Cloud Build Binary Authorization Attestation Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise security policy mandates that Google Kubernetes Engine (GKE) clusters in your production Google Cloud project only deploy container images that have verified build provenance and an attestation from Cloud Build. You execute builds inside Cloud Build private worker pools.

During pipeline testing, your single Cloud Build configuration file builds the Docker container, pushes it to Artifact Registry via an explicit docker push build step, and attempts to deploy the image directly to GKE. However, Binary Authorization blocks the deployment because the required built-by-cloud-build attestation is missing.

Which combination of actions should you take to ensure the attestation is properly generated and verified?

Add 'requestedVerifyOption: VERIFIED' to the build options, push the container image to Artifact Registry using the top-level 'images' field instead of 'docker push', and separate the build and deployment workloads into distinct pipeline configurations.

Update the Binary Authorization policy's default admission rule evaluation mode to 'ALWAYS_ALLOW' and switch enforcement mode to 'DRYRUN_AUDIT_LOG_ONLY'.

Create a custom Cloud Build step that signs the container digest using Cloud KMS and manually creates an attestation occurrence before running 'kubectl apply' in the same build configuration file.

Assign the 'roles/binaryauthorization.attestorsViewer' role to the Cloud Build service account, keep the single build configuration, and add the '--digest-file' flag to the 'docker push' command.

Professional Cloud DevOps Engineer

Cloud Build Binary Authorization Attestation Pipeline

Related questions