<p>I was trying to showcase binary authorization to my client as POC. During the deployment, it is failing with the following error message:</p>

<blockquote>
  <p>pods "hello-app-6589454ddd-wlkbg" is forbidden: image policy webhook backend denied one or more images: Denied by cluster admission rule for us-central1.staging-cluster. Denied by Attestor. Image gcr.io//hello-app:e1479a4 denied by projects//attestors/vulnz-attestor: Attestor cannot attest to an image deployed by tag</p>
</blockquote>

<p>I have adhered all steps mentioned in the site.</p>

<p>I have verified the image repeatedly for few occurances, for example using below command to force fully make the attestation:</p>

<pre><code>gcloud alpha container binauthz attestations sign-and-create   --project "projectxyz"  --artifact-url "gcr.io/projectxyz/hello-app@sha256:82f1887cf5e1ff80ee67f4a820703130b7d533f43fe4b7a2b6b32ec430ddd699"   --attestor "vulnz-attestor"   --attestor-project "projectxyz"   --keyversion "1"   --keyversion-key "vulnz-signer"   --keyversion-location "us-central1"   --keyversion-keyring "binauthz"   --keyversion-project "projectxyz"
</code></pre>

<p>It throws error as:</p>

<blockquote>
  <p>ERROR: (gcloud.alpha.container.binauthz.attestations.sign-and-create) Resource in project [project xyz] is the subject of a conflict: occurrence ID "c5f03cc3-3829-44cc-ae38-2b2b3967ba61" already exists in project "projectxyz"</p>
</blockquote>

<p>So when I verify, I found the attestion present:</p>

<pre><code>gcloud beta container binauthz attestations list       --artifact-url "gcr.io/projectxyz/hello-app@sha256:82f1887cf5e1ff80ee67f4a820703130b7d533f43fe4b7a2b6b32ec430ddd699"       --attestor "vulnz-attestor"       --attestor-project "projectxyz"       --format json  | jq '.[0].kind' \
&gt;       | grep 'ATTESTATION'
"ATTESTATION"
</code></pre>

<p>Here are the screen shots:</p>

<p><img src="https://user-images.githubusercontent.com/27581174/67691987-c3b44b80-f99f-11e9-92c0-384dc41a120d.PNG" alt="deployment error"></p>

<p><img src="https://user-images.githubusercontent.com/27581174/67691988-c3b44b80-f99f-11e9-80c9-0a3fce511500.PNG" alt="container"></p>

<p><img src="https://user-images.githubusercontent.com/27581174/67691989-c44ce200-f99f-11e9-9917-880d665cbe83.PNG" alt="cloud build"></p>

<p>Any feedback please?</p>

<p>Thanks in advance.</p>

ARINDAM BANERJEE
<p>Thank you for trying Binary Authorization. I just updated the <a href="https://cloud.google.com/solutions/binary-auth-with-cloud-build-and-gke" rel="nofollow noreferrer">Binary Authorization Solution</a>, which you might find helpful.</p>

<p>A few things I noticed along the way:</p>

<blockquote>
  <p>... denied by projects//attestors/vulnz-attestor:</p>
</blockquote>

<p>There should be a project ID in between <code>projects</code> and <code>attestors</code>, like:</p>

<pre><code>projects/my-project/attestors/vulnz-attestor
</code></pre>

<p>Similarly, your gcr.io links should include that same project ID, for example:</p>

<blockquote>
  <p>gcr.io//hello-app:e1479a4</p>
</blockquote>

<p>should be</p>

<pre><code>gcr.io/my-project/hello-app:e1479a4
</code></pre>

<p>If you followed a tutorial, it likely asked you to set a variable like <code>$PROJECT_ID</code>, but you may have accidentally unset it or ran the command in a different terminal session.</p>
