You build and test container images with Cloud Build and store images in Artifact Registry before deploying to Cloud Run. To ensure only tested images are deployed with minimal operational overhead, what do you implement?

Binary Authorization ensures only trusted images are deployed. By enabling it on your Cloud Run service and configuring it to require attestations, you create a policy that prevents unauthorized deployments. Cloud Build can automatically create an attestation (a digital signature confirming a policy has been met, like passing tests) once the image has successfully completed all tests. This attestation is then checked by Binary Authorization before deployment, providing a strong security control with minimal operational overhead. The other options are less effective or introduce unnecessary complexity. Deploying a new revision without serving traffic is a testing strategy, not a deployment gate for only tested images. Creating a GKE cluster is an entirely different deployment target and doesn't address the core requirement of ensuring only tested images are deployed to Cloud Run. Configuring build provenance provides an audit trail but doesn't prevent the deployment of untested images.