nerdexam
Linux_Foundation

CKS · Question #52

Edit the ImagePolicyWebhook config. One of these is true on your cluster: Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file. Option 2: ImagePolicyWebhook config is

Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file Edit the file in /etc/kubernetes/bouncer that contains kind: ImagePolicyWebhookConfiguration: grep -R "kind: ImagePolicyWebhookConfiguration" -n /etc/kubernetes/bouncer vi /etc/kubernetes/bounce

Submitted by zhang_li· May 5, 2026Cluster Hardening

Question

Edit the ImagePolicyWebhook config. One of these is true on your cluster: Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file. Option 2: ImagePolicyWebhook config is embedded inside AdmissionConfiguration. Set (or ensure) defaultAllow: false.

Explanation

Option 1 (most common in these tasks): ImagePolicyWebhook config is a standalone file Edit the file in /etc/kubernetes/bouncer that contains kind: ImagePolicyWebhookConfiguration: grep -R "kind: ImagePolicyWebhookConfiguration" -n /etc/kubernetes/bouncer vi /etc/kubernetes/bouncer/<THE_FILE_YOU_FOUND>.yaml Set (or ensure) exactly: defaultAllow: false Option 2: ImagePolicyWebhook config is embedded inside AdmissionConfiguration Edit the AdmissionConfiguration file: vi /etc/kubernetes/bouncer/admission_configuration.yaml Find the plugin section for ImagePolicyWebhook and ensure the config includes: defaultAllow: false Save/exit: :wq

Topics

#ImagePolicyWebhook#Admission Controllers#Kubernetes Security#Default Deny

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CKS Practice