Binary Authorization

Binary Authorization is enforced at the orchestration layer through an Admission Controller. When a deployment request is made, the controller intercepts it and queries the policy engine. The image must satisfy all configured attestations and signature requirements before the API server permits the pod to be scheduled. This decouples policy evaluation from the CI/CD pipeline, ensuring that even if a build system is compromised, the production cluster will reject unauthorized artifacts. The enforcement point is configured as a ValidatingWebhookConfiguration in Kubernetes, making it a mandatory, non-bypassable checkpoint.

Authorization policies are expressed as code using the Rego language, executed by the Open Policy Agent (OPA). This allows security teams to define granular, human-readable rules that go beyond simple signature presence. Example policies include:

• Requiring signatures from at least two distinct trusted signers.
• Blocking images with critical vulnerabilities in their Software Bill of Materials (SBOM).
• Enforcing that only images built from a specific, trusted CI/CD pipeline identity are allowed.
• Preventing the use of the latest tag, enforcing immutable, digest-based references. These policies are stored in version control, audited, and tested like any other software artifact.

Modern Binary Authorization systems leverage keyless signing via the Sigstore ecosystem to eliminate long-lived private key management. Instead of managing static secrets, a build system authenticates using its Workload Identity via an OpenID Connect token. Fulcio issues a short-lived code-signing certificate bound to that identity, and the signature is recorded in the Rekor transparency log. The authorization policy then verifies the signature against the certificate chain and checks for inclusion in the transparency log, providing both non-repudiation and a public audit trail without the operational burden of key rotation.

Beyond simple image signing, Binary Authorization can require cryptographically signed attestations about the artifact's provenance and quality. Using frameworks like in-toto, each step in the supply chain can produce a verifiable statement. An authorization policy can then mandate the presence of specific attestations before deployment, such as:

• A vulnerability scan attestation confirming zero critical CVEs.
• A test suite attestation proving all integration tests passed.
• A build provenance attestation linking the image to a specific source commit and build environment. This creates a data-driven, verifiable gate that ensures only artifacts meeting a complete compliance profile are deployed.

For operational resilience, Binary Authorization supports break-glass mechanisms that allow authorized administrators to bypass policy enforcement in emergency situations, with every override generating a permanent, auditable log entry. Additionally, dry-run mode enables security teams to deploy the admission controller in an audit-only capacity. In this mode, policy violations are logged and alerted on but do not block deployments. This allows organizations to observe the impact of a new policy on a live cluster, tune rules to eliminate false positives, and build confidence before switching to full enforcement mode.

An open-source ecosystem for keyless signing of software artifacts. Cosign signs container images using short-lived certificates bound to an OIDC identity, eliminating long-lived private key management. Signatures are stored in the OCI registry alongside the image and recorded in the Rekor transparency log. Binary Authorization policies can be configured to require valid Sigstore signatures, verifying both the artifact's integrity and the signer's identity before allowing deployment.

A graduated security framework that defines increasing levels of tamper resistance across the build and deployment lifecycle. SLSA Level 3 requires non-falsifiable provenance attestations generated by a hardened build platform. Binary Authorization enforces SLSA compliance at deploy time by verifying these attestations. An organization can mandate that only artifacts meeting SLSA Level 3 provenance are permitted in production, closing the loop between build integrity and runtime admission.