Error from server (Forbidden): error when creating "/tmp/create_pod.yaml": pods "breakglass-pod" is forbidden: image policy webhook backend denied one or more images: Image gcr.io/google-samples/hello-app denied by Binary Authorization default
admission rule. Denied by always_deny admission rule`.
ブレークグラスを有効にして再度デプロイする
このセクションでは、ブレークグラスを有効にします。ブレークグラスは Binary Authorization に固有ですが、有効にするには Pod 仕様の label フィールドを更新する必要があります。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eBreakglass is an emergency feature in Binary Authorization that allows the deployment of container images that would otherwise be blocked by policy.\u003c/p\u003e\n"],["\u003cp\u003eUsing breakglass overrides the Binary Authorization policy enforcement, and a breakglass event is automatically logged in Cloud Audit Logs.\u003c/p\u003e\n"],["\u003cp\u003eTo enable breakglass, a \u003ccode\u003ebreak-glass\u003c/code\u003e label must be added to the Pod specification.\u003c/p\u003e\n"],["\u003cp\u003eDemonstrating the use of breakglass involves updating the Binary Authorization policy to reject all image deployments and subsequently using the breakglass label to bypass this restriction and deploy an image.\u003c/p\u003e\n"],["\u003cp\u003eCleaning up involves deleting the Pod, removing the breakglass label, and resetting your policy.\u003c/p\u003e\n"]]],[],null,["# Use breakglass (GKE, Distributed Cloud)\n\n| **Note:** This document or section includes references to one or more terms that Google considers disrespectful or offensive. The terms are used because they are keywords in the software that's described in the document. \n| The terms: `whitelist`\n\nThis page provides instructions on using breakglass with Binary Authorization.\n\nBefore you begin\n----------------\n\nThis guide assumes you have\n[set up Binary Authorization](/binary-authorization/docs/setting-up).\n\nOverview\n--------\n\nYou use *breakglass* to deploy a container image that Binary Authorization blocks.\n\nBreakglass provides an emergency escape hatch that lets you override\nBinary Authorization policy enforcement to allow images to be deployed, even those\nthat would be disallowed by the policy.\n\nThis feature is implemented consistent with recommendations in the Kubernetes\n[admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) specification.\n\nWhen you use breakglass to deploy an image, a breakglass event is automatically\nlogged to Cloud Audit Logs, regardless of whether the deployment satisfies or\nviolates the policy. In Cloud Audit Logs, you can manually audit or\nautomatically trigger an alert or other downstream event.\n\nTo enable breakglass, you add a `label` field to the Pod specification with a\n`break-glass` policy flag.\n\nDemonstrate a breakglass event\n------------------------------\n\nThis section shows how to use breakglass to deploy images, including those\nthat violate the Binary Authorization policy.\n\n### Update the Binary Authorization policy to reject all requests to deploy\n\n| **Note:** We recommend that the following steps only be performed on a test Google Kubernetes Engine project. To demonstrate a policy violation that results in an image being blocked from deployment, the following instructions update the default Binary Authorization policy, disallowing **all** images from being deployed. This procedure replaces your existing policy. **We recommend you\n| save your existing policy before proceeding.**\n\nTo update the policy to disallow all images from being deployed, perform the\nfollowing steps: \n\n### Google Cloud console\n\n1. Go to the Binary Authorization page in the Google Cloud console.\n\n [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/)\n2. Click **Edit policy**.\n\n3. In the **Edit policy** page, in **Project default rule** , note the\n original evaluation mode, then click **Disallow all images**.\n\n4. Click **Save policy**.\n\n### gcloud\n\n1. To save the existing policy in the current project, execute the\n following command:\n\n ```\n gcloud container binauthz policy export \u003e SAVE_POLICY_YAML\n ```\n\n Replace \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e with the path of the export file---for\n example, `/tmp/save_policy.yaml`.\n2. Create a policy file:\n\n ```\n cat \u003e TEST_POLICY_YAML \u003c\u003c EOM\n admissionWhitelistPatterns:\n defaultAdmissionRule:\n enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG\n evaluationMode: ALWAYS_DENY\n globalPolicyEvaluationMode: DISABLE\n EOM\n ```\n\n Replace \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e with a file path---for example,\n `/tmp/policy.yaml`.\n3. Import the policy:\n\n gcloud container binauthz policy import \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eTEST_POLICY_YAML\u003c/var\u003e with a file path---for example,\n `/tmp/policy.yaml`.\n\nBy default, all images are now blocked from being deployed.\n\n### Attempt to deploy an image\n\nIn this section you attempt to deploy an image. The default rule of the policy\nis configured to disallow all images from being deployed, so the deploy request\nfails.\n\n1. Create a configuration file in YAML format. This file contains the basic\n information required to create the pod:\n\n ```\n cat \u003e /tmp/create_pod.yaml \u003c\u003c EOM\n apiVersion: v1\n kind: Pod\n metadata:\n name: breakglass-pod\n spec:\n containers:\n - name: container-name\n image: us-docker.pkg.dev/google-samples/containers/gke/hello-app@sha256:c62ead5b8c15c231f9e786250b07909daf6c266d0fcddd93fea882eb722c3be4\n EOM\n ```\n2. Create the Pod using `kubectl`:\n\n ```\n kubectl create -f /tmp/create_pod.yaml\n ```\n\n You see an error indicating that the image was blocked by your policy. The\n error resembles the following: \n\n ```\n Error from server (Forbidden): error when creating \"/tmp/create_pod.yaml\": pods \"breakglass-pod\" is forbidden: image policy webhook backend denied one or more images: Image gcr.io/google-samples/hello-app denied by Binary Authorization default\n admission rule. Denied by always_deny admission rule`.\n ```\n\n### Enable breakglass and deploy again\n\nIn this section you enable breakglass. Although breakglass is specific to\nBinary Authorization, you must update the `label` field on the Pod specification to\nenable it.\n\nTo enable breakglass, execute the following commands:\n\n1. Create a configuration file in YAML format.\n\n The following command creates the file containing the `break-glass` label\n and other information required to create the pod: \n\n ```\n cat \u003e /tmp/create_pod.yaml \u003c\u003c EOM\n apiVersion: v1\n kind: Pod\n metadata:\n name: pod-name\n labels:\n image-policy.k8s.io/break-glass: \"true\"\n spec:\n containers:\n - name: container-name\n image: us-docker.pkg.dev/google-samples/containers/gke/hello-app@sha256:c62ead5b8c15c231f9e786250b07909daf6c266d0fcddd93fea882eb722c3be4\n EOM\n ```\n2. Create the pod using `kubectl`:\n\n ```\n kubectl create -f /tmp/create_pod.yaml\n ```\n\n Note the output: `pod/pod-name created`\n\nFind the breakglass log entry in Cloud Audit Logs\n-------------------------------------------------\n\nView breakglass events in [Cloud Audit Logs](/binary-authorization/docs/viewing-audit-logs#breakglass_events_in).\n\nOlder PodSpecs that specify `annotations: alpha.image-policy.k8s.io/break-glass`\nalso trigger breakglass and produce log entries. Using that annotation is no\nlonger recommended but is still supported to maintain backwards compatibility.\n\nClean up\n--------\n\nTo delete the Pod and disable breakglass, do the following:\n\n1. Delete the Pod:\n\n \u003cbr /\u003e\n\n ```\n kubectl delete -f /tmp/create_pod.yaml\n \n ```\n\n \u003cbr /\u003e\n\n Verify you received output like `pod \u003cvar\u003epod-name\u003c/var\u003e deleted`.\n2. Remove the `label` block from your Pod specification.\n\n3. Reset your policy:\n\n ### Google Cloud console\n\n 1. Go to the Binary Authorization page in the Google Cloud console.\n\n [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/)\n 2. Click **Edit policy**.\n\n 3. In the **Edit policy** page, in **Project default rule**, reset\n the evaluation mode to the previous setting.\n\n 4. Click **Save policy**.\n\n ### gcloud\n\n 1. Reimport your original policy.\n\n gcloud container binauthz policy import \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003eSAVE_POLICY_YAML\u003c/var\u003e with the path to the file you\n created earlier in this guide.\n\n Your policy is reset.\n\nWhat's next\n-----------\n\n- View breakglass events in [Cloud Audit Logs](/binary-authorization/docs/viewing-audit-logs#breakglass_events_in)."]]
