Linux_Foundation
CKS · Question #51
Context You must fully integrate a container image scanner into the kubeadm provisioned cluster. Task Given an incomplete configuration located at /etc/kubernetes/bouncer and a functional container im
Sign in or unlock CKS to reveal the answer and full explanation for question #51. The question stem and answer options stay visible for context.
Submitted by carter_n· May 4, 2026Supply Chain Security
Question
Context
You must fully integrate a container image scanner into the kubeadm provisioned cluster.
Task
Given an incomplete configuration located at /etc/kubernetes/bouncer and a functional container image scanner with an HTTPS endpoint at https://smooth-yak.local/review, perform the following tasks to implement a validating admission controller.
First, re-configure the API server to enable all admission plugin(s) to support the provided AdmissionConfiguration.
Next, re-configure the ImagePolicyWebhook configuration to deny images on backend failure.
Next, complete the backend configuration to point to the container image scanner's endpoint at https://smooth-yak.local/review.
Finally, to test the configuration, deploy the test resource defined in
/home/candidate/vulnerable.yaml which is using an image that should be denied.
You may delete and re-create the resource as often as needed.
The container image scanner's log file is located at /var/log/nginx/access_log.
Unlock CKS to see the answer
You've previewed enough free CKS questions. Unlock CKS for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Admission Controllers#Image Policy#kube-apiserver Configuration#Webhook Integration