Binary Authorization

At its core, Binary Authorization validates that every container image scheduled for deployment carries a valid digital signature from a trusted authority. This process uses asymmetric cryptography—typically via tools like Cosign or Notary—to verify that the image was signed by an approved build system or developer identity. The verification occurs at the admission controller level, meaning the Kubernetes API server rejects any pod creation request that references an unsigned or improperly signed image before the pod is persisted to etcd.

• Uses OpenID Connect (OIDC) identities for keyless signing
• Validates signatures against a trusted public key or certificate authority
• Prevents deployment of images altered after the build pipeline

Beyond simple signature checks, Binary Authorization evaluates attestations—cryptographically signed metadata documents that make verifiable claims about an image. An attestation might certify that the image passed a specific vulnerability scan, that an SBOM was generated, or that the build adhered to SLSA Level 3 provenance requirements. Policies are authored to require specific attestations, creating a logical AND gate: an image must be signed and carry a valid vulnerability-free attestation to be admitted.

• Requires Trivy or Grype scan attestations before deployment
• Enforces SLSA provenance to verify build integrity
• Policies written in Rego or vendor-specific YAML

Binary Authorization integrates tightly with private container registries like Harbor or Artifact Registry to create a closed-loop security system. The registry acts as the source of truth, storing both the container images and their associated signatures and attestations as OCI artifacts. When the admission controller queries the registry, it retrieves the image manifest and all linked artifacts in a single atomic operation, ensuring that the signature verified is the one bound to the exact image digest being deployed.

• Stores signatures as OCI Artifacts alongside images
• Uses image digest pinning to prevent tag mutation attacks
• Supports air-gapped registries with offline signature verification

A Kubernetes-native plugin that intercepts authenticated API requests to the API server and can mutate or validate objects before they are persisted. In the context of Binary Authorization, a validating admission controller evaluates the cryptographic signatures of container images against a defined policy. If an image is unsigned or signed by an unauthorized authority, the admission controller rejects the pod creation request, preventing untrusted code from ever being scheduled onto cluster nodes.

A tool under the Sigstore project used to cryptographically sign container images and OCI artifacts. Cosign generates a digital signature that is stored alongside the image in the registry, enabling Binary Authorization systems to verify the signer's identity. Key capabilities include:

• Keyless signing using OpenID Connect identities
• Support for hardware tokens and KMS providers
• Generation of SBOM attestations
• Verification of signatures against a transparency log

The Supply-chain Levels for Software Artifacts framework provides a tamper-proof, attestable record of a software artifact's build process and origin. SLSA provenance is a critical input to Binary Authorization policies, as it allows deploy-time checks to verify not just who signed the image, but the entire build chain that produced it. This prevents supply chain attacks where a legitimate signer's credentials are compromised to sign malicious artifacts.

A cryptographically signed, verifiable statement about a container image that is stored alongside the image in the registry. Attestations extend Binary Authorization beyond simple signature checks to include:

• SBOM verification: Confirming the software bill of materials is complete
• Vulnerability scan results: Ensuring no critical CVEs exist
• Build environment details: Validating the build was executed in a trusted CI/CD pipeline These attestations allow for fine-grained policy decisions at deployment time.

A security mechanism that uses digital signatures to ensure only authorized, untampered container images are pulled and executed within a runtime environment. Docker Content Trust, implemented via the Notary project and The Update Framework (TUF), provides a signing and verification model that predates and complements Binary Authorization. While Content Trust operates at the Docker Engine pull level, Binary Authorization enforces policy at the Kubernetes admission level, providing defense-in-depth.