2V0-71.23 Question 16
Select 3A platform administrator is tasked with configuring a Kubernetes cluster to ensure secure access control for workloads and services. Which of the following actions align with Kubernetes platform and service administration best practices?
- A
Use Kubernetes Role-Based Access Control (RBAC) to define permissions for users and service accounts.
- B
Grant cluster-admin privileges to all users to simplify access management.
- C
Configure Network Policies to restrict pod-to-pod communication within the cluster.
- D
Disable Kubernetes audit logs to reduce resource overhead.
- E
Implement namespaces to isolate workloads and manage resources more effectively.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely and effectively manage a Kubernetes platform, administrators should follow best practices such as utilizing RBAC for access control, configuring Network Policies to restrict unauthorized pod communication, and using namespaces to isolate workloads and manage resources. Granting excessive privileges or disabling key features like audit logs undermines security and operational efficiency.
- A. Correct.
RBAC is a critical security feature in Kubernetes for managing user and service account permissions. It ensures that users and applications have the least privilege required for their tasks.
- B. Incorrect.
Granting cluster-admin privileges to all users is a poor practice as it violates the principle of least privilege and significantly increases security risks.
- C. Correct.
Network Policies are essential for controlling traffic between pods, ensuring only authorized communication occurs within the cluster.
- D. Incorrect.
Disabling Kubernetes audit logs is a bad practice as it removes visibility into cluster activity, making it harder to monitor and troubleshoot security or operational issues.
- E. Correct.
Namespaces are a Kubernetes feature used to isolate workloads, manage resources, and enforce boundaries between applications or teams, aligning with best practices for platform and service administration.