클러스터를 만들거나 업데이트할 때 Binary Authorization을 사용 설정합니다. --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE 플래그가 Binary Authorization을 사용 설정하므로 이 플래그를 포함해야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-06(UTC)"],[],[],null,["# How to enable Binary Authorization\n\n| **Note:** Starting with GKE on AWS version 1.28, manual policy binding to authorize the service account for Binary Authorization is no longer necessary. The required permissions are now automatically granted to this service account. You can therefore disregard step 2 in the following instructions.\n\nTo enable Binary Authorization for GKE on AWS, perform the following steps:\n\n1. Enable the Binary Authorization API in your project:\n\n gcloud services enable binaryauthorization.googleapis.com \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e with the ID of your\n Google Cloud project.\n2. Grant the `binaryauthorization.policyEvaluator` role to the Kubernetes\n service account associated with the Binary Authorization agent:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=serviceAccount:\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e.svc.id.goog[gke-system/binauthz-agent] \\\n --role=\"roles/binaryauthorization.policyEvaluator\"\n\n3. Enable Binary Authorization when creating or updating a cluster. Make sure to\n include the flag\n `--binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE` since this\n flag enables Binary Authorization:\n\n ### Creating a cluster\n\n gcloud container aws clusters create \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\n Replace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with the name of\n your cluster.\n\n ### Updating a cluster\n\n gcloud container aws clusters update \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e \\\n --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE\n\n Replace \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e with the name of\n your cluster.\n\nBy following these steps, you ensure that only trusted and verified images\nare used to create Kubernetes containers in your GKE clusters. This helps\nto maintain a secure environment for your applications."]]
