For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in-scope" Nodes only. These Nodes can only contain the "in-scope" Pods. How should the…

Question

Options

• AAdd a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
• BCreate a node pool with the label inscope: true and a Pod Security Policy that only allows the
• CPlace a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to
• DRun all in-scope Pods in the namespace "in-scope-pci".

• A
  73% (36)
• B
  6% (3)
• C
  16% (8)
• D
  4% (2)

Explanation

A nodeSelector field in the Pod specification instructs the Kubernetes scheduler to place the Pod only on Nodes that carry the matching label (e.g., inscope: true). This satisfies the first requirement - in-scope Pods land only on designated in-scope Nodes. In the context of this question, the answer assumes that in-scope Nodes are isolated and dedicated, so no other workloads are co-scheduled there. Option C (taints and tolerations) is actually a more complete solution in practice because taints with NoSchedule also prevent non-in-scope Pods from landing on the in-scope Nodes, but the given answer is A. Option B references PodSecurityPolicy which is deprecated. Option D (namespace isolation) does not provide Node-level scheduling control.

No community discussion yet for this question.