An enterprise using Kubernetes wants to enforce a security policy that ensures all deployed containers originate only from their private container registry (registry.example.com). What is the best…

Question

Options

• AUse a Kubernetes NetworkPolicy to restrict egress traffic to public container registries
• BUse a PodSecurityPolicy (PSP) to define allowed image sources
• CUse RBAC to restrict users from pulling images from unauthorized registries
• DUse a ValidatingWebhookConfiguration to reject pods that use images from untrusted registries

• A
  14% (7)
• B
  6% (3)
• C
  24% (12)
• D
  57% (29)

Explanation

Option A: NetworkPolicies do not control which images can be pulled, only how network traffic flows between pods. Attackers could still use unauthorized images that were already pulled and Option B: PodSecurityPolicies (PSPs) are deprecated and cannot enforce image sources. Even when PSPs were in use, they did not provide controls for restricting container images based on Option C: RBAC rules control permissions related to Kubernetes objects but do not directly prevent the use of unauthorized container images. Option D: A ValidatingWebhookConfiguration can be set up to inspect pod specifications and deny any that use images not sourced from registry.example.com. This provides a centralized and enforceable policy.

No community discussion yet for this question.