Binary Authorization 서비스 사용 설정

이 페이지에서는 배포자 프로젝트에서 Binary Authorization을 사용 설정하는 방법을 설명합니다.

먼저 프로젝트를 만들거나 선택합니다. 컨테이너를 배포하는Google Cloud 프로젝트에서 Binary Authorization을 사용 설정합니다. 이 프로젝트는 Google Kubernetes Engine (GKE), Cloud Run, Google Distributed Cloud와 같이 지원되는 플랫폼을 실행하는 동일한 프로젝트입니다.

Binary Authorization을 사용 설정하려면 다음 단계를 수행합니다.

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Binary Authorization API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Install the Google Cloud CLI.

외부 ID 공급업체(IdP)를 사용하는 경우 먼저 제휴 ID로 gcloud CLI에 로그인해야 합니다.

gcloud CLI를 초기화하려면, 다음 명령어를 실행합니다.

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Enable the Binary Authorization API.

Roles required to enable APIs

To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

Enable the API

Install the Google Cloud CLI.

외부 ID 공급업체(IdP)를 사용하는 경우 먼저 제휴 ID로 gcloud CLI에 로그인해야 합니다.

gcloud CLI를 초기화하려면, 다음 명령어를 실행합니다.

gcloud init

Binary Authorization이 사용 설정되어 있습니다. 이제 컨테이너 관리 플랫폼으로 설정할 수 있습니다.

경고: Binary Authorization 서비스 에이전트를 삭제하거나 역할을 변경하면 권한이 없으므로 Binary Authorization이 실패합니다.

다음 단계

• GKE로 Binary Authorization 지속적 검증 설정(미리보기)
• GKE로 Binary Authorization 시행 설정
• Cloud Build로 Binary Authorization 설정
• Distributed Cloud로 Binary Authorization 설정