En la lista de clústeres de Kubernetes, haz clic en el nombre de tu clúster.
En Seguridad, en la fila Autorización binaria, haz clic en el ícono de edición (edit).
En el cuadro de diálogo Editar autorización binaria, selecciona la casilla de verificación Habilitar autorización binaria y haz clic en Guardar cambios.
gcloud
Para un clúster zonal, ingresa el siguiente comando:
NAME: Es el nombre del clúster de GKE en el que deseas habilitar la autorización binaria.
ZONE: la zona en la que reside el clúster
Los clústeres pueden tener habilitada la aplicación de Autorización Binaria y la supervisión de CV. Para cambiar la configuración de aplicación y supervisión de la CV, establece --binauthz-evaluation-mode en uno de los siguientes valores:
POLICY_BINDINGS: habilita solo la supervisión de la CV e inhabilita una política de aplicación existente si la hay
PROJECT_SINGLETON_POLICY_ENFORCE: habilita solo la aplicación y, luego, inhabilita la supervisión de la CV si se habilitó antes
POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE: habilita la aplicación y la supervisión de la CV
NAME: Es el nombre del clúster de GKE en el que deseas habilitar la autorización binaria.
REGION: La región en la que reside el clúster
Los clústeres pueden tener habilitada la aplicación de Autorización Binaria y la supervisión de CV. Para cambiar la configuración de aplicación y supervisión de la CV, establece --binauthz-evaluation-mode en uno de los siguientes valores:
POLICY_BINDINGS: habilita solo la supervisión de la CV e inhabilita una política de aplicación existente si la hay
PROJECT_SINGLETON_POLICY_ENFORCE: habilita solo la aplicación y, luego, inhabilita la supervisión de la CV si se habilitó antes
POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE: habilita la aplicación y la supervisión de la CV
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-04-21 (UTC)"],[[["\u003cp\u003eThis guide explains how to enable Binary Authorization enforcement on an existing Google Kubernetes Engine (GKE) cluster using the Google Cloud console or the gcloud command-line tool.\u003c/p\u003e\n"],["\u003cp\u003eBefore enabling enforcement, you must create a standard GKE cluster and enable the Binary Authorization API.\u003c/p\u003e\n"],["\u003cp\u003eYou can enable Binary Authorization enforcement for either a zonal or regional cluster using the \u003ccode\u003egcloud container clusters update\u003c/code\u003e command, specifying the cluster name and zone or region.\u003c/p\u003e\n"],["\u003cp\u003eBinary Authorization enforcement can be configured alongside CV monitoring, with different modes available to enable one, the other, or both.\u003c/p\u003e\n"],["\u003cp\u003eAfter enabling the policy, it can take several minutes for the changes to take full effect on the cluster.\u003c/p\u003e\n"]]],[],null,["# Enable enforcement on an existing cluster\n\nThis guide shows you how to enable Binary Authorization enforcement on an existing Google Kubernetes Engine (GKE) cluster.\n\n\u003cbr /\u003e\n\nBefore you begin\n----------------\n\nBefore you use this guide do the following:\n\n1. Create a [standard](/kubernetes-engine/docs/concepts/cluster-architecture) GKE cluster. To learn more about creating standard clusters, see [Create a zonal cluster](/kubernetes-engine/docs/how-to/creating-a-zonal-cluster) or [Create a regional cluster](/kubernetes-engine/docs/how-to/creating-a-regional-cluster).\n2. [Enable the Binary Authorization API](/binary-authorization/docs/enabling).\n\nEnable enforcement\n------------------\n\nTo enable enforcement, perform the following steps: \n\n### Console\n\n1. In the Google Cloud console, go to the GKE page:\n\n [Go to GKE](https://console.cloud.google.com/kubernetes/list).\n2. In the **Kubernetes clusters** list, click the name of your cluster.\n\n3. Under **Security** , in the row for **Binary authorization** , click the\n edit icon (*edit*).\n\n4. In the **Edit Binary Authorization** dialog, select the\n **Enable Binary Authorization** checkbox and click **Save changes**.\n\n### gcloud\n\nFor a zonal cluster, enter the following command: \n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e \\\n --zone \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e \\\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the GKE cluster on which you want to enable Binary Authorization.\n- \u003cvar translate=\"no\"\u003eZONE\u003c/var\u003e: the zone where the cluster resides.\n\n\nClusters can have both Binary Authorization enforcement and\nCV monitoring enabled. To change CV monitoring\nand enforcement settings, set `--binauthz-evaluation-mode` to one\nof the following values:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_BINDINGS\u003c/var\u003e: enables only CV monitoring and disables an existing enforcement policy if there is one\n- \u003cvar translate=\"no\"\u003ePROJECT_SINGLETON_POLICY_ENFORCE\u003c/var\u003e: enables only enforcement and disables CV monitoring if it was previously enabled\n- \u003cvar translate=\"no\"\u003ePOLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE\u003c/var\u003e: enables both enforcement and CV monitoring\n\n\nFor more information on CV policy and cluster management, see\n[Manage CV platform policies](/binary-authorization/docs/manage-platform-policies).\n\n\u003cbr /\u003e\n\nAlternatively, for a regional cluster, enter the following command: \n\n gcloud container clusters update \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e \\\n --region \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e \\\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e: the name of the GKE cluster on which you want to enable Binary Authorization.\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the region where the cluster resides.\n\n\nClusters can have both Binary Authorization enforcement and\nCV monitoring enabled. To change CV monitoring\nand enforcement settings, set `--binauthz-evaluation-mode` to one\nof the following values:\n\n- \u003cvar translate=\"no\"\u003ePOLICY_BINDINGS\u003c/var\u003e: enables only CV monitoring and disables an existing enforcement policy if there is one\n- \u003cvar translate=\"no\"\u003ePROJECT_SINGLETON_POLICY_ENFORCE\u003c/var\u003e: enables only enforcement and disables CV monitoring if it was previously enabled\n- \u003cvar translate=\"no\"\u003ePOLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE\u003c/var\u003e: enables both enforcement and CV monitoring\n\n\nFor more information on CV policy and cluster management, see\n[Manage CV platform policies](/binary-authorization/docs/manage-platform-policies).\n\n\u003cbr /\u003e\n\n| **Note:** It can take a few minutes for the policy to take effect.\n\nWhat's next\n-----------\n\n- [Require attestations](/binary-authorization/docs/attestations)\n- [Deploy container images](/binary-authorization/docs/deploying-containers)\n- [View events in Cloud Audit Logs](/binary-authorization/docs/viewing-audit-logs)"]]
