Setting up Binary Authorization

Binary Authorization evaluates containerized workloads. It requires the container to be signed using a compliant key. We can sign the container images using either a Google-managed key or one created with Google’s CMEK. Also, the image must comply with a customer-defined policy.

This exercise will walk you through the steps of setting up the environment and then signing the container.

Here is an overview of the process:

1. Environment preparation:
   1. Create a key with CMEK.
   2. Create a Binary Authorization policy.
   3. Enable the policy.
2. Container preparation:
   1. Create a container.
   2. Sign the container.
   3. Deploy the container.

Let’s get started.

Creating a CMEK

Encryption keys are fundamental to the security of your applications and the systems you use to deliver those applications. CMEKs give you control over the keys you use to keep your customers’ data secure.

Binary Authorization uses either a customer-managed key or...