ื™ืฆื™ืจืช ืืฉื›ื•ืœ

ื‘ื“ืฃ ื”ื–ื” ืžื•ืกื‘ืจ ืื™ืš ืœื™ืฆื•ืจ ืืฉื›ื•ืœ ื‘-Google Kubernetes Engine โ€ (GKE) ืขื Binary Authorization ืžื•ืคืขืœ. ืžื‘ืฆืขื™ื ืืช ื”ืฉืœื‘ ื”ื–ื” ื‘ืฉื•ืจืช ื”ืคืงื•ื“ื” ื‘ืืžืฆืขื•ืช ืคืงื•ื“ื•ืช gcloud ืื• ื‘ืžืกื•ืฃ Google Cloud . ื”ืฉืœื‘ ื”ื–ื” ื”ื•ื ื—ืœืง ืžื”ื’ื“ืจืช Binary Authorization ืœ-GKE.

ืœืคื ื™ ืฉืžืชื—ื™ืœื™ื

ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืขื Binary Authorization ืžื•ืคืขืœ (ื ื™ื˜ื•ืจ CV ื‘ืœื‘ื“)

ื”ืชื›ื•ื ื” Binary Authorization ืคื•ืขืœืช ืขื ืืฉื›ื•ืœื•ืช ื‘ืžืฆื‘ Autopilot ืื• ื‘ืžืฆื‘ Standard. ื›ื“ื™ ืœื”ื’ื“ื™ืจ ืžืฆื‘ ื”ืขืจื›ื” ืฉืœ ื ื™ื˜ื•ืจ ื‘ืœื‘ื“, ืฆืจื™ืš ืœืฆื™ื™ืŸ ืœืคื—ื•ืช ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืžื‘ื•ืกืกืช-ื‘ื“ื™ืงื” ืื—ืช.

ื›ื“ื™ ืœื™ืฆื•ืจ ืืฉื›ื•ืœ ืขื Binary Authorization ืฉืžื•ืคืขืœ ื‘ื• ืžืขืงื‘ ืื—ืจื™ CV ื‘ืœื‘ื“:

ื”ืžืกื•ืฃ

ื‘ืฉืœื‘ื™ื ื”ื‘ืื™ื ืžื•ืกื‘ืจ ืื™ืš ืœื”ื’ื“ื™ืจ ืืฉื›ื•ืœ ืจื’ื™ืœ.

  1. ื ื›ื ืกื™ื ืœื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ืœื•ื—ืฆื™ื ืขืœ Create Cluster (ื™ืฆื™ืจืช ืืฉื›ื•ืœ). ืžื–ื™ื ื™ื ืขืจื›ื™ื ื‘ืฉื“ื•ืช ื‘ืจื™ืจืช ื”ืžื—ื“ืœ ื›ืžื• ืฉืžืชื•ืืจ ื‘ืžืืžืจ ื‘ื ื•ืฉื ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืื–ื•ืจื™.

  3. ื‘ื—ืœื•ื ื™ืช ื”ื ื™ื•ื•ื˜, ื‘ืงื˜ืข Cluster (ืืฉื›ื•ืœ), ืœื•ื—ืฆื™ื ืขืœ Advanced settings (ื”ื’ื“ืจื•ืช ืžืชืงื“ืžื•ืช).

  4. ื‘ืฉื•ืจื” Binary authorization ืœื•ื—ืฆื™ื ืขืœ Edit configuration.

  5. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Binary Authorization.

  6. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Audit-only, ืžื’ื“ื™ืจื™ื ืืช ืžื“ื™ื ื™ื•ืช ื”ืคืœื˜ืคื•ืจืžื” ืฉืžื‘ื•ืกืกืช ืขืœ ื‘ื“ื™ืงืช CV ืฉืจื•ืฆื™ื ืฉ-Binary Authorization ื™ื‘ื“ื•ืง ืืช ื”ืชืื™ืžื•ืช ืฉืœ ื”ืชืžื•ื ื•ืช ื‘ืืฉื›ื•ืœ, ื•ืื– ืœื•ื—ืฆื™ื ืขืœ Save.

  7. ืœื•ื—ืฆื™ื ืขืœ ื™ืฆื™ืจื”.

gcloud

  1. ืžื’ื“ื™ืจื™ื ืืช Google Cloud ืคืจื•ื™ืงื˜ ื‘ืจื™ืจืช ื”ืžื—ื“ืœ:

    gcloud config set project PROJECT_ID
    

    ืžื—ืœื™ืคื™ื ืืช PROJECT_ID ื‘ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืจื•ืฆื™ื ืœื™ืฆื•ืจ ืืช ื”ืืฉื›ื•ืœ.

  2. ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืฉืžืฉืชืžืฉ ืจืง ื‘ืžืขืงื‘ ืžื‘ื•ืกืก-ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืœื˜ืคื•ืจืžืช CV:

    ืœืคื ื™ ื”ืฉื™ืžื•ืฉ ื‘ื ืชื•ื ื™ ื”ืคืงื•ื“ื” ื”ื‘ืื™ื, ืฆืจื™ืš ืœื”ื—ืœื™ืฃ ืืช ื”ื ืชื•ื ื™ื ื”ื‘ืื™ื:

    • โ€ซCLUSTER_NAME: ืฉื ื”ืืฉื›ื•ืœ.
    • โ€ซLOCATION: ื”ืžื™ืงื•ื โ€“ ืœื“ื•ื’ืžื”, us-central1 ืื• asia-south1.
    • โ€ซPOLICY_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ื”ืžื“ื™ื ื™ื•ืช.
    • POLICY_ID: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช.
    • โ€ซCLUSTER_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉืœ ื”ืืฉื›ื•ืœ.

    ืžืจื™ืฆื™ื ืืช ื”ืคืงื•ื“ื” ื”ื‘ืื”:

    โ€ซLinux,โ€ macOS ืื• Cloud Shell

    gcloud beta container clusters create CLUSTER_NAME \
        --location=LOCATION \
        --binauthz-evaluation-mode=POLICY_BINDINGS \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID \
        --project=CLUSTER_PROJECT_ID

    โ€Windows (PowerShell)

    gcloud beta container clusters create CLUSTER_NAME `
        --location=LOCATION `
        --binauthz-evaluation-mode=POLICY_BINDINGS `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID `
        --project=CLUSTER_PROJECT_ID

    Windowsโ€ (cmd.exe)

    gcloud beta container clusters create CLUSTER_NAME ^
        --location=LOCATION ^
        --binauthz-evaluation-mode=POLICY_BINDINGS ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID ^
        --project=CLUSTER_PROJECT_ID

ื™ืฆื™ืจืช ื”ืืฉื›ื•ืœ ื™ื›ื•ืœื” ืœื”ื™ืžืฉืš ื›ืžื” ื“ืงื•ืช.

ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืขื Binary Authorization ืžื•ืคืขืœ (ืื›ื™ืคื” ื‘ืœื‘ื“)

ื”ืชื›ื•ื ื” Binary Authorization ืคื•ืขืœืช ืขื ืืฉื›ื•ืœื•ืช ื‘ืžืฆื‘ Autopilot ืื• ื‘ืžืฆื‘ Standard. ืžื“ื™ื ื™ื•ืช ื”ืื›ื™ืคื” ืžื•ื’ื“ืจืช ืœืžื“ื™ื ื™ื•ืช ื”ืคืจื•ื™ืงื˜, ืฉืžืืคืฉืจืช ื›ื‘ืจื™ืจืช ืžื—ื“ืœ ืืช ื›ืœ ื”ืชืžื•ื ื•ืช. ื›ื“ื™ ืœืฉื ื•ืช ืืช ืžื“ื™ื ื™ื•ืช ื”ืคืจื•ื™ืงื˜, ืคื•ืขืœื™ื ืœืคื™ ื”ื”ื•ืจืื•ืช ื”ืืœื”.

ื›ื“ื™ ืœื™ืฆื•ืจ ืืฉื›ื•ืœ ืขื Binary Authorization ืžื•ืคืขืœ, ืฉืžื•ืคืขืœ ื‘ื• ืจืง ืื›ื™ืคื”:

ื”ืžืกื•ืฃ

ื‘ืฉืœื‘ื™ื ื”ื‘ืื™ื ืžื•ืกื‘ืจ ืื™ืš ืœื”ื’ื“ื™ืจ ืืฉื›ื•ืœ ืจื’ื™ืœ.

  1. ื ื›ื ืกื™ื ืœื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ืœื•ื—ืฆื™ื ืขืœ Create Cluster (ื™ืฆื™ืจืช ืืฉื›ื•ืœ). ืžื–ื™ื ื™ื ืขืจื›ื™ื ื‘ืฉื“ื•ืช ื‘ืจื™ืจืช ื”ืžื—ื“ืœ ื›ืžื• ืฉืžืชื•ืืจ ื‘ืžืืžืจ ื‘ื ื•ืฉื ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืื–ื•ืจื™.

  3. ื‘ื—ืœื•ื ื™ืช ื”ื ื™ื•ื•ื˜, ื‘ืงื˜ืข Cluster (ืืฉื›ื•ืœ), ืœื•ื—ืฆื™ื ืขืœ Advanced settings (ื”ื’ื“ืจื•ืช ืžืชืงื“ืžื•ืช).

  4. ื‘ืฉื•ืจื” Binary authorization ืœื•ื—ืฆื™ื ืขืœ Edit configuration.

  5. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Binary Authorization.

  6. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช ืื›ื™ืคื” ื‘ืœื‘ื“ ื•ืื– ืœื•ื—ืฆื™ื ืขืœ ืฉืžื™ืจื”.

  7. ืœื•ื—ืฆื™ื ืขืœ ื™ืฆื™ืจื”.

gcloud

  1. ืžื’ื“ื™ืจื™ื ืืช Google Cloud ืคืจื•ื™ืงื˜ ื‘ืจื™ืจืช ื”ืžื—ื“ืœ:

    gcloud config set project PROJECT_ID
    

    ืžื—ืœื™ืคื™ื ืืช PROJECT_ID ื‘ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืจื•ืฆื™ื ืœื™ืฆื•ืจ ืืช ื”ืืฉื›ื•ืœ.

  2. ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืฉืžืฉืชืžืฉ ื‘ืื›ื™ืคืช ืžื“ื™ื ื™ื•ืช ื‘ืœื‘ื“:

    ืœืคื ื™ ื”ืฉื™ืžื•ืฉ ื‘ื ืชื•ื ื™ ื”ืคืงื•ื“ื” ื”ื‘ืื™ื, ืฆืจื™ืš ืœื”ื—ืœื™ืฃ ืืช ื”ื ืชื•ื ื™ื ื”ื‘ืื™ื:

    • โ€ซCLUSTER_NAME: ืฉื ื”ืืฉื›ื•ืœ.
    • โ€ซLOCATION: ื”ืžื™ืงื•ื โ€“ ืœื“ื•ื’ืžื”, us-central1 ืื• asia-south1.
    • โ€ซCLUSTER_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉืœ ื”ืืฉื›ื•ืœ.

    ืžืจื™ืฆื™ื ืืช ื”ืคืงื•ื“ื” ื”ื‘ืื”:

    โ€ซLinux,โ€ macOS ืื• Cloud Shell

    gcloud beta container clusters create CLUSTER_NAME \
        --location=LOCATION \
        --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE \
        --project=CLUSTER_PROJECT_ID

    โ€Windows (PowerShell)

    gcloud beta container clusters create CLUSTER_NAME `
        --location=LOCATION `
        --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE `
        --project=CLUSTER_PROJECT_ID

    Windowsโ€ (cmd.exe)

    gcloud beta container clusters create CLUSTER_NAME ^
        --location=LOCATION ^
        --binauthz-evaluation-mode=PROJECT_SINGLETON_POLICY_ENFORCE ^
        --project=CLUSTER_PROJECT_ID

Terraform

ื‘ื“ื•ื’ืžื” ื”ื‘ืื” ืฉืœ Terraform ื ื•ืฆืจ ื•ืžื•ื’ื“ืจ ืืฉื›ื•ืœ Standard:

resource "google_container_cluster" "default" {
  name               = "gke-standard-regional-binauthz-enforce"
  location           = "us-west1"
  initial_node_count = 1

  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }
}

ืžื™ื“ืข ื ื•ืกืฃ ืขืœ ืฉื™ืžื•ืฉ ื‘-Terraform ื–ืžื™ืŸ ื‘ืžืืžืจ ืชืžื™ื›ื” ื‘-Terraform ื‘-GKE.

ื™ืฆื™ืจืช ื”ืืฉื›ื•ืœ ื™ื›ื•ืœื” ืœื”ื™ืžืฉืš ื›ืžื” ื“ืงื•ืช.

ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืขื Binary Authorization ืžื•ืคืขืœ (ืžืขืงื‘ ื•ืื›ื™ืคื” ืฉืœ CV)

ื”ืชื›ื•ื ื” Binary Authorization ืคื•ืขืœืช ืขื ืืฉื›ื•ืœื•ืช ื‘ืžืฆื‘ Autopilot ืื• ื‘ืžืฆื‘ Standard.

ืœืฆื•ืจืš ืื›ื™ืคื”, ื”ืžื“ื™ื ื™ื•ืช ืžื•ื’ื“ืจืช ืœืžื“ื™ื ื™ื•ืช ื”ืคืจื•ื™ืงื˜, ืฉืžืืคืฉืจืช ื›ื‘ืจื™ืจืช ืžื—ื“ืœ ืืช ื›ืœ ื”ืชืžื•ื ื•ืช. ื›ื“ื™ ืœืฉื ื•ืช ืืช ืžื“ื™ื ื™ื•ืช ื”ืคืจื•ื™ืงื˜, ืคื•ืขืœื™ื ืœืคื™ ื”ื”ื•ืจืื•ืช ื”ืืœื”.

ื›ื“ื™ ืœื”ืฉืชืžืฉ ื‘ืžืขืงื‘ ืื—ืจ CV, ืฆืจื™ืš ืœืฆื™ื™ืŸ ืœืคื—ื•ืช ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืฉืžื‘ื•ืกืกืช ืขืœ ื‘ื“ื™ืงืช CV.

ื›ื“ื™ ืœื™ืฆื•ืจ ืืฉื›ื•ืœ ืขื Binary Authorization ืฉืžื•ืคืขืœ ืขื ืžืขืงื‘ ื•ืื›ื™ืคื” ืฉืœ CV:

ื”ืžืกื•ืฃ

ื‘ืฉืœื‘ื™ื ื”ื‘ืื™ื ืžื•ืกื‘ืจ ืื™ืš ืœื”ื’ื“ื™ืจ ืืฉื›ื•ืœ ืจื’ื™ืœ.

  1. ื ื›ื ืกื™ื ืœื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ืœื•ื—ืฆื™ื ืขืœ Create Cluster (ื™ืฆื™ืจืช ืืฉื›ื•ืœ). ืžื–ื™ื ื™ื ืขืจื›ื™ื ื‘ืฉื“ื•ืช ื‘ืจื™ืจืช ื”ืžื—ื“ืœ ื›ืžื• ืฉืžืชื•ืืจ ื‘ืžืืžืจ ื‘ื ื•ืฉื ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืื–ื•ืจื™.

  3. ื‘ื—ืœื•ื ื™ืช ื”ื ื™ื•ื•ื˜, ื‘ืงื˜ืข Cluster (ืืฉื›ื•ืœ), ืœื•ื—ืฆื™ื ืขืœ Advanced settings (ื”ื’ื“ืจื•ืช ืžืชืงื“ืžื•ืช).

  4. ื‘ืฉื•ืจื” Binary authorization ืœื•ื—ืฆื™ื ืขืœ Edit configuration.

  5. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Binary Authorization.

  6. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช ื‘ื“ื™ืงื” ื•ืื›ื™ืคื”, ืžื’ื“ื™ืจื™ื ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืฉืžื‘ื•ืกืกืช ืขืœ ื‘ื“ื™ืงืช CV ื•ืื– ืœื•ื—ืฆื™ื ืขืœ ืฉืžื™ืจื”.

  7. ืœื•ื—ืฆื™ื ืขืœ ื™ืฆื™ืจื”.

gcloud

  1. ืžื’ื“ื™ืจื™ื ืืช Google Cloud ืคืจื•ื™ืงื˜ ื‘ืจื™ืจืช ื”ืžื—ื“ืœ:

    gcloud config set project PROJECT_ID
    

    ืžื—ืœื™ืคื™ื ืืช PROJECT_ID ื‘ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืจื•ืฆื™ื ืœื™ืฆื•ืจ ืืช ื”ืืฉื›ื•ืœ.

  2. ื™ื•ืฆืจื™ื ืืฉื›ื•ืœ ืฉืžืฉืชืžืฉ ื’ื ื‘ืื›ื™ืคืช ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืจื•ื™ืงื˜ ื™ื—ื™ื“ ื•ื’ื ื‘ืžืขืงื‘ ืžื‘ื•ืกืก-ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืœื˜ืคื•ืจืžืช CV:

    ืœืคื ื™ ื”ืฉื™ืžื•ืฉ ื‘ื ืชื•ื ื™ ื”ืคืงื•ื“ื” ื”ื‘ืื™ื, ืฆืจื™ืš ืœื”ื—ืœื™ืฃ ืืช ื”ื ืชื•ื ื™ื ื”ื‘ืื™ื:

    • โ€ซCLUSTER_NAME: ืฉื ื”ืืฉื›ื•ืœ.
    • โ€ซLOCATION: ื”ืžื™ืงื•ื โ€“ ืœื“ื•ื’ืžื”, us-central1 ืื• asia-south1.
    • โ€ซPOLICY_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ื”ืžื“ื™ื ื™ื•ืช.
    • POLICY_ID: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช.
    • โ€ซCLUSTER_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉืœ ื”ืืฉื›ื•ืœ.

    ืžืจื™ืฆื™ื ืืช ื”ืคืงื•ื“ื” ื”ื‘ืื”:

    โ€ซLinux,โ€ macOS ืื• Cloud Shell

    gcloud beta container clusters create CLUSTER_NAME \
        --location=LOCATION \
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID \
        --project=CLUSTER_PROJECT_ID

    โ€Windows (PowerShell)

    gcloud beta container clusters create CLUSTER_NAME `
        --location=LOCATION `
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID `
        --project=CLUSTER_PROJECT_ID

    Windowsโ€ (cmd.exe)

    gcloud beta container clusters create CLUSTER_NAME ^
        --location=LOCATION ^
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID/platforms/gke/policies/POLICY_ID ^
        --project=CLUSTER_PROJECT_ID

ื™ืฆื™ืจืช ื”ืืฉื›ื•ืœ ื™ื›ื•ืœื” ืœื”ื™ืžืฉืš ื›ืžื” ื“ืงื•ืช.

ื™ืฆื™ืจืช ืืฉื›ื•ืœ CV ืฉืžืฉืชืžืฉ ื‘ื›ืžื” ื›ืœืœื™ ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืœื˜ืคื•ืจืžื” (ืžืขืงื‘ ืื—ืจื™ CV ื‘ืœื‘ื“)

ื”ืชื›ื•ื ื” Binary Authorization ืคื•ืขืœืช ืขื ืืฉื›ื•ืœื•ืช ื‘ืžืฆื‘ Autopilot ืื• ื‘ืžืฆื‘ Standard.

ืืคืฉืจ ืœื™ืฆื•ืจ ืืฉื›ื•ืœื•ืช ืขื ื›ืžื” ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืฉืžืฉื•ื™ื›ืช ืืœื™ื”ื (ืžื™ื“ืข ื ื•ืกืฃ ื–ืžื™ืŸ ื‘ืžืืžืจื™ ื”ืขื–ืจื” ืฉืœ ื”-API ืฉืœ GKE).

ื”ืžืกื•ืฃ

ื‘ืฉืœื‘ื™ื ื”ื‘ืื™ื ืžื•ืกื‘ืจ ืื™ืš ืœื”ื’ื“ื™ืจ ืืฉื›ื•ืœ ืจื’ื™ืœ.

  1. ื ื›ื ืกื™ื ืœื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ืœื•ื—ืฆื™ื ืขืœ Create Cluster (ื™ืฆื™ืจืช ืืฉื›ื•ืœ). ืžื–ื™ื ื™ื ืขืจื›ื™ื ื‘ืฉื“ื•ืช ื‘ืจื™ืจืช ื”ืžื—ื“ืœ ื›ืžื• ืฉืžืชื•ืืจ ื‘ืžืืžืจ ื‘ื ื•ืฉื ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืื–ื•ืจื™.

  3. ื‘ื—ืœื•ื ื™ืช ื”ื ื™ื•ื•ื˜, ื‘ืงื˜ืข Cluster (ืืฉื›ื•ืœ), ืœื•ื—ืฆื™ื ืขืœ Advanced settings (ื”ื’ื“ืจื•ืช ืžืชืงื“ืžื•ืช).

  4. ื‘ืฉื•ืจื” Binary authorization ืœื•ื—ืฆื™ื ืขืœ Edit configuration.

  5. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Binary Authorization.

  6. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Audit-only (ื‘ื™ืงื•ืจืช ื‘ืœื‘ื“), ืžื’ื“ื™ืจื™ื ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืื—ืช ืื• ื™ื•ืชืจ ืฉืจื•ืฆื™ื ืฉ-Binary Authorization ืชื‘ื“ื•ืง ืืช ื”ืืฉื›ื•ืœ ืœืคื™ื”, ื•ืื– ืœื•ื—ืฆื™ื ืขืœ Save (ืฉืžื™ืจื”).

  7. ืœื•ื—ืฆื™ื ืขืœ ื™ืฆื™ืจื”.

gcloud

  1. ืžื’ื“ื™ืจื™ื ืืช Google Cloud ืคืจื•ื™ืงื˜ ื‘ืจื™ืจืช ื”ืžื—ื“ืœ:

    gcloud config set project PROJECT_ID
    
  2. ื™ื•ืฆืจื™ื ืืช ื”ืืฉื›ื•ืœ.

    ืœืคื ื™ ื”ืฉื™ืžื•ืฉ ื‘ื ืชื•ื ื™ ื”ืคืงื•ื“ื” ื”ื‘ืื™ื, ืฆืจื™ืš ืœื”ื—ืœื™ืฃ ืืช ื”ื ืชื•ื ื™ื ื”ื‘ืื™ื:

    • โ€ซCLUSTER_NAME: ืฉื ื”ืืฉื›ื•ืœ.
    • โ€ซLOCATION: ื”ืžื™ืงื•ื โ€“ ืœื“ื•ื’ืžื”, us-central1 ืื• asia-south1.
    • โ€ซPOLICY_PROJECT_ID_1: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ืžื“ื™ื ื™ื•ืช ื”ืคืœื˜ืคื•ืจืžื” ื”ืจืืฉื•ื ื”.
    • โ€ซPOLICY_ID_1: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช ืฉืœ ื”ืžื“ื™ื ื™ื•ืช ื”ืจืืฉื•ื ื” ื‘ืคืœื˜ืคื•ืจืžื”.
    • โ€ซPOLICY_PROJECT_ID_2: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ืžื“ื™ื ื™ื•ืช ื”ืคืœื˜ืคื•ืจืžื” ื”ืฉื ื™ื™ื”. ืืคืฉืจ ืœืื—ืกืŸ ื›ืžื” ื›ืœืœื™ ืžื“ื™ื ื™ื•ืช ื‘ืื•ืชื• ืคืจื•ื™ืงื˜ ืื• ื‘ืคืจื•ื™ืงื˜ื™ื ืฉื•ื ื™ื.
    • โ€ซPOLICY_ID_2: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช ืฉืœ ื”ืžื“ื™ื ื™ื•ืช ื”ืฉื ื™ื™ื” ื‘ืคืœื˜ืคื•ืจืžื”.
    • โ€ซCLUSTER_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉืœ ื”ืืฉื›ื•ืœ.

    ืžืจื™ืฆื™ื ืืช ื”ืคืงื•ื“ื” ื”ื‘ืื”:

    โ€ซLinux,โ€ macOS ืื• Cloud Shell

    gcloud beta container clusters create CLUSTER_NAME \
        --location=LOCATION \
        --binauthz-evaluation-mode=POLICY_BINDINGS \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 \
        --project=CLUSTER_PROJECT_ID

    โ€Windows (PowerShell)

    gcloud beta container clusters create CLUSTER_NAME `
        --location=LOCATION `
        --binauthz-evaluation-mode=POLICY_BINDINGS `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 `
        --project=CLUSTER_PROJECT_ID

    Windowsโ€ (cmd.exe)

    gcloud beta container clusters create CLUSTER_NAME ^
        --location=LOCATION ^
        --binauthz-evaluation-mode=POLICY_BINDINGS ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 ^
        --project=CLUSTER_PROJECT_ID

ื™ืฆื™ืจืช ื”ืืฉื›ื•ืœ ื™ื›ื•ืœื” ืœื”ื™ืžืฉืš ื›ืžื” ื“ืงื•ืช.

ื™ืฆื™ืจืช ืืฉื›ื•ืœ CV ืฉืžืฉืชืžืฉ ื‘ื›ืžื” ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” (ืžืขืงื‘ ื•ืื›ื™ืคื” ืฉืœ CV)

ื”ืชื›ื•ื ื” Binary Authorization ืคื•ืขืœืช ืขื ืืฉื›ื•ืœื•ืช ื‘ืžืฆื‘ Autopilot ืื• ื‘ืžืฆื‘ Standard.

ืืคืฉืจ ืœื™ืฆื•ืจ ืืฉื›ื•ืœื•ืช ืขื ื›ืžื” ืžื“ื™ื ื™ื•ืช ืคืœื˜ืคื•ืจืžื” ืฉืžืฉื•ื™ื›ืช ืืœื™ื”ื (ืžื™ื“ืข ื ื•ืกืฃ ื–ืžื™ืŸ ื‘ืžืืžืจื™ ื”ืขื–ืจื” ืฉืœ ื”-API ืฉืœ GKE).

ื”ืžืกื•ืฃ

ื‘ืฉืœื‘ื™ื ื”ื‘ืื™ื ืžื•ืกื‘ืจ ืื™ืš ืœื”ื’ื“ื™ืจ ืืฉื›ื•ืœ ืจื’ื™ืœ.

  1. ื ื›ื ืกื™ื ืœื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ืœื•ื—ืฆื™ื ืขืœ Create Cluster (ื™ืฆื™ืจืช ืืฉื›ื•ืœ). ืžื–ื™ื ื™ื ืขืจื›ื™ื ื‘ืฉื“ื•ืช ื‘ืจื™ืจืช ื”ืžื—ื“ืœ ื›ืžื• ืฉืžืชื•ืืจ ื‘ืžืืžืจ ื™ืฆื™ืจืช ืืฉื›ื•ืœ ืื–ื•ืจื™.

  3. ื‘ื—ืœื•ื ื™ืช ื”ื ื™ื•ื•ื˜, ื‘ืงื˜ืข Cluster (ืืฉื›ื•ืœ), ืœื•ื—ืฆื™ื ืขืœ Advanced settings (ื”ื’ื“ืจื•ืช ืžืชืงื“ืžื•ืช).

  4. ื‘ืฉื•ืจื” Binary authorization ืœื•ื—ืฆื™ื ืขืœ Edit configuration.

  5. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช Binary Authorization.

  6. ื‘ื•ื—ืจื™ื ื‘ืืคืฉืจื•ืช ื‘ื“ื™ืงื” ื•ืื›ื™ืคื”, ืžื’ื“ื™ืจื™ื ืืช ืžื“ื™ื ื™ื•ืช ื”ืžืขืงื‘ ืื—ืจ CV ื•ืœื•ื—ืฆื™ื ืขืœ ืฉืžื™ืจื”.

  7. ืœื•ื—ืฆื™ื ืขืœ ื™ืฆื™ืจื”.

gcloud

  1. ืžื’ื“ื™ืจื™ื ืืช Google Cloud ืคืจื•ื™ืงื˜ ื‘ืจื™ืจืช ื”ืžื—ื“ืœ:

    gcloud config set project PROJECT_ID
    
  2. ื™ื•ืฆืจื™ื ืืฉื›ื•ืœ ืฉืžืฉืชืžืฉ ื’ื ื‘ืื›ื™ืคืช ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืจื•ื™ืงื˜ ื™ื—ื™ื“ ื•ื’ื ื‘ืžืขืงื‘ ืžื‘ื•ืกืก-ืžื“ื™ื ื™ื•ืช ืฉืœ ืคืœื˜ืคื•ืจืžืช CV:

    ืœืคื ื™ ื”ืฉื™ืžื•ืฉ ื‘ื ืชื•ื ื™ ื”ืคืงื•ื“ื” ื”ื‘ืื™ื, ืฆืจื™ืš ืœื”ื—ืœื™ืฃ ืืช ื”ื ืชื•ื ื™ื ื”ื‘ืื™ื:

    • โ€ซCLUSTER_NAME: ืฉื ื”ืืฉื›ื•ืœ.
    • โ€ซLOCATION: ื”ืžื™ืงื•ื โ€“ ืœื“ื•ื’ืžื”, us-central1 ืื• asia-south1.
    • โ€ซPOLICY_PROJECT_ID_1: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ืžื“ื™ื ื™ื•ืช ื”ืคืœื˜ืคื•ืจืžื” ื”ืจืืฉื•ื ื”.
    • โ€ซPOLICY_ID_1: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช ืฉืœ ื”ืžื“ื™ื ื™ื•ืช ื”ืจืืฉื•ื ื” ื‘ืคืœื˜ืคื•ืจืžื”.
    • โ€ซPOLICY_PROJECT_ID_2: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉื‘ื• ืžืื•ื—ืกื ืช ืžื“ื™ื ื™ื•ืช ื”ืคืœื˜ืคื•ืจืžื” ื”ืฉื ื™ื™ื”. ืืคืฉืจ ืœืื—ืกืŸ ื›ืžื” ื›ืœืœื™ ืžื“ื™ื ื™ื•ืช ื‘ืื•ืชื• ืคืจื•ื™ืงื˜ ืื• ื‘ืคืจื•ื™ืงื˜ื™ื ืฉื•ื ื™ื.
    • โ€ซPOLICY_ID_2: ืžื–ื”ื” ื”ืžื“ื™ื ื™ื•ืช ืฉืœ ื”ืžื“ื™ื ื™ื•ืช ื”ืฉื ื™ื™ื” ื‘ืคืœื˜ืคื•ืจืžื”.
    • โ€ซCLUSTER_PROJECT_ID: ืžื–ื”ื” ื”ืคืจื•ื™ืงื˜ ืฉืœ ื”ืืฉื›ื•ืœ.

    ืžืจื™ืฆื™ื ืืช ื”ืคืงื•ื“ื” ื”ื‘ืื”:

    โ€ซLinux,โ€ macOS ืื• Cloud Shell

    gcloud beta container clusters create CLUSTER_NAME \
        --location=LOCATION \
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 \
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 \
        --project=CLUSTER_PROJECT_ID

    โ€Windows (PowerShell)

    gcloud beta container clusters create CLUSTER_NAME `
        --location=LOCATION `
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 `
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 `
        --project=CLUSTER_PROJECT_ID

    Windowsโ€ (cmd.exe)

    gcloud beta container clusters create CLUSTER_NAME ^
        --location=LOCATION ^
        --binauthz-evaluation-mode=POLICY_BINDINGS_AND_PROJECT_SINGLETON_POLICY_ENFORCE ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_1/platforms/gke/policies/POLICY_ID_1 ^
        --binauthz-policy-bindings=name=projects/POLICY_PROJECT_ID_2/platforms/gke/policies/POLICY_ID_2 ^
        --project=CLUSTER_PROJECT_ID

ื™ืฆื™ืจืช ื”ืืฉื›ื•ืœ ื™ื›ื•ืœื” ืœื”ื™ืžืฉืš ื›ืžื” ื“ืงื•ืช.

ืื™ืžื•ืช ืฉื”ืชื›ื•ื ื” 'ื”ืจืฉืืช ืงื‘ืฆื™ื ื‘ื™ื ืืจื™ื™ื' ืžื•ืคืขืœืช

ื›ื“ื™ ืœื•ื•ื“ื ืฉื”ืชื›ื•ื ื” 'ืื™ืฉื•ืจ ื‘ื™ื ืืจื™' ืžื•ืคืขืœืช ื‘ืืฉื›ื•ืœ:

ื”ืžืกื•ืฃ

  1. ืคื•ืชื—ื™ื ืืช ื”ื“ืฃ GKE ื‘ืžืกื•ืฃ Google Cloud .

    ืžืขื‘ืจ ืืœ GKE

  2. ื‘ืงื˜ืข Kubernetes clusters, ืžื•ืฆืื™ื ืืช ื”ืืฉื›ื•ืœ.

  3. ื‘ืงื˜ืข ืื‘ื˜ื—ื”, ืžื•ื•ื“ืื™ื ืฉื”ืืคืฉืจื•ืช ืื™ืฉื•ืจ ื‘ื™ื ืืจื™ ืžื•ื’ื“ืจืช ืœืžื•ืคืขืœ.

gcloud

ื›ื“ื™ ืœื”ืฆื™ื’ ืืช ืงื™ืฉื•ืจื™ ื”ืžื“ื™ื ื™ื•ืช ืฉืœ ื”ืืฉื›ื•ืœ:

gcloud beta container clusters describe CLUSTER_NAME --location LOCATION --project CLUSTER_PROJECT_ID | grep -A 10 policyBindings:

ืฉื™ืžื• ืœื‘: ื™ื›ื•ืœ ืœื”ื™ื•ืช ืฉื™ื•ืคื™ืข ืžื™ื“ืข ื ื•ืกืฃ ืื—ืจื™ ืจืฉื™ืžืช ื”ืžื“ื™ื ื™ื•ืช ื”ืžื—ื™ื™ื‘ืช.

ื”ืžืืžืจื™ื ื”ื‘ืื™ื