Cloud Build Binary Authorization Attestation Pipeline

What the Cloud Build and Binary Authorization Integration Is

Google Cloud provides automated build provenance and attestation generation through Cloud Build and Binary Authorization. When properly configured, Cloud Build generates a verifiable cryptographic attestation associated with the built-by-cloud-build attestor upon successful completion of a build.

How It Meets the Requirements

• Enabling Attestations in Private Pools: By default, Cloud Build does not generate attestations or provenance metadata for builds running in private worker pools. Adding requestedVerifyOption: VERIFIED to the options block of the build configuration explicitly enables attestation generation.
• Artifact Registry Image Registration: Cloud Build cannot automatically generate attestations when an explicit docker push step is used. Images must be specified under the top-level images field in the build config so that Cloud Build manages the upload and captures the digest necessary for the attestation.
• Separation of Build and Deployment Pipelines: Cloud Build emits attestations and writes provenance records only after the entire build pipeline finishes successfully. A single build configuration that builds and immediately attempts deployment will fail because the attestation does not yet exist while the build is still executing. Separating build and deployment into distinct configuration files ensures the attestation exists before GKE validates it.

Key Advantages

• Automated Provenance: Delivers SLSA Level 3 build assurance without custom signing scripts.
• Cryptographic Verification: Guarantees that only images produced by approved Cloud Build triggers are deployed to production clusters.
• Policy Enforcement: Integrates seamlessly with Binary Authorization admission controllers at deploy time.

Why This Is Optimal

This approach leverages native, fully managed platform controls to ensure zero-trust supply chain validation while adhering directly to Cloud Build's architectural lifecycle requirements.