breakglass를 사용하여 이미지를 배포하면 breakglass 이벤트는 배포가 정책을 충족하거나 위반하는지 여부와 관계없이 자동으로 Cloud 감사 로그에 로깅됩니다. Cloud 감사 로그에서는 수동으로 감사를 수행하거나 감사 또는 기타 다운스트림 이벤트를 자동으로 트리거할 수 있습니다.
breakglass를 사용 설정하려면 break-glass 정책 플래그를 사용하여 포드 사양에 label 필드를 추가합니다.
Break Glass 이벤트 시연
이 섹션에서는 Binary Authorization 정책을 위반하는 이미지를 포함하여 breakglass를 사용하여 이미지를 배포하는 방법을 보여줍니다.
모든 배포 요청을 거부하도록 Binary Authorization 정책 업데이트
모든 이미지가 배포되지 않도록 정책을 업데이트하려면 다음 단계를 수행합니다.
Google Cloud 콘솔
Google Cloud 콘솔에서 Binary Authorization 페이지로 이동합니다.
Error from server (Forbidden): error when creating "/tmp/create_pod.yaml": pods "breakglass-pod" is forbidden: image policy webhook backend denied one or more images: Image gcr.io/google-samples/hello-app denied by Binary Authorization default
admission rule. Denied by always_deny admission rule`.
Break Glass 사용 설정 및 다시 배포
이 섹션에서는 breakglass를 사용 설정합니다. breakglass는 Binary Authorization에만 적용되지만 포드 사양의 label 필드를 업데이트하여 사용 설정해야 합니다.
breakglass를 사용 설정하려면 다음 명령어를 실행합니다.
YAML 형식으로 구성 파일을 만듭니다.
다음 명령어는 포드를 만드는 데 필요한 break-glass 라벨 및 기타 정보가 포함된 파일을 만듭니다.
annotations: alpha.image-policy.k8s.io/break-glass를 지정하는 이전 PodSpec도 breakglass를 트리거하고 로그 항목을 생성합니다. 이 주석을 사용하는 것은 더 이상 권장되지 않지만 이전 버전과의 호환성을 유지하기 위해 계속 지원됩니다.
삭제
포드를 삭제하고 breakglass를 사용 중지하려면 다음 안내를 따르세요.
포드를 삭제합니다.
kubectl delete -f /tmp/create_pod.yaml
pod <var>pod-name</var> deleted와 같은 출력을 수신했는지 확인합니다.
포드 사양에서 label 블록을 삭제합니다.
정책을 재설정합니다.
Google Cloud 콘솔
Google Cloud 콘솔에서 Binary Authorization 페이지로 이동합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-05-06(UTC)"],[[["\u003cp\u003eBreakglass is an emergency feature in Binary Authorization that allows the deployment of container images that would otherwise be blocked by policy.\u003c/p\u003e\n"],["\u003cp\u003eUsing breakglass overrides the Binary Authorization policy enforcement, and a breakglass event is automatically logged in Cloud Audit Logs.\u003c/p\u003e\n"],["\u003cp\u003eTo enable breakglass, a \u003ccode\u003ebreak-glass\u003c/code\u003e label must be added to the Pod specification.\u003c/p\u003e\n"],["\u003cp\u003eDemonstrating the use of breakglass involves updating the Binary Authorization policy to reject all image deployments and subsequently using the breakglass label to bypass this restriction and deploy an image.\u003c/p\u003e\n"],["\u003cp\u003eCleaning up involves deleting the Pod, removing the breakglass label, and resetting your policy.\u003c/p\u003e\n"]]],[],null,["# Use breakglass (GKE, Distributed Cloud)\n\n| **Note:** This document or section includes references to one or more terms that Google considers disrespectful or offensive. The terms are used because they are keywords in the software that's described in the document. \n| The terms: `whitelist`\n\nThis page provides instructions on using breakglass with Binary Authorization.\n\nBefore you begin\n----------------\n\nThis guide assumes you have\n[set up Binary Authorization](/binary-authorization/docs/setting-up).\n\nOverview\n--------\n\nYou use *breakglass* to deploy a container image that Binary Authorization blocks.\n\nBreakglass provides an emergency escape hatch that lets you override\nBinary Authorization policy enforcement to allow images to be deployed, even those\nthat would be disallowed by the policy.\n\nThis feature is implemented consistent with recommendations in the Kubernetes\n[admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) specification.\n\nWhen you use breakglass to deploy an image, a breakglass event is automatically\nlogged to Cloud Audit Logs, regardless of whether the deployment satisfies or\nviolates the policy. In Cloud Audit Logs, you can manually audit or\nautomatically trigger an alert or other downstream event.\n\nTo enable breakglass, you add a `label` field to the Pod specification with a\n`break-glass` policy flag.\n\nDemonstrate a breakglass event\n------------------------------\n\nThis section shows how to use breakglass to deploy images, including those\nthat violate the Binary Authorization policy.\n\n### Update the Binary Authorization policy to reject all requests to deploy\n\n| **Note:** We recommend that the following steps only be performed on a test Google Kubernetes Engine project. To demonstrate a policy violation that results in an image being blocked from deployment, the following instructions update the default Binary Authorization policy, disallowing **all** images from being deployed. This procedure replaces your existing policy. **We recommend you\n| save your existing policy before proceeding.**\n\nTo update the policy to disallow all images from being deployed, perform the\nfollowing steps: \n\n### Google Cloud console\n\n1. Go to the Binary Authorization page in the Google Cloud console.\n\n [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/)\n2. Click **Edit policy**.\n\n3. In the **Edit policy** page, in **Project default rule** , note the\n original evaluation mode, then click **Disallow all images**.\n\n4. Click **Save policy**.\n\n### gcloud\n\n1. To save the existing policy in the current project, execute the\n following command:\n\n ```\n gcloud container binauthz policy export \u003e SAVE_POLICY_YAML\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e with the path of the export file---for\n example, `/tmp/save_policy.yaml`.\n2. Create a policy file:\n\n ```\n cat \u003e TEST_POLICY_YAML \u003c\u003c EOM\n admissionWhitelistPatterns:\n defaultAdmissionRule:\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n evaluationMode: ALWAYS_DENY\n globalPolicyEvaluationMode: DISABLE\n EOM\n ```\n\n Replace \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e with a file path---for example,\n `/tmp/policy.yaml`.\n3. Import the policy:\n\n gcloud container binauthz policy import \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e with a file path---for example,\n `/tmp/policy.yaml`.\n\nBy default, all images are now blocked from being deployed.\n\n### Attempt to deploy an image\n\nIn this section you attempt to deploy an image. The default rule of the policy\nis configured to disallow all images from being deployed, so the deploy request\nfails.\n\n1. Create a configuration file in YAML format. This file contains the basic\n information required to create the pod:\n\n ```\n cat \u003e /tmp/create_pod.yaml \u003c\u003c EOM\n apiVersion: v1\n kind: Pod\n metadata:\n name: breakglass-pod\n spec:\n containers:\n - name: container-name\n image: us-docker.pkg.dev/google-samples/containers/gke/hello-app@sha256:c62ead5b8c15c231f9e786250b07909daf6c266d0fcddd93fea882eb722c3be4\n EOM\n ```\n2. Create the Pod using `kubectl`:\n\n ```\n kubectl create -f /tmp/create_pod.yaml\n ```\n\n You see an error indicating that the image was blocked by your policy. The\n error resembles the following: \n\n ```\n Error from server (Forbidden): error when creating \"/tmp/create_pod.yaml\": pods \"breakglass-pod\" is forbidden: image policy webhook backend denied one or more images: Image gcr.io/google-samples/hello-app denied by Binary Authorization default\n admission rule. Denied by always_deny admission rule`.\n ```\n\n### Enable breakglass and deploy again\n\nIn this section you enable breakglass. Although breakglass is specific to\nBinary Authorization, you must update the `label` field on the Pod specification to\nenable it.\n\nTo enable breakglass, execute the following commands:\n\n1. Create a configuration file in YAML format.\n\n The following command creates the file containing the `break-glass` label\n and other information required to create the pod: \n\n ```\n cat \u003e /tmp/create_pod.yaml \u003c\u003c EOM\n apiVersion: v1\n kind: Pod\n metadata:\n name: pod-name\n labels:\n image-policy.k8s.io/break-glass: \"true\"\n spec:\n containers:\n - name: container-name\n image: us-docker.pkg.dev/google-samples/containers/gke/hello-app@sha256:c62ead5b8c15c231f9e786250b07909daf6c266d0fcddd93fea882eb722c3be4\n EOM\n ```\n2. Create the pod using `kubectl`:\n\n ```\n kubectl create -f /tmp/create_pod.yaml\n ```\n\n Note the output: `pod/pod-name created`\n\nFind the breakglass log entry in Cloud Audit Logs\n-------------------------------------------------\n\nView breakglass events in [Cloud Audit Logs](/binary-authorization/docs/viewing-audit-logs#breakglass_events_in).\n\nOlder PodSpecs that specify `annotations: alpha.image-policy.k8s.io/break-glass`\nalso trigger breakglass and produce log entries. Using that annotation is no\nlonger recommended but is still supported to maintain backwards compatibility.\n\nClean up\n--------\n\nTo delete the Pod and disable breakglass, do the following:\n\n1. Delete the Pod:\n\n \u003cbr /\u003e\n\n ```\n kubectl delete -f /tmp/create_pod.yaml\n \n ```\n\n \u003cbr /\u003e\n\n Verify you received output like `pod \u003cvar\u003epod-name\u003c/var\u003e deleted`.\n2. Remove the `label` block from your Pod specification.\n\n3. Reset your policy:\n\n ### Google Cloud console\n\n 1. Go to the Binary Authorization page in the Google Cloud console.\n\n [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/)\n 2. Click **Edit policy**.\n\n 3. In the **Edit policy** page, in **Project default rule**, reset\n the evaluation mode to the previous setting.\n\n 4. Click **Save policy**.\n\n ### gcloud\n\n 1. Reimport your original policy.\n\n gcloud container binauthz policy import \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e with the path to the file you\n created earlier in this guide.\n\n Your policy is reset.\n\nWhat's next\n-----------\n\n- View breakglass events in [Cloud Audit Logs](/binary-authorization/docs/viewing-audit-logs#breakglass_events_in)."]]
