Setelah layanan, fitur, atau produk secara resmi tidak
digunakan lagi, layanan, fitur, atau produk tersebut akan terus tersedia setidaknya selama jangka waktu yang ditentukan dalam
Persyaratan Layanan. Setelah jangka waktu ini, layanan akan dijadwalkan untuk dimatikan.
Otorisasi Biner mengakhiri dukungan untuk validasi berkelanjutan lama (CV lama)
dengan kebijakan singleton project untuk GKE.
Mulai 15 April 2024, Anda tidak dapat mengaktifkan CV lama untuk
Google Kubernetes Engine (GKE) di project baru.
CV lama akan terus memantau Pod GKE Anda melalui kebijakan project singleton untuk project yang sudah mengaktifkannya hingga 1 Mei 2025. Setelah 1 Mei 2025,
CV lama tidak akan lagi memantau Pod Anda, dan
entri Cloud Logging tidak akan lagi dibuat untuk gambar Pod yang tidak
sesuai dengan kebijakan Otorisasi Biner project-singleton.
Penggantian: Validasi berkelanjutan (CV) dengan kebijakan platform berbasis pemeriksaan
Selain dukungan untuk pengesahan, kebijakan platform berbasis pemeriksaan memungkinkan Anda memantau metadata image container yang terkait dengan Pod untuk membantu Anda memitigasi potensi masalah keamanan. Kebijakan berbasis pemeriksaan CV
memberikan pemeriksaan yang mencakup hal berikut:
Pemeriksaan kerentanan: Gambar diperiksa untuk mengetahui kerentanan keamanan yang berada pada tingkat keparahan yang Anda tentukan.
Pemeriksaan Sigstore: Image memiliki pengesahan yang ditandatangani oleh sigstore.
Pemeriksaan SLSA: Image dibuat
dari sumber di direktori tepercaya dan oleh builder tepercaya.
Seperti validasi berkelanjutan lama, CV dengan kebijakan berbasis pemeriksaan juga mencatat
Pod dengan image yang tidak sesuai ke Logging.
Jika Anda menggunakan validasi berkelanjutan lama (CV lama), lihat Migrasi.
Untuk mengetahui informasi selengkapnya tentang cara menggunakan CV dengan kebijakan platform berbasis pemeriksaan, lihat
Ringkasan validasi berkelanjutan.
Migrasi
Untuk bermigrasi dari kebijakan singleton project CV lama ke kebijakan platform berbasis pemeriksaan yang setara, lakukan hal berikut:
Untuk kebijakan singleton project ALWAYS_ALLOW, buat kebijakan platform berbasis pemeriksaan
tanpa blok checkSet.
Untuk kebijakan singleton project ALWAYS_DENY, buat kebijakan platform berbasis pemeriksaan dengan satu blok checkSet yang memiliki pemeriksaan alwaysDeny.
Untuk kebijakan singleton project yang memerlukan pengesahan, buat
kebijakan berbasis pemeriksaan tunggal, dan untuk setiap pengesah dalam kebijakan
singleton project, tambahkan satu SimpleSigningAttestationCheck
ke kebijakan berbasis pemeriksaan. Dengan menggunakan pasangan kunci yang sama, pemeriksaan akan terus
berfungsi dengan pengesahan yang ada, dan hanya mencatat image Pod yang tidak memiliki
pengesahan yang valid.
Kebijakan platform berbasis pemeriksaan dicakup ke cluster GKE, bukan Google Cloud project. Setelah membuat kebijakan platform berbasis pemeriksaan, Anda dapat menerapkan kebijakan tersebut ke satu atau beberapa cluster.
Untuk mengaktifkan CV dengan kebijakan platform berbasis pemeriksaan pada cluster,
setelan Otorisasi Biner cluster harus dikonfigurasi
selama proses pembuatan atau update cluster.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eBinary Authorization is discontinuing support for legacy continuous validation (legacy CV) with project-singleton policies for GKE, with new projects unable to enable it after April 15, 2024, and existing projects losing monitoring capabilities after May 1, 2025.\u003c/p\u003e\n"],["\u003cp\u003eContinuous validation (CV) with check-based platform policies is the replacement for legacy CV, allowing for monitoring of container image metadata and offering checks such as vulnerability, Sigstore, SLSA, and trusted directory checks.\u003c/p\u003e\n"],["\u003cp\u003eMigrating from a legacy CV project-singleton policy to a check-based platform policy involves creating a corresponding check-based policy with appropriate \u003ccode\u003echeckSet\u003c/code\u003e configurations.\u003c/p\u003e\n"],["\u003cp\u003eUnlike legacy CV policies, check-based platform policies are scoped to a GKE cluster, allowing the same policy to be applied to multiple clusters.\u003c/p\u003e\n"],["\u003cp\u003eTo use CV with check-based policies, the cluster's Binary Authorization must be configured during the cluster creation or update process.\u003c/p\u003e\n"]]],[],null,["# Legacy continuous validation deprecation and shutdown\n\nThe\n[Google Cloud Platform Terms of Service (section \"Discontinuation of Services\")](/terms)\ndefines the deprecation policy that applies to Binary Authorization.\nThe [deprecation policy](/terms/deprecation) only applies to the services,\nfeatures, or products listed therein.\n\n\nAfter a service, feature, or product is officially\ndeprecated, it continues to be available for at least the period of time defined in the\nTerms of Service. After this period of time, the service is scheduled for shutdown.\n\nBinary Authorization is ending support for legacy continuous validation (legacy CV)\nwith project-singleton policies for GKE.\n\n- As of April 15, 2024, you can't enable legacy CV for Google Kubernetes Engine (GKE) on new projects.\n- Legacy CV will continue monitoring your GKE Pods through project-singleton policies for existing projects for which it is already enabled until May 1, 2025. After May 1, 2025, legacy CV will no longer monitor your Pods, and Cloud Logging entries will no longer be produced for Pod images that don't conform to the project-singleton Binary Authorization policy.\n\nReplacement: Continuous validation (CV) with check-based platform policies\n--------------------------------------------------------------------------\n\nMonitor your Pods using [continuous validation (CV) with check-based platform policies](/binary-authorization/docs/overview-cv).\n\nIn addition to support for attestations, check-based platform policies let you\nmonitor the metadata of container images associated with your Pods to help you\nmitigate potential security issues. CV check-based policies\nprovide checks that include the following:\n\n- [Vulnerability check](/binary-authorization/docs/cv-vulnerability-check): The image is checked for security vulnerabilities that are at a level of severity that you define.\n- [Sigstore check](/binary-authorization/docs/cv-sigstore-check): The image has attestations that are signed by sigstore.\n- [SLSA check](/binary-authorization/docs/cv-slsa-check): The image was built from source in a trusted directory and by a trusted builder.\n- [Trusted directory check](/binary-authorization/docs/cv-trusted-directory-check): The image must reside in a trusted directory within a trusted image repository.\n\nLike legacy continuous validation, CV with check-based policies also logs\nPods with non-conformant images to Logging.\n\nIf you use legacy continuous validation (legacy CV), see [Migration](#migration).\n\nFor more information on how to use CV with check-based platform policies, see\n[Continuous validation overview](/binary-authorization/docs/overview-cv).\n\nMigration\n---------\n\nTo migrate from a legacy CV project-singleton policy to an\nequivalent check-based platform policy, do the following:\n\n- For an `ALWAYS_ALLOW` project-singleton policy, create a check-based platform policy without any `checkSet` block.\n- For an `ALWAYS_DENY` project-singleton policy, create a check-based platform policy with a single `checkSet` block that has an `alwaysDeny` check.\n- For a project-singleton policy that requires attestations, create a single check-based policy, and for each attestor in the project-singleton policy, add one [SimpleSigningAttestationCheck](/binary-authorization/docs/overview-cv#simple-signing-check) to the check-based policy. By using the same key pair, the check continues to work with your existing attestations, and logs only Pod images that don't have valid attestations.\n\nCheck-based platform policies are scoped to a GKE cluster, rather\nthan a Google Cloud project. After you create a check-based platform\npolicy, you can apply that policy to one or more clusters.\n\nTo enable CV with check-based platform policies on a cluster,\nthe cluster's Binary Authorization settings must be [configured](/binary-authorization/docs/creating-cluster#console)\nduring the cluster creation or update process."]]
