An enterprise team wants to secure their container pipeline on Google Cloud. They need to automatically detect software vulnerabilities in container images stored in Artifact Registry and ensure that only cryptographically signed images can be deployed to Google Kubernetes Engine (GKE). Which TWO security solutions should the cloud architect implement?
- Enable automatic vulnerability scanning in Artifact Registry for container imagesAnswer
- Configure a Binary Authorization policy on the GKE cluster to require attestations prior to deploymentAnswer
- CEstablish a VPC Service Controls perimeter around Artifact Registry to validate container signatures
- DGrant the primitive Owner IAM role to the GKE node service account to inspect container vulnerabilities
Answer
The team should enable automatic vulnerability scanning in Artifact Registry to detect image vulnerabilities upon push, and configure a Binary Authorization policy on the GKE cluster to enforce cryptographic attestation before container deployment.
Automated vulnerability scanning in Artifact Registry inspects container images for security flaws at push time, while Binary Authorization checks image attestations at deployment time to ensure only signed container images run on GKE.
Step-by-Step Solution
Key Concept
Combining Artifact Registry vulnerability scanning for image analysis with Binary Authorization for deploy-time signature enforcement on GKE.
Estimated Time:1m 0s