What is Binary Authorization?
Binary Authorization is a deployment security service from Google Cloud that enforces policy-based controls for container images. The service prevents unauthorized or unsigned containers from being deployed to GKE, Cloud Run, Cloud Service Mesh, or Google Distributed Cloud.
Core Features
- Attestation-based deployment control with cryptographic signatures
- Integration with Artifact Registry for container images
- Flexible policy definition at project, cluster, or namespace level
- Dry-run mode support for testing policies
- Audit logging of all deployment decisions
Typical Use Cases
Secure CI/CD Pipelines: Only container images that have passed all build and test phases receive attestation and can be deployed.
Compliance Requirements: Organizations in regulated industries can prove that only verified software runs in production.
Multi-Team Governance: Central security teams define policies that apply to all development teams.
Benefits
- Protection against supply chain attacks through signed containers
- Seamless integration into existing GKE workflows
- No changes to container images required
- Complete audit trail for compliance documentation
Integration with innFactory
As a certified Google Cloud partner, innFactory supports you with Binary Authorization: architecture, migration, operations, and cost optimization.
Available Tiers & Options
Standard
- Fully managed
- Scalable
- Native GKE integration
- Requires attestor configuration
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Binary Authorization?
Binary Authorization is a security service that ensures only signed and trusted container images are deployed to Google Kubernetes Engine. It continuously validates whether running images comply with defined policies and can block deployments that violate them.
How does attestation work?
Developers or CI/CD pipelines create attestations for container images, for example after a successful build, test, or vulnerability scan. Binary Authorization validates these signatures against defined policies before deployment.
Which container platforms are supported?
Binary Authorization supports GKE, Cloud Run, Cloud Service Mesh, and Google Distributed Cloud. The former Anthos brand has been retired in favor of these product names. Integration is available via the Google Cloud console, gcloud, or Terraform.
What does Binary Authorization cost?
Binary Authorization is billed on a usage basis; for many configurations, pure policy enforcement incurs little to no additional cost. Exact prices and included free tiers are listed on the official pricing page.
Is Binary Authorization GDPR compliant?
Yes, Binary Authorization is available in EU regions and supports GDPR requirements as part of Google Cloud's compliance certifications.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
