Ensure Only Trusted Container Images Are Used

#!/usr/bin/env bash
#
# Report Binary Authorization status for all GKE clusters in a project.
# Requirements:
#   - gcloud, jq
#   - Authenticated with privileges to list and describe clusters & binauthz policy
#
# Usage:
#   ./report-binauthz.sh <PROJECT_ID>
#

set -euo pipefail

PROJECT_ID="${1:-}"

if [[ -z "$PROJECT_ID" ]]; then
  echo "Usage: $0 <PROJECT_ID>" >&2
  exit 1
fi

echo "Project: $PROJECT_ID"
echo "Timestamp: $(date -Iseconds)"
echo "========================================"

# List all regions/zones that have clusters
LOCATIONS=$(gcloud container clusters list \
  --project "${PROJECT_ID}" \
  --format='value(location)' | sort -u)

if [[ -z "$LOCATIONS" ]]; then
  echo "No clusters found in project ${PROJECT_ID}"
  exit 0
fi

# Try to fetch the Binary Authorization policy once (may not exist)
echo
echo "=== Project-level Binary Authorization Policy ==="
if gcloud container binauthz policy export --project "${PROJECT_ID}" >/tmp/binauthz-policy.yaml 2>/dev/null; then
  echo "Binary Authorization policy FOUND for project ${PROJECT_ID}"
  echo "Policy summary:"
  # Show only high-level fields; detailed review is manual
  grep -E '^(defaultAdmissionRule|clusterAdmissionRules:|globalPolicyEvaluationMode:)' -n \
    /tmp/binauthz-policy.yaml || true
else
  echo "No Binary Authorization policy configured for project ${PROJECT_ID}"
fi
echo "========================================"
echo

# For each cluster, show Binary Authorization configuration
for LOCATION in ${LOCATIONS}; do
  echo "=== LOCATION: ${LOCATION} ==="
  CLUSTERS=$(gcloud container clusters list \
    --project "${PROJECT_ID}" \
    --location "${LOCATION}" \
    --format='value(name)')

  if [[ -z "$CLUSTERS" ]]; then
    echo "  No clusters in ${LOCATION}"
    continue
  fi

  for CLUSTER in ${CLUSTERS}; do
    echo
    echo "Cluster: ${CLUSTER}"

    # Describe the cluster's Binary Authorization block
    DESC_JSON=$(gcloud container clusters describe "${CLUSTER}" \
      --project "${PROJECT_ID}" \
      --location "${LOCATION}" \
      --format=json)

    echo "${DESC_JSON}" | jq '.binaryAuthorization // {}'

    # Simple classification to highlight potential issues
    EVAL_MODE=$(echo "${DESC_JSON}" | jq -r '.binaryAuthorization.evaluationMode // "NOT_SET"')

    case "${EVAL_MODE}" in
      ENABLED|PROJECT_SINGLETON_POLICY_ENFORCE)
        STATUS="ENFORCED"
        ;;
      DISABLED)
        STATUS="DISABLED"
        ;;
      *)
        STATUS="UNKNOWN_OR_NOT_SET"
        ;;
    esac

    echo "  Evaluation mode: ${EVAL_MODE}  => Status: ${STATUS}"

    # Flag clusters without enforcement
    if [[ "${STATUS}" != "ENFORCED" ]]; then
      echo "  WARNING: Binary Authorization is NOT enforced on this cluster."
    fi
  done

  echo
done

echo "========================================"
echo "Review guidance:"
echo " - For each cluster, .binaryAuthorization.evaluationMode should indicate enforcement (e.g. ENABLED or PROJECT_SINGLETON_POLICY_ENFORCE)."
echo " - A problem is indicated when:"
echo "     * .binaryAuthorization is null or empty, OR"
echo "     * evaluationMode is DISABLED or NOT_SET, OR"
echo "     * No project-level Binary Authorization policy exists."
echo " - Policy contents (attestors, rules, exceptions) must be reviewed manually against your trust requirements."