Question

Your organization runs production workloads on a GKE cluster. Security policy requires that only container images built by the approved Cloud Build pipeline and scanned for vulnerabilities may be deployed. Developers must not be able to deploy arbitrary images pulled from public registries or built on their laptops. You need to enforce this at deploy time on the cluster. What should you implement?

Accepted Answer

Enable Binary Authorization on the cluster with a policy that requires attestations from the CI/CD attestor, and have Cloud Build create attestations only after successful vulnerability scanning.

Answer

Configure an Artifact Registry IAM policy that grants the developers only the Artifact Registry Reader role so they cannot push images.

Answer

Enable Container Analysis vulnerability scanning on Artifact Registry and configure Security Command Center to alert when a vulnerable image is deployed.

Answer

Apply a Pod Security Admission policy on the namespace that restricts images to a specific trusted registry hostname prefix.