Abilita Autorizzazione binaria durante la registrazione o l'aggiornamento di un cluster.
Registra un cluster
Per abilitare Autorizzazione binaria durante la registrazione di un cluster, utilizza il
comando gcloud container attached clusters register. Segui le istruzioni riportate in
collega il cluster AKS
e includi l'argomento facoltativo
--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE:
Per abilitare Autorizzazione binaria durante l'aggiornamento di un cluster, utilizza il
comando gcloud container attached clusters update. Segui le istruzioni riportate in
Aggiorna il cluster AKS
e includi l'argomento facoltativo
--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE:
Se segui questi passaggi, ti assicuri che vengano utilizzate solo immagini attendibili e verificate
per creare container Kubernetes nei cluster GKE. In questo modo
si mantiene un ambiente sicuro per le tue applicazioni.
Configurare i criteri
L'attivazione di Autorizzazione binaria da sola non protegge automaticamente il cluster.
Per impostazione predefinita, consente il deployment di tutte le immagini container se non è configurato alcun criterio. Ciò significa che per proteggere efficacemente il cluster, devi definire e applicare un criterio che specifichi quali immagini sono consentite. Per
scoprire come configurare un criterio di autorizzazione binaria, consulta
Configurare un criterio utilizzando Google Cloud CLI.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[],[],null,["| **Note:** Starting with Kubernetes version 1.28, manual policy binding to authorize the service account for Binary Authorization is no longer necessary. The required permissions are now automatically granted to this service account. You can therefore disregard step 2 in the following instructions.\n\nTo enable Binary Authorization for GKE attached clusters, perform the following steps:\n\n1. Enable the Binary Authorization API in your project:\n\n gcloud services enable binaryauthorization.googleapis.com \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of your\n Google Cloud project.\n2. Grant the `binaryauthorization.policyEvaluator` role to the Kubernetes\n service account associated with the Binary Authorization agent:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=serviceAccount:\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog[gke-system/binauthz-agent] \\\n --role=\"roles/binaryauthorization.policyEvaluator\"\n\n3. Enable Binary Authorization when registering or updating a cluster.\n\n Register a cluster\n\n To enable Binary Authorization when registering a cluster, use the\n [`gcloud container attached clusters register` command](/sdk/gcloud/reference/container/attached/clusters/register). Follow the instructions in\n [attach your AKS cluster](/kubernetes-engine/multi-cloud/docs/attached/aks/how-to/attach-cluster),\n and include the optional argument\n `--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE`: \n\n gcloud container attached clusters register \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n ...\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\n Replace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with the name of\n your cluster.\n\n Update a cluster\n\n To enable Binary Authorization when updating a cluster, use the\n [`gcloud container attached clusters update` command](/sdk/gcloud/reference/container/attached/clusters/update). Follow the instructions in\n [update your AKS cluster](/kubernetes-engine/multi-cloud/docs/attached/aks/how-to/update-cluster),\n and include the optional argument\n `--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE`: \n\n gcloud container attached clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n ...\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\n Replace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with the name of\n your cluster.\n\nBy following these steps, you ensure that only trusted and verified images\nare used to create Kubernetes containers in your GKE clusters. This helps\nto maintain a secure environment for your applications.\n\nConfigure policies\n\nEnabling Binary Authorization alone doesn't automatically protect your cluster.\nBy default, it allows all container images to be deployed if no policy is\nconfigured. This means that to effectively secure your cluster, you need to\ndefine and enforce a policy that specifies which images are allowed. To\nlearn how to configure a Binary Authorization policy, see\n[Configure a policy using the Google Cloud CLI](/binary-authorization/docs/configuring-policy-cli)."]]
