Question

A financial services company enforces a Binary Authorization policy on its production GKE cluster that requires images to carry an attestation from an approved attestor before they can run. During a severe outage at 2 a.m., the on-call engineer must urgently deploy a hotfix image that has not yet passed the attestation pipeline. Company policy allows emergency deployments but mandates that every such deployment be recorded and reviewed afterward. What is the recommended way to deploy the unattested image while preserving an auditable record?

Accepted Answer

Add the breakglass annotation to the Pod specification so the deployment bypasses policy enforcement, which is logged in Cloud Audit Logs for later review.

Answer

Temporarily change the Binary Authorization policy default rule to ALWAYS_ALLOW, deploy the image, then revert the policy after the incident.

Answer

Grant the on-call engineer the Binary Authorization Policy Administrator role so the enforcement check is skipped for their deployments.

Answer

Disable the Binary Authorization admission controller on the cluster, deploy the image, and re-enable the controller once the hotfix is verified.