Question

Your organization enforces a Binary Authorization policy on a GKE cluster requiring attestations from your CI/CD pipeline. A security review reveals a concern: images that passed admission weeks ago may later be found to contain newly disclosed vulnerabilities, but they continue running in the cluster because the policy is only evaluated at Pod creation time. The security team wants ongoing assurance that running Pods still comply with the Binary Authorization policy, and to be alerted when they drift out of compliance, without blocking currently running workloads. What should you do?

Accepted Answer

Enable Binary Authorization continuous validation, which periodically re-evaluates running Pods against the policy and records non-compliant Pods in Cloud Logging.

Answer

Configure the Binary Authorization policy enforcement mode to 'Dryrun Audit Log Only' so all admission decisions are logged for later review.

Answer

Add a cron job that deletes and recreates all Pods every hour so the admission controller re-evaluates each image against the current policy.

Answer

Enable GKE Container Threat Detection to monitor runtime behavior and flag Pods running vulnerable binaries.