Your company is adopting a DevSecOps culture. The security team wants to ensure that only container images that have been built by the official CI/CD pipeline and scanned for vulnerabilities can be deployed to the production GKE cluster. How should you enforce this?

Write a Kubernetes Mutating Admission Webhook to check the image registry URL before allowing the pod to start.

Implement Binary Authorization on the GKE cluster and require attestations from Cloud Build and Container Analysis.

Use IAM to restrict access to the GKE cluster so only the Cloud Build service account can run 'kubectl apply'.

Enable Google Cloud Armor on the GKE ingress to block malicious traffic.