Binary Authorization is enabled on your GKE clusters. Cloud Build runs regression tests and publishes images. How do you ensure only tested images can be deployed?

Binary Authorization requires attestations to verify image authenticity before deployment. The correct approach involves creating an attestor and a policy that mandates this attestation. After Cloud Build successfully runs regression tests, Kritis Signer is used within the Cloud Build pipeline to create the cryptographic attestation for the tested image. This attestation is then checked by Binary Authorization at deployment time, ensuring only approved images are deployed. Incorrect options: Voucher Server/Client is a separate open-source project, not a native Google Cloud Binary Authorization component. Pod Security Standards control pod capabilities, not image deployment approval based on testing. Digital signing is part of the attestation process, but not sufficient alone without Binary Authorization policy enforcement. Creating an attestation directly is not the standard or secure method; Kritis Signer handles the secure signing and attestation creation using a key managed by the attestor.