This page provides an overview of how to set up Binary Authorization enforcement in your
environment for use with Google Kubernetes Engine (GKE). You can set up
Binary Authorization by using the Google Cloud console or the Google Cloud CLI.
You can also perform some setup steps by using the Binary Authorization
[REST API](https://docs.cloud.google.com/binary-authorization/docs/reference/rest).

For an end-to-end tutorial that includes the following setup steps, see
[Get started using the Google Cloud CLI](https://docs.cloud.google.com/binary-authorization/docs/getting-started-cli)
or
[Get started using the Google Cloud console](https://docs.cloud.google.com/binary-authorization/docs/getting-started-console).

To set up Binary Authorization, perform the following steps:

1. [Enable Binary Authorization](https://docs.cloud.google.com/binary-authorization/docs/enabling).

2. [Create a cluster](https://docs.cloud.google.com/binary-authorization/docs/creating-cluster)
   with Binary Authorization enabled or
   [enable Binary Authorization on an existing cluster](https://docs.cloud.google.com/binary-authorization/docs/enable-cluster).

   > [!NOTE]
   > **Note:** At deployment time, Binary Authorization only scans images in the `containers` and `ephemeralContainers` fields of the [PodSpec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#podspec-v1-core). No other fields are scanned. [Init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) and [image volumes](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/) aren't scanned at deployment time.

3. Configure your Binary Authorization policy.

   > [!NOTE]
   > **Note:** Skip this step if you want to use attestations.

   You can configure the following features in your policy:
   - [Default rule](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#default-rule).
   - [Cluster-specific rules](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#set_cluster_specific_rules).
   - [Specific rules for your Kubernetes service identity or namespace](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#add-specific-rules-asm).
   - [Exempt images](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console#exempt_images). [Learn more about exempt images](https://docs.cloud.google.com/binary-authorization/docs/key-concepts#exempt_images).
4. Optional: If you have different Google Cloud projects that own your
   policy or your Container Registry repositories, grant the IAM
   roles required for cross-project access. For instructions, see
   [Configure cross-project access for Binary Authorization in GKE](https://docs.cloud.google.com/binary-authorization/docs/cross-project-access-gke).

5. Optional: Use the `built-by-cloud-build` attestor to [deploy only images built by Cloud Build](https://docs.cloud.google.com/binary-authorization/docs/deploy-cloud-build).

6. Optional: [Use attestations](https://docs.cloud.google.com/binary-authorization/docs/attestations).

7. [Deploy container images](https://docs.cloud.google.com/binary-authorization/docs/deploying-containers).

8. [View events in Cloud Audit Logs](https://docs.cloud.google.com/binary-authorization/docs/viewing-audit-logs).