This page provides an overview of how to set up Binary Authorization for use with
Cloud Service Mesh.

## Before you begin

Before you use Binary Authorization for Cloud Service Mesh, you must first
install Cloud Service Mesh on Google Kubernetes Engine (GKE). For more information,
see the [quickstart](https://docs.cloud.google.com/service-mesh/docs/quickstart-asm) or the [GKE installation guides](https://docs.cloud.google.com/service-mesh/docs/all-gke-install-guides).

## Setup Steps

To set up Binary Authorization for Cloud Service Mesh, perform the following steps:

1. [Enable Binary Authorization](https://docs.cloud.google.com/binary-authorization/docs/enabling).
2. Configure your Binary Authorization policy.

   > [!NOTE]
   > **Note:** Skip this step if you want to use attestations.

   You can configure the following features in your policy:
   - [Default rule](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#default-rule).
   - [Specific rules for your Cloud Service Mesh service identity](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#add-specific-rules-asm).
   - [Exempt images](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#exempt_images). [Learn more about exempt images](https://docs.cloud.google.com/binary-authorization/docs/key-concepts#exempt_images).
3. Optional: Use the `built-by-cloud-build` attestor to [deploy only images built by Cloud Build](https://docs.cloud.google.com/binary-authorization/docs/deploy-cloud-build).

4. Optional: [Use attestations](https://docs.cloud.google.com/binary-authorization/docs/attestations).

5. View audit logs by following instructions in [View audit logs for GKE](https://docs.cloud.google.com/binary-authorization/docs/viewing-audit-logs).

## Disable Binary Authorization for GKE with Cloud Service Mesh

To disable Binary Authorization for GKE with Cloud Service Mesh enabled,
follow the instructions in [Disable Binary Authorization for
GKE](https://docs.cloud.google.com/binary-authorization/docs/disabling).