You’ve integrated Cloud Build, Artifact Analysis, and created an attestor. Only images that pass automated UAT tests should be deployable to production GKE clusters. What next steps enforce this?

To enforce that only images passing UAT are deployed to production, the attestation must be signed with a secure key. Cloud KMS is the recommended and most secure service for storing cryptographic keys in Google Cloud, offering robust key management and auditing capabilities, unlike Kubernetes secrets which are less secure for this purpose. The Binary Authorization policy must then be configured on the production Google Cloud project, specifically targeting the GKE clusters where the images will be deployed. This policy will check for the required attestation before allowing deployment, ensuring only UAT-approved images reach production. Setting a rule for the UAT project would not prevent unapproved images from reaching production.