This page provides instructions on how you can secure image deployments toCloud Run and Google Kubernetes Engine using Cloud Build.

Learn how to configureBinary Authorization to check for buildattestations and block deployments of images that are not generated byCloud Build. This process can reduce the risk of deployingunauthorized software.

Before you begin

1. Enable the Cloud Build, Binary Authorization, and Artifact Registry APIs.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains theserviceusage.services.enable permission.Learn how to grant roles.

   Enable the APIs

2. To use the command-line examples in this guide, install and configure theGoogle Cloud SDK.

   Note: If you've installed Google Cloud SDK previously, make sure you have thelatest available version by runninggcloud components update.

3. Set up Binary Authorization for your platform.

Control deployments with Binary Authorization

Apolicy in Binary Authorization is a set of rules that govern thedeployment of images. You can configure a rule to require digitally signedattestations.

Cloud Build generates and signs attestations at build time. WithBinary Authorization, you can use thebuilt-by-cloud-buildattestor toverify the attestations and only deploy images built by Cloud Build.

To create thebuilt-by-cloud-build attestor in your project, run a build inthat project.

To allow only images built by Cloud Build to be deployed, perform thefollowing steps:

You can view policy errors in the Binary Authorization log messages forGKE orCloud Run

Using dry-run mode

In dry-run mode, Binary Authorization checks policy compliance withoutactually blocking the deployment. Instead, policy compliance status messages arelogged to Cloud Logging. You can use these logs to determine if yourblocking policy is working correctly and to identify false positives.

To enable dry run, do the following:

You can view policy errors in the Binary Authorization log messages forGKE orCloud Run

Limitations

• Cloud Build and Binary Authorization must be in the same project.If you run your deployment platform in anotherproject, configure IAM roles for amulti-project setup,and refer to the Cloud Build project when adding thebuilt-by-cloud-build attestor in Binary Authorization.

• Cloud Build does not generate attestations when you push imagesto Artifact Registry using an explicitdocker push build step. Make sure you pushto Artifact Registry using theimages field in yourdocker build build step. Formore information onimages, seeDifferent ways of storing images in Artifact Registry.

• You must use separate build config files for your build pipeline anddeployment pipeline. This is because Cloud Build producesattestations only after the build pipeline completes successfully.Binary Authorization will then check the attestation before deploying theimage.

Enable attestations in private pools

By default, Cloud Build does not generate Binary Authorizationattestations for builds inprivate pools. To generateattestations, add therequestedVerifyOption: VERIFIED option to yourbuild configuration file:

steps:-name:'gcr.io/cloud-builders/docker'args:['build','-t','us-central1-docker.pkg.dev/$PROJECT_ID/quickstart-docker-repo/quickstart-image:tag1','.']images:-'us-central1-docker.pkg.dev/$PROJECT_ID/quickstart-docker-repo/quickstart-image:tag1'options:requestedVerifyOption:VERIFIED

After adding therequestedVerifyOption, Cloud Build enablesattestation generation andprovenance metadata for yourimage.

View attestor metadata

Anattestor is created the first time you run a build in a project. Theattestor ID is of the formprojects/PROJECT_ID/attestors/built-by-cloud-build,wherePROJECT_ID is your project ID.

You can check the build attestor metadata using the following command:

curl-XGET-H"Content-Type: application/json"\-H"Authorization: Bearer$(gcloudauthprint-access-token)"\https://binaryauthorization.googleapis.com/v1beta1/projects/PROJECT_ID/attestors/built-by-cloud-build

ReplacePROJECT_ID with the project where you runCloud Build.

The output contains information about the attestor and the corresponding publickeys. For example:

name": "projects/PROJECT_ID/attestors/built-by-cloud-build",  "userOwnedDrydockNote": {    "noteReference": "projects/PROJECT_ID/notes/built-by-cloud-build",    "publicKeys": [      {        "id": "//cloudkms.googleapis.com/v1/projects/verified-builder/locations/asia/keyRings/attestor/cryptoKeys/builtByGCB/cryptoKeyVersions/1",        "pkixPublicKey": {          "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMMvFxZLgIiWOLIXsaTkjTmOKcaK7\neIZrgpWHpHziTFGg8qyEI4S8O2/2wh1Eru7+sj0Sh1QxytN/KE5j3mTvYA==\n-----END PUBLIC KEY-----\n",          "signatureAlgorithm": "ECDSA_P256_SHA256"        }      },...      }    ],    "delegationServiceAccountEmail": "service-942118413832@gcp-binaryauthorization.iam.gserviceaccount.com"  },  "updateTime": "2021-09-24T15:26:44.808914Z",  "description": "Attestor autogenerated by build ID fab07092-30f4-4f70-caf7-4545cbc404d6"

What's next

• Learn aboutBinary Authorization.