Your organization is establishing a secure CI/CD deployment pipeline for containerized microservices running on Google Kubernetes Engine (GKE). The security team has defined the following compliance requirements: All container images pushed to Artifact Registry must automatically undergo vulnerability scanning. Images containing vulnerabilities exceeding defined severity thresholds must be prevented from deploying. Deployments must be cryptographically verified using an asymmetric key pair before admission to the GKE cluster. Workload deployments must ensure immutability by preventing image tag mutability exploits. Which combination of steps should you implement to configure this deployment gate?

Enable Artifact Analysis vulnerability scanning on the repository. Create a Binary Authorization attestor associated with an Artifact Analysis note and register the PKIX public key. Configure the Binary Authorization policy default admission rule to require attestations from this attestor and enable enforcement on the GKE cluster. In the pipeline, evaluate the scan results, sign the container image digest with the private key to create an attestation occurrence, and deploy the workload to GKE using the image digest.: What Binary Authorization with Attestation is Binary Authorization is a deploy-time security control that ensures only trusted and verified container images are deployed to Google Kubernetes Engine (GKE). It integrates directly with Artifact Analysis, which automatically scans container images stored in Artifact Registry for known vulnerabilities (Common Vulnerabilities and Exposures - CVEs) and records metadata notes and occurrences. How it meets the requirements Automated vulnerability scanning: Enabling Artifact Analysis ensures that whenever images are pushed to Artifact Registry, automatic scans evaluate packages against known vulnerability databases and assign severity scores based on the Common Vulnerability Scoring System (CVSS). Deploy-time enforcement gate: Creating a Binary Authorization attestor links a public verification key with an Artifact Analysis note. The Binary Authorization policy is configured with an admission rule that mandates attestations from this specific attestor, blocking any unverified container from admission. Cryptographic signing: In the CI/CD pipeline, automated scripts inspect the vulnerability scan occurrences. If the image satisfies the security threshold, the pipeline signs the container image digest using the corresponding private cryptographic key (such as an asymmetric ECDSA or RSA key) and creates an attestation occurrence in Artifact Analysis. Immutability and tag protection: Deploying workloads via the container image digest (image@sha256:...) rather than mutable tags guarantees that the cryptographic signature matches the exact bits being executed, preventing tag-swapping or drift. Key advantages/capabilities Cryptographic non-repudiation: Uses PKIX/X.509 keys or Cloud Key Management Service (Cloud KMS) to sign image digests, preventing tampering. Centralized policy governance: Enforces admission rules at the Kubernetes API admission controller layer before any pod execution begins. Full audit trail: GKE logs admission decisions, attestation checks, and policy evaluations directly to Cloud Audit Logs. Granular multi-stage validation: Allows pipelines to require distinct attestations across multiple stages (e.g., build verification, security scanning, QA approval). Why this is optimal This approach uses native Google Cloud security services to form an automated, end-to-end software supply chain security gate. It eliminates manual intervention while guaranteeing that only cryptographically signed, vulnerability-free container digests are admitted into the production GKE environment.