team when a CRITICAL vulnerability is running, then manually delete the deployment

Answer

Set an Artifact Registry cleanup policy to automatically delete any image tagged with a CRITICAL vulnerability so it cannot be pulled by the cluster