[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis page provides example policies for Binary Authorization in YAML format, which can be configured via the Google Cloud CLI or console.\u003c/p\u003e\n"],["\u003cp\u003eBinary Authorization policies can be configured to allow all deployments, block almost all deployments, or require attestors to sign before deployment.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eglobalPolicyEvaluationMode\u003c/code\u003e setting allows Google-maintained system images to be exempted from policy enforcement, enabling smooth operation of Google Kubernetes Engine (GKE) clusters.\u003c/p\u003e\n"],["\u003cp\u003eDry run mode enables the testing of policies in a production environment by allowing non-conformant images to deploy while logging policy violations.\u003c/p\u003e\n"],["\u003cp\u003eCluster-specific rules can be defined to apply unique requirements to deployments in specific clusters, such as requiring multiple attestors for authorization in certain clusters.\u003c/p\u003e\n"]]],[],null,["# Example policies\n\n| **Note:** This document or section includes references to one or more terms that Google considers disrespectful or offensive. The terms are used because they are keywords in the software that's described in the document. \n| The terms: `whitelist`\n\nThis page contains example [policies](/binary-authorization/docs/key-concepts#policies) for\nBinary Authorization specified in [YAML format](/binary-authorization/docs/policy-yaml-reference). For\ninstructions on configuring policies in Binary Authorization, see\n[Configure a policy using the Google Cloud CLI](/binary-authorization/docs/configuring-policy-cli) or\n[Configure a policy using the Google Cloud console](/binary-authorization/docs/configuring-policy-console).\n\nAllow all deployments\n---------------------\n\nThe following example shows how to allow all container images to be deployed\nwith no constraints. \n\n```\nname: projects/example-project/policy\ndefaultAdmissionRule:\n evaluationMode: ALWAYS_ALLOW\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n```\n\nHere, the [default rule](/binary-authorization/docs/key-concepts#default-rules) has an\n[`evaluationMode`](/binary-authorization/docs/policy-yaml-reference#evaluationmode) of `ALWAYS_ALLOW`,\nwhich causes Binary Authorization to allow deployment of all container images. The\ndefault [`enforcementMode`](/binary-authorization/docs/policy-yaml-reference#enforcementmode) is set to\n`ENFORCED_BLOCK_AND_AUDIT_LOG`, but as all deployments are allowed, this action\nis never taken.\n\nBlock (almost) all deployments\n------------------------------\n\nThe following example shows how to block all container images from being\ndeployed, while allowing Google-maintained system images. These container images\nare required for most Google Kubernetes Engine (GKE) clusters\nto start successfully. \n\n```\nname: projects/example-project/policy\nglobalPolicyEvaluationMode: ENABLE\ndefaultAdmissionRule:\n evaluationMode: ALWAYS_DENY\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n```\n\nHere, [globalPolicyEvaluationMode](/binary-authorization/docs/key-concepts#google-maintained_system_images)\nis enabled so that images that are required by GKE are\nnot blocked by policy enforcement.\nThe [default rule](/binary-authorization/docs/key-concepts#default-rules) has an\n[`evaluationMode`](/binary-authorization/docs/policy-yaml-reference#evaluationmode) of `ALWAYS_DENY`, which\ncauses Binary Authorization to deny deployment of all container images. The\n[`enforcementMode`](/binary-authorization/docs/policy-yaml-reference#enforcementmode) is set to\n`ENFORCED_BLOCK_AND_AUDIT_LOG`, which causes Binary Authorization to block\ndeployment and write to the [audit log](/binary-authorization/docs/viewing-audit-logs).\n\nRequire attestors to sign before deployment\n-------------------------------------------\n\nThe following example shows how to require [attestors](/binary-authorization/docs/key-concepts#attestors)\nto authorize a release before a container image can be deployed. The deployment\nis blocked if all attestors have not signed. \n\n```\nname: projects/example-project/policy\nglobalPolicyEvaluationMode: ENABLE\ndefaultAdmissionRule:\n evaluationMode: REQUIRE_ATTESTATION\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n requireAttestationsBy:\n - projects/example-project/attestors/secure-build\n```\n\nHere, the default rule has an `evaluationMode` of `REQUIRE_ATTESTATION`, which\ncauses Binary Authorization to allow deployment of only those images which have\nbeen authorized by the required attestors in\n[`requireAttestationsBy`](/binary-authorization/docs/policy-yaml-reference#requireattestationsby).\n\nAllow deployments in dry run mode\n---------------------------------\n\nDry run mode is an enforcement mode in a policy that allows non-conformant images\nto be deployed, but writes details about the policy violation and deployment to\nthe audit log. Dry run mode allows you to test a policy in your production\nenvironment before it goes into effect.\n\nThe following example shows how to allow all non-conformant images to be\ndeployed in dry run mode. \n\n```\nname: projects/example-project/policy\nglobalPolicyEvaluationMode: ENABLE\ndefaultAdmissionRule:\n evaluationMode: REQUIRE_ATTESTATION\n enforcementMode: DRYRUN_AUDIT_LOG_ONLY\n requireAttestationsBy:\n - projects/example-project/attestors/secure-build\n```\n\nHere, the default rule has an\n[`enforcementMode`](/binary-authorization/docs/policy-yaml-reference#enforcementmode) of\n`DRYRUN_AUDIT_LOG_ONLY`, which allows deployment of images that have not been\nauthorized by the specified attestor to be deployed, but writes information\nabout the non-conformant deployment to the audit log.\n\nUse a cluster-specific rule\n---------------------------\n\nThe following examples shows a\n[cluster-specific rule](/binary-authorization/docs/key-concepts#cluster-specific_rules) that only allows\nthose container images to be deployed which have been authorized by the\nspecified attestors: \n\n```\nname: projects/example-project/policy\nglobalPolicyEvaluationMode: ENABLE\ndefaultAdmissionRule:\n evaluationMode: ALWAYS_DENY\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\nclusterAdmissionRules:\n us-east1-a.prod-cluster:\n evaluationMode: REQUIRE_ATTESTATION\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n requireAttestationsBy:\n - projects/example-project/attestors/secure-build\n - projects/example-project/attestors/prod-qualified\n```\n\nHere, the cluster-specific rule only applies to those container images deployed\nto `us-east1-a.prod-cluster`. The rule requires attestation by two attestors\nbefore an image can be deployed.\n\nAdd exempt images\n-----------------\n\nThe following example shows how to add additional paths in Container Registry\nor another registry to the list of images\n[exempt from the policy](/binary-authorization/docs/key-concepts#exempt_images): \n\n```\nname: projects/example-project/policy\nglobalPolicyEvaluationMode: ENABLE\nadmissionWhitelistPatterns:\n- namePattern: gcr.io/example-project-1/*\n- namePattern: gcr.io/example-project-2/my-app\ndefaultAdmissionRule:\n evaluationMode: ALWAYS_DENY\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n```\n\nHere, the matching patterns for additional exempt images are\n`gcr.io/example-project-1/*` and `gcr.io/example-project-2/my-app`."]]
