With Binary Authorization enabled on GKE, ensure only container images that passed Cloud Build regression tests can be deployed.

To enforce that only images passing regression tests are deployed, you need to integrate Binary Authorization with your CI/CD pipeline. The correct approach involves creating an attestor and a policy in Binary Authorization. The attestor represents the entity (e.g., your CI/CD system) that verifies images. The policy defines the rules, including requiring attestations from this attestor. As a Cloud Build step, after your regression tests pass, you would then create an attestation for the successfully tested container image. This attestation acts as proof that the image met your defined quality gates. When deployment is attempted, Binary Authorization checks for this required attestation, blocking any image that lacks it. Deploying Voucher Server and Client is a third-party solution not natively integrated with Binary Authorization for this specific attestation flow. Running a vulnerability scan produces scan results, not an attestation directly usable by Binary Authorization for passing regression tests. Setting Pod Security Standard to Restricted is a good security practice for runtime but doesn't enforce image provenance based on build-time test results.