Runbook — Binary Authorization breakglass

Scope: emergency deploy bypass of the REQUIRE_ATTESTATION Binary Authorization policy on a upsquad-beta / upsquad-prod env project. ADR: ADR-0018 §2.4/§2.6 · Issue: #1281

When to use

Binary Authorization on each env project requires every non-exempt image to carry a valid attestation from that env's attestor (attestor-beta / attestor-prod), default-admission DENY. Use breakglass ONLY when:

• a verified-good image must be deployed but the attestation path is broken (KMS outage, attestor misconfig, Container Analysis unavailable), AND
• the delay would cause or prolong a Sev-1/Sev-2 incident.

Breakglass is a deliberate, audited, per-deploy human action. The policy default rule is never weakened to provide a standing escape hatch — that would defeat the anti-contamination control (tenet 1: "prod runs only prod-built, attested images").

How (Cloud Run — today's compute plane)

Deploy the revision with the breakglass annotation. The deploy is admitted without attestation and a binaryauthorization.googleapis.com audit-log entry is emitted recording the bypass.

gcloud run deploy <service> \
  --project=<upsquad-beta|upsquad-prod> \
  --region=asia-south1 \
  --image=<asia-south1-docker.pkg.dev/<env-project>/upsquad/<image>@sha256:...> \
  --binary-authorization=breakglass
# (equivalently: annotation run.googleapis.com/binary-authorization-breakglass="true")

How (GKE — once GKE activates per ADR-0017 triggers)

Annotate the Pod (the same project policy is inherited by GKE admission):

metadata:
  annotations:
    alpha.image-policy.k8s.io/break-glass: "true"

After breakglass

1. File / link the incident.
2. Confirm the audit-log entry exists:

   gcloud logging read \
     'protoPayload.serviceName="binaryauthorization.googleapis.com" AND protoPayload.metadata.breakglass=true' \
     --project=<env-project> --freshness=1d --limit=20

3. Restore the normal attested path ASAP, re-deploy the same digest with a valid attestation, and remove the breakglass revision/annotation.
4. Record the bypass in the incident write-up.

Who can do this

The same identity authorized to deploy the env's compute (the env deploy SA via the gated CI/promotion path). Breakglass does not require any extra IAM — it is a deploy-time flag — so its only control is this runbook + the audit trail. Do not grant breakglass standing approval.