Enabling the service with Anthos Config Management

This guide describes how to enable Binary Authorization using Anthos Config Management. It assumes you have Anthos Config Management and the Config Management Operator installed and configured, and know how to configure the Operator using a YAML file.

Alternatively, you can enable Binary Authorization through Google Kubernetes Engine.

Before you begin

  • You must have an Anthos entitlement.
  • You must have Anthos Config Management installed and the Operator configured.

Enable Binary Authorization in the Operator

The following steps configure Anthos Config Management to enable Binary Authorization on one or more clusters.

  1. Update the Operator.

    In this step you edit the Operator configuration file as follows:

    1. Add the binauthz block to the spec block:

      binauthz:
        enabled: true
        # Information needed to determine which policy to enforce
        policyRef:
          gkeCluster:
            # The name (or ID) of the GCP project containing the cluster
            project: project-id
            # Location of this cluster
            location: zone
            # The name of the cluster.
            name: cluster-name
      
    2. Update the fields as follows:

      • Set enabled to true.
      • Set project to the project ID.
      • Set location to the zone in which this cluster runs, for example us-central1-c.
      • Set name to the name of the cluster, which can be found in the Google Kubernetes Engine menu.

        Visit the Google Kubernetes Engine menu

      The top of the config-management.yaml should like:

      apiVersion: configmanagement.gke.io/v1
      kind: ConfigManagement
      metadata:
        name: config-management
      spec:
        # Set to true to install and enable Binary Authorization
        binauthz:
          enabled: true
          # Information needed to determine which policy to enforce
          policyRef:
            gkeCluster:
              # The name (or ID) of the GCP project containing the cluster
              project: my-project
              # Location of this cluster
              location: us-central1-c
              # The name of the cluster.
              name: my-gke-cluster
      
  2. Update the Operator object:

    kubectl apply -f config-management.yaml
    

    At this point, Binary Authorization should start to enforce the policy.

  3. Verify the installation.

    To verify that Anthos Config Management enabled Binary Authorization, check that ValidatingWebhookConfiguration is running by entering the following command:

    kubectl get validatingwebhookconfigurations binauthz
    

    The output is similar to the following:

    NAME       CREATED AT
    binauthz   yyyy-mm-dd-xxxx
    

Uninstalling Binary Authorization

To uninstall Binary Authorization, edit the Operator configuration in config-management.yaml as follows:

  1. Set binauthz.enabled to false.

  2. Update the Operator object:

    kubectl apply -f config-management.yaml
    

After the Operator removes the Binary Authorization ValidatingWebhookConfiguration, uninstallation is complete.

What's next