온프레미스 클러스터의 Binary Authorization은 배포 중 호스팅된 Binary Authorization 규칙의 시행을 Google Distributed Cloud로 확장하는 Google Cloud 제품입니다.
아키텍처
온프레미스 클러스터의 Binary Authorization은 Google Cloud에서 실행되는 Binary Authorization 시행자에 클러스터를 연결합니다.
컨테이너 이미지를 실행하는 요청을 온프레미스 클러스터에서 Binary Authorization 시행 API로 릴레이하는 방식으로 작동합니다.
하나의 사용자 컨트롤 플레인이 포함된 Distributed Cloud 아키텍처의 Binary Authorization입니다. (확대하려면 클릭)
클러스터에 대해 Kubernetes API 서버가 포드 실행 요청을 처리할 때, 제어 영역을 통해 허용 요청을 Binary Authorization 모듈로 전송합니다.
그런 후 허용 요청을 호스팅된 Binary Authorization API로 전달합니다.
Google Cloud에서 API는 요청을 수신하고 이를 Binary Authorization 시행자로 전달합니다. 그런 후 시행자는 요청이 Binary Authorization 정책을 충족하는지 확인합니다. 충족하면 Binary Authorization API가 '허용' 응답을 반환합니다. 그렇지 않으면 API가 '거부' 응답을 반환합니다.
온프레미스에서 Binary Authorization 모듈이 응답을 수신합니다.
Binary Authorization 모듈 및 다른 모든 허용 웹훅이 배포 요청을 허용하는 경우 컨테이너 이미지 배포가 허용됩니다.
실패로 인해 Binary Authorization과의 통신이 방해될 경우, 웹훅 특정 실패 정책은 컨테이너 배포가 허용되는지 확인합니다. 컨테이너 이미지 배포를 허용하도록 실패 정책을 구성하는 것을 Fail Open이라고 부릅니다. 컨테이너 이미지 배포를 거부하도록 실패 정책을 구성하는 것을 Fail Close라고 부릅니다.
실패 시 거부로 Binary Authorization 모듈을 구성하려면 manifest.yaml 파일을 수정하고 failurePolicy를 Ignore에서 Fail로 변경한 후 매니페스트 파일을 배포합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eBinary Authorization for on-premises clusters extends Google Cloud's Binary Authorization to Google Distributed Cloud environments, enabling deploy-time enforcement.\u003c/p\u003e\n"],["\u003cp\u003eIt supports Google Distributed Cloud on bare metal (version 1.14 or later) and on VMware (version 1.4 or later).\u003c/p\u003e\n"],["\u003cp\u003eThe system operates by using the Binary Authorization Module in the cluster, which acts as a validating admission webhook, to relay requests to the hosted Binary Authorization API.\u003c/p\u003e\n"],["\u003cp\u003eThe Binary Authorization enforcer checks if the deployment request meets the Binary Authorization policy, allowing or rejecting it accordingly.\u003c/p\u003e\n"],["\u003cp\u003eA webhook failure policy determines whether a container is permitted to deploy if communication with Binary Authorization fails, with the option to configure it for either fail open (allow) or fail close (deny).\u003c/p\u003e\n"]]],[],null,["# Binary Authorization for on-premises clusters overview\n\nThis document describes Binary Authorization for [on-premises clusters](/anthos/clusters/doc)\nthat are created as part of Google Distributed Cloud.\nTo get started installing and using the product, see\n[Set up Binary Authorization for on-premises clusters](/binary-authorization/docs/setting-up-on-prem).\nBinary Authorization supports the following environments:\n\n- [Google Distributed Cloud (software only) on bare metal](/anthos/clusters/docs/bare-metal/latest/overview) 1.14 or later.\n- [Google Distributed Cloud (software only) on VMware](/anthos/gke/docs/on-prem/latest/overview) 1.4 or later.\n\nBinary Authorization for on-premises clusters is a Google Cloud product that\nextends [Binary Authorization](/binary-authorization/docs/overview)'s hosted, deploy-time enforcement to\nGoogle Distributed Cloud.\n\nArchitecture\n------------\n\nBinary Authorization for on-premises clusters connects clusters\nto the Binary Authorization enforcer, running on Google Cloud.\nIt works by relaying\nrequests to run container images from on-premises clusters to the\nBinary Authorization enforcement API.\n[](/static/binary-authorization/docs/images/binauthz-for-gke-on-prem.svg) Binary Authorization for Distributed Cloud architecture with one user control plane. (Click to enlarge)\n\nBinary Authorization installs the\nBinary Authorization Module, which runs as a Kubernetes\n[validating admission webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/)\nin your cluster.\n\nWhen the Kubernetes API server for the cluster processes a request to run\na Pod, it sends an admission request, through the control plane, to the\nBinary Authorization Module.\n\nThe module then forwards the admission request to the hosted Binary Authorization\nAPI.\n\nOn Google Cloud, the API receives the request and forwards it to the\nBinary Authorization enforcer. The enforcer then checks that the request\nsatisfies the Binary Authorization policy. If it does, the Binary Authorization API\nreturns an \"allow\" response. Otherwise the API returns a \"reject\" response.\n\nOn premises, the Binary Authorization Module receives the response.\nIf the Binary Authorization Module and all of the other admission webhooks allow\nthe deploy request, the container image is allowed to deploy.\n\nFor more information about validating admission webhooks, see\n[Using Admission Controllers](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/).\n\nWebhook failure policy\n----------------------\n\n\u003cbr /\u003e\n\nWhen a failure prevents communication with Binary Authorization, a\nwebhook-specific failure policy determines if the container is\nallowed to deploy. Configuring the failure policy to allow the container image\nto deploy is known as *fail open* . Configuring the failure policy to deny the\ncontainer image from deploying is known as *fail close*.\n| **Note:** By default, the Binary Authorization Module is configured to fail open.\n\nTo configure the Binary Authorization Module for fail close, modify the\n`manifest.yaml` file and change the `failurePolicy` from\n`Ignore` to `Fail`, then deploy the manifest file.\n\nYou can [update the failure policy](/binary-authorization/docs/setting-up-on-prem#update-failure-policy)\nin the Binary Authorization Module.\n\nWhat's next\n-----------\n\n- To learn how to set up Binary Authorization for on-premises clusters, see [Set up Binary Authorization for on-premises clusters](/binary-authorization/docs/setting-up-on-prem).\n- To learn more about Google Distributed Cloud, see the [Google Distributed Cloud overview](/distributed-cloud/docs).\n- To learn more about Binary Authorization, see [Binary Authorization overview](/binary-authorization/docs/overview)."]]
