Binary Authorization | Google Cloud
Binary Authorization
Binary Authorization is a service offered by Google Cloud to ensure only authorized build images are deployed on GKE or cloudrun. It helps in validating the images being deployed in the container environment by teams authorized to attest the same. It helps devops teams by ensuring only authorized images are deployed. It helps the teams strengthen the Security Posture of the environment and natively integrates with Google Cloud Services like GKE and Cloudrun.
Key Requirements for Binary Authorization
The Software Supply chain Security in one of the Key requirements of any Enterprise Security and it aims to ensure that Software is sourced, built, tested and released according to Internal Best Practises to reduce the Attack Surface and have Secure Streamlined process for Deployment
With teams moving towards fully decoupled microservices architecture with shorter release cycles and including Continuous Integration (CI) and Continuous Deployment (CD), Binary Authorization helps by having Security teams attest the deployments to reduce the risk of unauthorized, vulnerable Softwares from being deployed
Key Features of Binary Authorization
Policy Enforcement
Binary Authorization integrates with Container Registry Vulnerability scanning and 3rd Party tools. Policies can be defined at Project, Cluster level. Teams can create different Policies sets for Different environments. It also has options to bypass the policy during emergency situations and policy has dry run options to test the changes before implementing
Integration
Binary Authorization can integrate with Security Command Center to provide Single Pane of Glass view for Policy Violations. Log Violations to Audit logging. Integrate with KMS for signing the image. Integrate also with Cloud Build, GKE and Cloud Run for Deployments. It can also integrate with 3rd Party Solutions like Cloudbees, Palo Alto Networks & Terraform
Attestations
Attestation is a process to assure that an image has completed the previous stage. Binary Authorization can be configured to check for a specific attestation before allowing the image to be deployed. Different types of Attestation includes; Build Verification where the Binary Authorization uses Attestation to check if the image was built by a specific Build System
Vulnerability Scanning Attestation for example is a process where Binary Authorization checks to see if the image is Checked by Container Analysis and is Safe to deploy. Attestation can be provided manually as well where a QA for example checks the features and attest the image manually
Binary Authorization in Action
To enable and setup Binary Authorization, please follow the below steps:-
- Enable the Required APIs in your project
- Create a Google Kubernetes Engine (GKE) cluster (Binary Authorization enabled)
- Create an attestor
- Generate a key pair used for attestation
- Create or Configure the custom policy
- Test the policy
- Create the Attestation
1. Enable the Required APIs in your project
We need to enable binary authorization api along with container registry/artifact registry and Kubernetes Engine API for this task.
2. Create a Google Kubernetes Engine (GKE) cluster (Binary Authorization enabled)
We are creating a zonal cluster binary-auth-cluster in zone us-central1-a
Configure or update your kubectl configuration
3. Create an attestor
Attestor creation is a 2 step process where we first create an attestor note and then the attestor itself. We then assign the attestor note to the newly created attestor. Attestor note (also called Container Analysis note) is used to store trusted metadata used in the authorization process.
a) Create the attestor note
Let’s define the attestor name and node id.
b) Create a JSON file in note_payload.json that describes the attestor note:
c) Create the note by sending an HTTP request to the Container Analysis REST API:
d) Verify that the note was created:
e) Create the Attestor
Create the attestor in Binary Authorization
f) Verify the attestor
We have the attestor created but to use the attestor, we need to associate a PKIX key pair with it. Lets create a PKIX key pair and associate.
4. Generate a key pair
Binary Authorization uses cryptographic keys to securely verify the identity of signers. This ensures that only authorized container images can be deployed. The key pair consists of a private key and a public key. The signer uses the private key to sign the container image digest, producing a signature that is then stored in an attestation. The public key is stored in the attestor. At deploy time, the Binary Authorization enforcer uses the attestor’s public key to verify the signature in the attestation before allowing the container to deploy.
Get Prasanna Bhaskaran Surendran’s stories in your inbox
Join Medium for free to get updates from this writer.
a) Create the private key
b) Extract the public key from the private key
c) Add the ECDSA public key to the attestor
d) Save the public key ID
To save the public key ID, you can copy it from the output of public-keys add above. To view your attestor’s public key ID after adding it to the attestor, use gcloud container binauthz attestors describe ${ATTESTOR_NAME}
5. Create and Configure the policy
A policy in Binary Authorization is a set of rules that govern the deployment of container images. You can have one policy per project. A default policy is configured to allow all container images to be deployed.
We will modify the default policy to our need and apply. In our case, we are modifying the policy to allows Google-maintained system images, sets the evaluationMode to REQUIRE_ATTESTATION, and adds a node named requireAttestationsBy that references the attestor you created
Import the policy YAML file into Binary Authorization:
6. Test the policy
You can test the policy you configured above by trying to deploy a sample container image to the cluster. The policy will block deployment because the required attestation has not been made.
Deploy a sample image to the cluster
Now, verify that the deployment was blocked by Binary Authorization:
You can get further details about the deployment
Lets delete this deployment and deploy a new one with assigning the attestation to the image.
We will now use the attestor we have created to assign an attestation to the image we want to deploy.
7) Create an attestation
i) Set variables that store the registry path and digest of the image
ii) Generate the attestation payload
iii) The payload JSON file has the following contents
iv) Sign the payload with your PKIX private key and output a signature file
v) Create and validate the attestation
where PUBLIC_KEY_ID is the public key id that you found in Generate a PKIX key pair above. The validate flag checks that the attestation can be verified by the attestor you configured in your policy.
vi) Verify that the attestation was created
Retest the policy
Again, test the policy by deploying a sample container image to the cluster.
To deploy the image, follow these steps:
To verify that the image was deployed
The command prints a message similar to the following, which indicates that deployment was successful
Integrate Binary Authorization in your Cloudbuild CI/CD Pipeline
Below cloudbuild.yaml is a CD Pipeline which automates the Binary Authorization process for image deployments to GKE. You can refer to Cloudbuild documentation for setting up the Cloudbuild for GKE here.
This blog is Co Authored by Prasanna Bhaskaran Surendran Partner Engineer Google Cloud and Umesh Kumar Co Founder Cloudside Technologies
