Quotas and limits

Request rate limits

Binary Authorization enforces the following request rate limits:

Request type	Value
Read request	100 per user-project-minute
Update or delete request	20 per user-project-minute
Create request	10 per user-project-minute
AdmissionReview request (Binary Authorization enforcement)	500 per user-project-minute

Note: When Binary Authorization enforcement is enabled, GKE sends AdmissionReview requests every time a Pod is created or updated, regardless of whether the creation or update is manual or automated, and regardless of whether there are new images being deployed. For example, it sends AdmissionReview requests when when a ReplicaSet creates a new Pod to create more capacity, or to compensate for a Pod or machine failure. Any Kubernetes operation that creates or updates many Pods sends an AdmissionReview request for each Pod separately. Every Admission review request counts toward the AdmissionReview quota.

Resource limits

Binary Authorization also enforces the following limits:

Limit	Value
Number of attestor resources per project	200
Number of attestor references per Policy	200
Number of keys per attestor	1000
Number of Binary Authorization platform policy bindings per cluster	10
Number of attestation projects allowed per check	10

Quota increases

If you would like to increase any of the limits, we might like to understand more about your needs. You can submit a Binary Authorization quota request for your project in the Google Cloud console.