Teams are bypassing dev and staging and deploying images directly to production in separate GKE clusters. You need a quick, low-effort Google Cloud control to enforce promotion testing. What do you implement?

Binary Authorization is a Google Cloud service designed specifically to enforce deployment policies on GKE. By configuring policies for dev, staging, and production clusters, you can require attestations (digital signatures) that prove an image has passed specific checks (like testing in a previous environment). The CI pipeline can automatically create these attestations after successful tests. This provides a strong, automated control against unauthorized deployments. Kubernetes lifecycle hooks and admission controllers are Kubernetes-native solutions that could be configured, but they require more custom development and maintenance compared to the managed Binary Authorization service, which is designed for this exact purpose with lower effort. A corporate policy is a procedural control, not a technical enforcement mechanism, and can easily be bypassed.