A VMware Cloud Foundation design is focused on IaaS control plane security, where the following requirements are present: - Support for Kubernetes Network Policies. - Cluster-wide network policy…

Question

Options

• ANSX VPCs
• BAntrea
• CHarbor
• DVelero Operators

• A
  16% (9)
• B
  74% (43)
• C
  3% (2)
• D
  7% (4)

Explanation

The design focuses on IaaS control plane security for Kubernetes within VCF 5.2, requiring Kubernetes Network Policies, cluster-wide policies, and support for multiple Kubernetes distributions. VMware Container Networking integrates with vSphere with Tanzu (part of VCF's IaaS control plane). Let's evaluate: Option A: NSX VPCs NSX VPCs (Virtual Private Clouds) provide isolated network domains in NSX-T, enhancing tenant segmentation. While NSX underpins vSphere with Tanzu networking, NSX VPCs are an advanced feature for workload isolation, not a direct implementation of Kubernetes Network Policies or cluster-wide policies. The VCF 5.2 Networking Guide positions NSX VPCs as optional, not required for core Kubernetes networking. Option B: Antrea Antrea is an open-source container network interface (CNI) plugin integrated with vSphere with Tanzu in VCF 5.2. It supports Kubernetes Network Policies (e.g., pod-to-pod rules), cluster-wide policies via Antrea-specific CRDs (Custom Resource Definitions), and multiple Kubernetes distributions (e.g., TKG clusters). The VMware Cloud Foundation 5.2 Architectural Guide notes Antrea as an alternative CNI to NSX, enabled when NSX isn't used for Kubernetes networking, meeting all requirements with native Kubernetes compatibility and security features. Option C: Harbor Harbor is a container registry for storing and securing images, not a networking solution. The VCF 5.2 Administration Guide confirms Harbor's role in image management, not network policy enforcement, making it irrelevant here. Option D: Velero Operators Velero is a backup and recovery tool for Kubernetes clusters, not a networking component. The VCF 5.2 Architectural Guide lists Velero for disaster recovery, not security or network policies,

No community discussion yet for this question.