GCP.BinaryAuthorization reference

Attestor

Source: src/GCP/BinaryAuthorization/Attestor.ts

A Binary Authorization attestor that verifies container-image attestations against a Grafeas Attestation Authority note.

Attestors have no labels field, so Alchemy stamps ownership into description for list / nuke. attestorId and noteReference are identity — changing either replaces the attestor. Description and public keys update in place.

Attestor: Creating an Attestor

Generated name

const note = yield* GCP.ContainerAnalysis.Note("Authority", {
  attestation: { hint: { humanReadableName: "QA" } },
});
const attestor = yield* GCP.BinaryAuthorization.Attestor("Qa", {
  noteReference: note.name,
});

Explicit id, description, and PKIX key

const attestor = yield* GCP.BinaryAuthorization.Attestor("Qa", {
  attestorId: "qa-attestor",
  noteReference: note.name,
  description: "signs production images",
  publicKeys: [
    {
      comment: "ci",
      pkixPublicKey: {
        publicKeyPem: pem,
        signatureAlgorithm: "EC_SIGN_P256_SHA256",
      },
    },
  ],
});

Attestor: Updating an Attestor

const attestor = yield* GCP.BinaryAuthorization.Attestor("Qa", {
  description: "signs staging and production images",
});

EvaluateGkePolicy

Source: src/GCP/BinaryAuthorization/EvaluateGkePolicy.ts

Runtime binding for Binary Authorization platforms.gke.policies.evaluate.

Bind this operation to a PlatformsPolicy in a Function/Action init phase. Provide EvaluateGkePolicyHttp.

EvaluateGkePolicy: Evaluating a GKE Policy

const evaluate = yield* GCP.BinaryAuthorization.EvaluateGkePolicy(policy);
const result = yield* evaluate({
  resource: {
    apiVersion: "v1",
    kind: "Pod",
    metadata: { name: "web", namespace: "default" },
    spec: { containers: [{ name: "nginx", image: "nginx" }] },
  },
});

EvaluateGkePolicyHttp

Source: src/GCP/BinaryAuthorization/EvaluateGkePolicyHttp.ts Kind: Layer · Provides: GCP.BinaryAuthorization.EvaluateGkePolicy

HTTP implementation of EvaluateGkePolicy.

GetAttestor

Source: src/GCP/BinaryAuthorization/GetAttestor.ts

Runtime binding for Binary Authorization attestors.get.

Bind this operation to an Attestor in a Function/Action init phase. Provide GetAttestorHttp.

GetAttestor: Reading an Attestor

const getAttestor = yield* GCP.BinaryAuthorization.GetAttestor(attestor);
const live = yield* getAttestor();

GetAttestorHttp

Source: src/GCP/BinaryAuthorization/GetAttestorHttp.ts Kind: Layer · Provides: GCP.BinaryAuthorization.GetAttestor

HTTP implementation of GetAttestor.

GetPlatformsPolicy

Source: src/GCP/BinaryAuthorization/GetPlatformsPolicy.ts

Runtime binding for Binary Authorization platforms.policies.get.

Bind this operation to a PlatformsPolicy in a Function/Action init phase. Provide GetPlatformsPolicyHttp.

GetPlatformsPolicy: Reading a Platform Policy

const getPolicy = yield* GCP.BinaryAuthorization.GetPlatformsPolicy(
  policy,
);
const live = yield* getPolicy();

GetPlatformsPolicyHttp

Source: src/GCP/BinaryAuthorization/GetPlatformsPolicyHttp.ts Kind: Layer · Provides: GCP.BinaryAuthorization.GetPlatformsPolicy

HTTP implementation of GetPlatformsPolicy.

PlatformsPolicy

Source: src/GCP/BinaryAuthorization/PlatformsPolicy.ts

A Binary Authorization platform policy. Platform policies apply to a specific runtime (gke by default) and evaluate images independently of the project-level admission policy.

Platform policies have no labels field, so Alchemy stamps ownership into description for list / nuke. policyId and platform are identity — changing either replaces the policy. Description and gkePolicy update in place via replace.

PlatformsPolicy: Creating a Platform Policy

Allow all images on GKE

const policy = yield* GCP.BinaryAuthorization.PlatformsPolicy(
  "Default",
  {},
);

Allowlist Google system images

const policy = yield* GCP.BinaryAuthorization.PlatformsPolicy(
  "Default",
  {
    policyId: "gke-default",
    description: "allowlisted system images",
    gkePolicy: {
      imageAllowlist: {
        allowPattern: ["gcr.io/google-containers/*"],
      },
    },
  },
);

PlatformsPolicy: Updating a Platform Policy

const policy = yield* GCP.BinaryAuthorization.PlatformsPolicy(
  "Default",
  {
    gkePolicy: {
      checkSets: [
        {
          displayName: "default",
          checks: [{ displayName: "deny", alwaysDeny: true }],
        },
      ],
    },
  },
);

ValidateAttestation

Source: src/GCP/BinaryAuthorization/ValidateAttestation.ts

Runtime binding for Binary Authorization attestors.validateAttestationOccurrence.

Bind this operation to an Attestor in a Function/Action init phase. Provide ValidateAttestationHttp.

ValidateAttestation: Validating an Attestation

const validate = yield* GCP.BinaryAuthorization.ValidateAttestation(
  attestor,
);
const result = yield* validate({
  occurrenceNote: note.name,
  occurrenceResourceUri: imageUri,
  attestation: {
    serializedPayload: btoa("payload"),
    signatures: [{ publicKeyId: keyId, signature: btoa("sig") }],
  },
});

ValidateAttestationHttp

Source: src/GCP/BinaryAuthorization/ValidateAttestationHttp.ts Kind: Layer · Provides: GCP.BinaryAuthorization.ValidateAttestation

HTTP implementation of ValidateAttestation.