The problem requires ensuring that only images that have passed vulnerability scanning and meet corporate policies are allowed to be deployed to GKE, with the process being automated and integrated into the existing CI/CD pipeline Binary Authorization: This Google Cloud service is purpose-built to enforce deployment policies on images before they are run on Google Kubernetes Engine (GKE), Cloud Run, and other deployable platforms It acts as a policy gate that prevents the deployment of non-compliant images Extract Reference: "Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE), Cloud Run, and Anthos clusters" and "With Binary Authorization, you can require images to be signed by trusted authorities and enforce validation policies during deployment" (Google Cloud Documentation: "Binary Authorization overview" - https://cloudgooglecom/binary-authorization/docs/overview) Artifact Analysis (part of Container Analysis): Artifact Analysis (which includes Container Analysis) provides vulnerability scanning capabilities for container images stored in Artifact Registry It generates findings and metadata about vulnerabilities Extract Reference: "Container Analysis is a service that scans your images for known vulnerabilities and provides metadata about them" (Google Cloud Documentation: "Overview | Container Analysis" - https://cloudgooglecom/container-analysis/docs/overview) Binary Authorization can be configured to integrate with Artifact Analysis (or other attestors) to check for vulnerability scan results as part of its deployment policy Integration and Automation: Binary Authorization policies can require attestations before deployment An attestation confirms that an image meets specific criteria (eg, it has passed a vulnerability scan, it was signed by an approved CI/CD process, it adheres to corporate policies) Cloud Build can be configured to generate these attestations after a successful vulnerability scan (using Artifact Analysis) This fully automates the process and integrates directly into the CI/CD pipeline Extract Reference: "With Binary Authorization, you create a policy that enforces your requirements The policy defines rules that govern deployment For example, a policy can require all images to be signed by a trusted authority before deployment" (Google Cloud Documentation: "Binary Authorization overview" - https://cloudgooglecom/binary-authorization/docs/overview) Let's evaluate the other options:
A Custom script in Cloud Build Fail the build: While scanning during the build is good practice (shift-left security), failing the build only prevents the image from being pushed It doesn't prevent a developer or an automated process from manually deploying an old or non-compliant image that might already exist in Artifact Registry, or from bypassing the build system The enforcement needs to happen at deployment time B Configure GKE to use only images from a specific trusted Artifact Registry repository Manually inspect all images: Manually inspecting images is not automated and does not scale for a "large number of containerized applications" It also doesn't programmatically enforce vulnerability scan results or corporate policies D Enable Artifact Analysis vulnerability scanning and regularly scan images Remove any images that do not meet before deployment: This describes scanning and remediation, which are important However, it's a reactive approach ("remove any images") rather than a proactive enforcement ("only images that are allowed to be deployed") There's still a window where a non-compliant image could be deployed before it's removed Binary Authorization is the enforcement gate Therefore, configuring Binary Authorization with a policy that integrates with Artifact Analysis (or requires attestations based on its findings) is the most robust, automated, and Google-recommended solution for enforcing deployment policies based on vulnerability scanning and corporate compliance