Binary Authorization

Beyond simple signature checks, modern Binary Authorization systems validate in-toto attestations—cryptographically signed metadata that proves specific steps in the build pipeline were completed. Policies can require proof that:

• A specific Software Bill of Materials (SBOM) was generated
• Vulnerability scanning passed with zero critical findings
• The image was built on a SLSA Level 3 compliant pipeline This shifts security from trusting an image tag to trusting verifiable, non-repudiable claims about how the image was produced.

Binary Authorization is enforced at the Kubernetes admission control layer. When an API request to create or update a Pod is received, a validating webhook intercepts it before the object is persisted to etcd. The webhook queries the policy engine, which evaluates the image's signatures and attestations against the configured rules. If the evaluation fails, the request is denied with a clear error message, preventing non-compliant workloads from ever being scheduled onto cluster nodes.

Managing long-lived private keys at scale is a significant operational burden and a security risk. Binary Authorization integrates with Sigstore to enable keyless signing using OpenID Connect (OIDC) identities. The build system authenticates via its workload identity, receives a short-lived ephemeral signing certificate, and signs the artifact. The certificate and signature are recorded in a transparency log (Rekor). Verification checks the OIDC identity against the policy—for example, 'only images signed by the CI service account from repository X are allowed'—eliminating key distribution entirely.

A formal, machine-readable inventory of every component, library, and dependency within a container image. Binary Authorization policies often rely on SBOM data to verify that no high-severity vulnerabilities exist before allowing deployment.

• Formats: SPDX, CycloneDX
• Role: Provides the ingredient list that attestation and policy engines evaluate
• Integration: SBOMs are generated during the build and attached as in-toto attestations

An open-source project enabling automated, keyless signing of container images using short-lived ephemeral certificates tied to OpenID Connect identities. Sigstore eliminates the operational burden of long-lived signing key management.

• Components: Fulcio (CA), Rekor (transparency log), Cosign (client)
• Benefit: Cryptographically binds an image to its build identity without manual key distribution
• Binary Auth Link: The admission controller validates Sigstore signatures against the configured attestor

Supply-chain Levels for Software Artifacts provides a graduated checklist of controls (Levels 1-4) to prevent tampering and improve integrity. Binary Authorization enforces SLSA provenance by requiring attested build steps before admitting an image to production.

• Level 3: Requires non-falsifiable provenance generated in a hardened build environment
• Level 4: Demands hermetic, reproducible builds with two-person review
• Enforcement: Policies can mandate a minimum SLSA level for all production deployments

A metadata specification that cryptographically verifies the complete software supply chain layout. Each step in the pipeline—source checkout, dependency resolution, compilation—produces a signed attestation.

• Predicate Types: SLSA Provenance, SPDX SBOM, Vulnerability Scan results
• Verification: The Binary Authorization attestor validates the signed attestation chain before admitting the image
• Non-repudiation: Provides immutable evidence of the exact build process for audit and compliance

A Kubernetes-native plug-in that intercepts authenticated API requests to the cluster. Binary Authorization is implemented as a validating admission webhook that evaluates image signatures and attestations before the kubelet can pull and run the container.

• Failure Policy: Configured as 'Fail-Closed' to deny unverifiable images by default
• Scope: Can enforce policies at the cluster, namespace, or workload level
• Latency: Must respond within a strict timeout to avoid blocking the API server

The practice of referencing a container image by its immutable content-addressable SHA256 hash rather than a mutable tag like :latest. Digest pinning is a prerequisite for Binary Authorization, as signatures are computed over the digest.

• Syntax: image@sha256:abc123... instead of image:latest
• Guarantee: Ensures the exact same artifact is deployed every time, preventing tag mutation attacks
• Policy Enforcement: Binary Authorization policies can reject any image referenced by a mutable tag