Google Distributed Cloud용 Binary Authorization은 Binary Authorization의 호스팅된 배포-시간 시행을 온프레미스 사용자 클러스터로 확장하는 Google Cloud 기능입니다. Google Distributed Cloud용 Binary Authorization의 기본 사용 사례는 사용자 클러스터의 워크로드 보호입니다. 이 가이드의 단계에 따라 Google Cloud 프로젝트에 구성된 Binary Authorization 정책의 시행 규칙을 사용자 클러스터에 적용합니다. Binary Authorization 정책 및 규칙에 대한 자세한 내용은 Binary Authorization 개요를 참조하세요.
기본 요건
사용자 클러스터에 Binary Authorization 정책 시행을 사용 설정하려면 먼저 다음 기본 요건 기준을 충족해야 합니다.
Fleet을 사용하여 클러스터 등록:gkectl로 만든 클러스터는 클러스터 구성 파일의 gkeConnect.projectID 필드에서 지정하는 Google Cloud 프로젝트에 등록됩니다. 이 프로젝트를 Fleet 호스트 프로젝트라고 합니다.
사용 사례, 권장사항, 예시 등 Fleet에 대한 자세한 내용은 Fleet 관리 문서를 참조하세요.
Binary Authorization 정책 평가자 역할을 Fleet 호스트 프로젝트에 추가: Binary Authorization 정책 평가자(roles/binaryauthorization.policyEvaluator) 역할을 Fleet 호스트 프로젝트의 Kubernetes 서비스 계정에 부여하려면 다음 명령어를 실행합니다.
클러스터가 프록시 서버 뒤에서 실행되는 경우 프록시 서버가 Binary Authorization API(binaryauthorization.googleapis.com)에 대한 연결을 허용하는지 확인합니다. 이 API는 클러스터에 배포된 이미지에 대해 정책 기반 배포 검증 및 제어를 제공합니다. 자세한 내용은 프록시 및 방화벽 규칙 프록시를 참조하세요.
기본 요건이 충족되면 새 클러스터를 만들거나 기존 클러스터를 업데이트할 때 Binary Authorization 정책을 사용 설정(또는 사용 중지)할 수 있습니다.
클러스터를 만드는 중에 Binary Authorization 정책 사용 설정
gkectl 또는 gcloud CLI를 사용하여 Binary Authorization 정책 시행을 사용 설정할 수 있습니다.
gkectl
gkectl을 사용하여 클러스터를 만들 때 Binary Authorization을 사용 설정하려면 다음 안내를 따르세요.
클러스터를 만들기 전에 다음 예시와 같이 사용자 클러스터 구성 파일에 binaryAuthorization.evaluationMode를 추가합니다.
ADMIN_CLUSTER_KUBECONFIG: 관리자 클러스터 kubeconfig 파일의 경로입니다.
USER_CLUSTER_CONFIG_FILE: 사용자 클러스터 구성 파일의 경로입니다.
binauthz-system 네임스페이스에 binauthz-module-deployment라는 배포가 준비될 때까지 기다립니다.
배포가 준비되면 Binary Authorization은 프로젝트 싱글톤 정책이라고도 부르는 Binary Authorization 정책에 지정된 규칙을 적용합니다. 이 정책은Google Cloud 프로젝트와 연결되어 있으며, 컨테이너 이미지 배포를 제어하는 규칙을 지정합니다. gkectl을 사용하여 클러스터를 업데이트하는 방법에 대한 자세한 내용은 클러스터 업데이트를 참조하세요.
Binary Authorization 정책 및 규칙에 대한 자세한 내용은 Binary Authorization 개요를 참조하세요.
사용 중지하려면 다음 안내를 따르세요.
클러스터 구성 파일을 수정하고 binaryAuthorization 섹션을 삭제하거나 evaluationMode를 disabled로 설정합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-01(UTC)"],[],[],null,["Binary Authorization for Google Distributed Cloud is a Google Cloud feature\nthat extends the hosted, deploy-time enforcement of\n[Binary Authorization](/binary-authorization/docs/overview) to your on-premises\nuser clusters. The primary use case for Binary Authorization on\nGoogle Distributed Cloud is to secure workloads on your user clusters. Follow the\nsteps in this guide to apply the enforcement rules of a Binary Authorization\npolicy configured in your Google Cloud project to your user clusters. For more\ninformation about Binary Authorization policies and rules, see\n[Binary Authorizationoverview](/binary-authorization/docs/key-concepts).\n| **Note:** If you enabled the ([Preview](/products#product-launch-stages)) Binary Authorization for Google Distributed Cloud, [disable it and clean up the\n| resources](/binary-authorization/docs/setting-up-on-prem#clean_up) before you enable the GA feature. Use the instructions in this document to enable the GA feature on version 1.28 or higher clusters.\n\nPrerequisites\n\nBefore you can enable Binary Authorization policy enforcement for a user\ncluster, ensure you've met the following prerequisite criteria:\n\n- **Register the cluster with a fleet:** For a cluster created with `gkectl`,\n the cluster is registered to the Google Cloud project that you specify\n in the `gkeConnect.projectID` field in the cluster configuration file. This\n project is referred to as the [fleet host\n project](/anthos/fleet-management/docs/fleet-concepts#fleet-host-project).\n To learn more about fleets, including use cases, best practices, and\n examples, see the [Fleet management](/anthos/fleet-management/docs)\n documentation.\n\n- **Enable the Binary Authorization API in your Google Cloud project:** [enable\n the Binary Authorization service](/binary-authorization/docs/enabling) in\n your fleet host project.\n\n- **Add the Binary Authorization Policy Evaluator role to your fleet host\n project:** To grant the Binary Authorization Policy Evaluator\n (`roles/binaryauthorization.policyEvaluator`) role to the Kubernetes service\n account on your fleet host project, run the following command:\n\n gcloud projects add-iam-policy-binding \u003cvar label=\"ID for the fleet host project\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:\u003cvar scope=\"PROJECT_ID\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog[binauthz-system/binauthz-agent]\" \\\n --role=\"roles/binaryauthorization.policyEvaluator\"\n\n If your cluster is running behind a proxy server, make sure the proxy server\n allows connections to the Binary Authorization API\n (`binaryauthorization.googleapis.com`). This API provides policy-based\n deployment validation and control for images deployed to your cluster. For\n more information about, see\n [Proxy and firewall rules proxy](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/firewall-rules).\n\nOnce you satisfy the prerequisites, you can enable (or disable) the\nBinary Authorization policy when you create a new cluster or update an existing\ncluster.\n\nEnable the Binary Authorization policy during cluster creation\n\nYou can enable the Binary Authorization policy enforcement with either `gkectl`\nor gcloud CLI. \n\n`gkectl`\n\nTo enable Binary Authorization when you create a cluster with `gkectl`:\n\n1. Before you create your cluster, add\n `binaryAuthorization.evaluationMode` to the user cluster\n configuration file as shown in the following example:\n\n ...\n binaryAuthorization:\n evaluationMode: \"project_singleton_policy_enforce\"\n ...\n\n Allowed values for `evaluationMode` are:\n - `project_singleton_policy_enforce`: enforce the rules specified in the\n Binary Authorization *policy* , also known as a *project-singleton\n policy*, on your Google Cloud project to govern the deployment of\n container images on your cluster.\n\n - `disabled`: disable the use of Binary Authorization for your cluster.\n This is the default value. If you omit `binaryAuthorization`, the\n feature is disabled.\n\n2. Make any other changes needed in the cluster configuration file and then\n run the `gkectl create cluster` command.\n\nFor more information about creating clusters, see\n[Google Distributed Cloud installation overview](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/install-overview).\n\nEnable or disable the Binary Authorization policy for an existing cluster\n\nIf you have an existing version 1.28 or higher cluster, you can enable or\ndisable Binary Authorization at any time, using `gkectl` or\ngcloud CLI. \n\n`gkectl`\n\n- To enable:\n\n 1. Edit the cluster configuration file to add the `binaryAuthorization`\n fields:\n\n ...\n binaryAuthorization:\n evaluationMode: \"project_singleton_policy_enforce\"\n\n 2. Update the cluster:\n\n ```\n gkectl update cluster \\\n --kubeconfig ADMIN_CLUSTER_KUBECONFIG \\\n --config USER_CLUSTER_CONFIG_FILE \\\n --force\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eADMIN_CLUSTER_KUBECONFIG\u003c/var\u003e: the path of the admin cluster kubeconfig file\n - \u003cvar translate=\"no\"\u003eUSER_CLUSTER_CONFIG_FILE\u003c/var\u003e: the path of your user cluster configuration file.\n 3. Wait for the Deployment named `binauthz-module-deployment` in the\n `binauthz-system` namespace to become ready.\n\n When the deployment is ready, Binary Authorization enforces the rules\n specified in the Binary Authorization *policy* , also known as a\n *project-singleton policy* . This policy is associated with your\n Google Cloud project and specifies rules to govern the deployment of\n container images. For more information about using `gkectl` to update a\n cluster, see [Update clusters](/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading).\n For more information about Binary Authorization policies and rules,\n see [Binary Authorization overview](/binary-authorization/docs/key-concepts).\n- To disable:\n\n 1. Edit the cluster configuration file and either remove the\n `binaryAuthorization` section or by set `evaluationMode` to\n `disabled`.\n\n ...\n binaryAuthorization:\n evaluationMode: \"disabled\"\n\n 2. Update the cluster:\n\n ```\n gkectl update cluster \\\n --kubeconfig ADMIN_CLUSTER_KUBECONFIG \\\n --config USER_CLUSTER_CONFIG_FILE \\\n --force\n ```\n\n After you make this change, wait a few minutes until the Deployment named\n `binauthz-module-deployment` in the `binauthz-system` namespace is\n removed.\n\nTroubleshooting\n\nIf you don't complete all of the prerequisites, you may see a message like the\nfollowing indicates there is a problem with the Binary Authorization configuration: \n\n```bash\nfailed to validate Binary Authorization policy\n\n(1) Ensure the Binary Authorization API is enabled for your Google Cloud project:\n gcloud services enable binaryauthorization.googleapis.com --project=PROJECT_ID\n(2) Ensure an IAM policy binding is in place granting binaryauthorization.policyEvaluator role to the binauthz-system/binauthz-agent Kubernetes service account:\n gcloud projects add-iam-policy-binding PROJECT_ID \\\n --member=\"serviceAccount:\u003cvar class=\"readonly\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog[binauthz-system/binauthz-agent]\" \\\n --role=roles/binaryauthorization.policyEvaluator\n```"]]
