ASSOCIATE-CLOUD-ENGINEER · Question #122
You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary c
The correct answer is C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter. You can enable GKE Sandbox on your cluster to isolate untrusted workloads in sandboxes on the node. GKE Sandbox is built using gVisor, an open source project. https://cloud.google.com/kubernetes-engine/docs/concepts/security- overview?hl=en#protecting_nodes_from_untrusted_workloa
Question
Options
- AUse Binary Authorization and whitelist only the container images used by your customers' Pods.
- BUse the Container Analysis API to detect vulnerabilities in the containers used by your customers'
- CCreate a GKE node pool with a sandbox type configured to gvisor. Add the parameter
- DUse the cos_containerd image for your GKE nodes. Add a nodeSelector with the value
How the community answered
(38 responses)- A8% (3)
- B21% (8)
- C66% (25)
- D5% (2)
Explanation
You can enable GKE Sandbox on your cluster to isolate untrusted workloads in sandboxes on the node. GKE Sandbox is built using gVisor, an open source project. https://cloud.google.com/kubernetes-engine/docs/concepts/security- overview?hl=en#protecting_nodes_from_untrusted_workloads
Topics
Community Discussion
No community discussion yet for this question.