Anthos Binary Authorization
Binary Authorization is a Google Cloud service aimed at providing security for your containerized software supply chain. It reduces the risk of deploying defective, vulnerable, or unauthorized software.
It allows you to create policies that kick in when there is an attempt to deploy a container on one of the supported platforms. It is done by means of so-called attestations that certify the images for the deployments.
At the time of writing this book, Binary Authorization supports the following platforms:
- GKE
- Cloud Run
- Anthos clusters on VMware
Binary Authorization compliments the suite of Google software supply chain services that includes Cloud Source Repositories, Cloud Build, Artifact Registry, and Container Analysis:
Figure 8.18 – The Cloud Build pipeline that creates a Binary Authorization attestation (Source: https://cloud.google.com/binary-authorization/docs/cloud-build?hl=zh-tw)
As...
