Your application services run in Google Kubernetes Engine (GKE). You want to make sure that only images from your centrally-managed Google Container Registry (GCR) image registry in the altostrat-imag

Question

Options

• ACreate a custom builder for Cloud Build that will only push images to gcr.io/altostrat-images.
• BUse a Binary Authorization policy that includes the whitelist name pattern gcr.io/altostrat-images/.
• CAdd logic to the deployment pipeline to check that all manifests contain only images from
• DAdd a tag to each image in gcr.io/altostrat-images and check that this tag is present when the

• A
  12% (3)
• B
  76% (19)
• C
  4% (1)
• D
  8% (2)

Explanation

Binary Authorization is Google Cloud's deploy-time security control for GKE that enforces policies on which container images can be deployed to a cluster. Using a whitelist name pattern of gcr.io/altostrat-images/ ensures that only images from that specific registry are allowed, with minimal setup. Option A (custom Cloud Build builder) only controls how images are pushed, not what is deployed to the cluster - a developer could still deploy an image from elsewhere. Option C (deployment pipeline logic) can be bypassed by direct kubectl apply. Option D (image tagging) is also bypassable and not enforced at the cluster level.

No community discussion yet for this question.