クラスタの Kubernetes API サーバーが Pod の実行リクエストを処理するとき、コントロール プレーンを介して Binary Authorization モジュールにアドミッション リクエストを送信します。
このモジュールが、ホストされている Binary Authorization API にアドミッション リクエストを転送します。
Google Cloud で、この API がリクエストを受信し、Binary Authorization の適用者に転送します。適用者は、リクエストが Binary Authorization ポリシーを遵守していることを確認します。遵守している場合、Binary Authorization API は「許可」レスポンスを返します。遵守していない場合、API は「拒否」レスポンスを返します。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2024-12-21 UTC。"],[[["\u003cp\u003eBinary Authorization for on-premises clusters extends Google Cloud's Binary Authorization to Google Distributed Cloud environments, enabling deploy-time enforcement.\u003c/p\u003e\n"],["\u003cp\u003eIt supports Google Distributed Cloud on bare metal (version 1.14 or later) and on VMware (version 1.4 or later).\u003c/p\u003e\n"],["\u003cp\u003eThe system operates by using the Binary Authorization Module in the cluster, which acts as a validating admission webhook, to relay requests to the hosted Binary Authorization API.\u003c/p\u003e\n"],["\u003cp\u003eThe Binary Authorization enforcer checks if the deployment request meets the Binary Authorization policy, allowing or rejecting it accordingly.\u003c/p\u003e\n"],["\u003cp\u003eA webhook failure policy determines whether a container is permitted to deploy if communication with Binary Authorization fails, with the option to configure it for either fail open (allow) or fail close (deny).\u003c/p\u003e\n"]]],[],null,["# Binary Authorization for on-premises clusters overview\n\nThis document describes Binary Authorization for [on-premises clusters](/anthos/clusters/doc)\nthat are created as part of Google Distributed Cloud.\nTo get started installing and using the product, see\n[Set up Binary Authorization for on-premises clusters](/binary-authorization/docs/setting-up-on-prem).\nBinary Authorization supports the following environments:\n\n- [Google Distributed Cloud (software only) on bare metal](/anthos/clusters/docs/bare-metal/latest/overview) 1.14 or later.\n- [Google Distributed Cloud (software only) on VMware](/anthos/gke/docs/on-prem/latest/overview) 1.4 or later.\n\nBinary Authorization for on-premises clusters is a Google Cloud product that\nextends [Binary Authorization](/binary-authorization/docs/overview)'s hosted, deploy-time enforcement to\nGoogle Distributed Cloud.\n\nArchitecture\n------------\n\nBinary Authorization for on-premises clusters connects clusters\nto the Binary Authorization enforcer, running on Google Cloud.\nIt works by relaying\nrequests to run container images from on-premises clusters to the\nBinary Authorization enforcement API.\n[](/static/binary-authorization/docs/images/binauthz-for-gke-on-prem.svg) Binary Authorization for Distributed Cloud architecture with one user control plane. (Click to enlarge)\n\nBinary Authorization installs the\nBinary Authorization Module, which runs as a Kubernetes\n[validating admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/)\nin your cluster.\n\nWhen the Kubernetes API server for the cluster processes a request to run\na Pod, it sends an admission request, through the control plane, to the\nBinary Authorization Module.\n\nThe module then forwards the admission request to the hosted Binary Authorization\nAPI.\n\nOn Google Cloud, the API receives the request and forwards it to the\nBinary Authorization enforcer. The enforcer then checks that the request\nsatisfies the Binary Authorization policy. If it does, the Binary Authorization API\nreturns an \"allow\" response. Otherwise the API returns a \"reject\" response.\n\nOn premises, the Binary Authorization Module receives the response.\nIf the Binary Authorization Module and all of the other admission webhooks allow\nthe deploy request, the container image is allowed to deploy.\n\nFor more information about validating admission webhooks, see\n[Using Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/).\n\nWebhook failure policy\n----------------------\n\n\u003cbr /\u003e\n\nWhen a failure prevents communication with Binary Authorization, a\nwebhook-specific failure policy determines if the container is\nallowed to deploy. Configuring the failure policy to allow the container image\nto deploy is known as *fail open* . Configuring the failure policy to deny the\ncontainer image from deploying is known as *fail close*.\n| **Note:** By default, the Binary Authorization Module is configured to fail open.\n\nTo configure the Binary Authorization Module for fail close, modify the\n`manifest.yaml` file and change the `failurePolicy` from\n`Ignore` to `Fail`, then deploy the manifest file.\n\nYou can [update the failure policy](/binary-authorization/docs/setting-up-on-prem#update-failure-policy)\nin the Binary Authorization Module.\n\nWhat's next\n-----------\n\n- To learn how to set up Binary Authorization for on-premises clusters, see [Set up Binary Authorization for on-premises clusters](/binary-authorization/docs/setting-up-on-prem).\n- To learn more about Google Distributed Cloud, see the [Google Distributed Cloud overview](/distributed-cloud/docs).\n- To learn more about Binary Authorization, see [Binary Authorization overview](/binary-authorization/docs/overview)."]]
