2V0-71.23 Question 170
Select 3A Tanzu Kubernetes Grid administrator is tasked with configuring image registry policies to ensure that developers can only pull images from a trusted private registry and block any access to unapproved public registries. The team also wants to enforce image scanning before deployments to enhance security. Which configuration steps should the administrator implement?
- A
Configure a whitelist of trusted registry endpoints in the Kubernetes cluster policy.
- B
Enable admission controllers such as OPA/Gatekeeper to validate image sources.
- C
Allow unrestricted access to all public registries for flexibility in workflows.
- D
Implement image scanning policies as part of the CI/CD pipeline.
- E
Use Kubernetes NodePort services to restrict registry access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure image registry policies, it is essential to restrict access to trusted registries, validate image sources using admission controllers, and enforce security measures like image scanning in the CI/CD pipeline. These steps collectively help prevent unauthorized or insecure images from being deployed in the Kubernetes cluster.
- A. Correct.
Whitelisting trusted registries ensures that only approved registries can be used for pulling container images, which is a critical part of securing the Kubernetes environment.
- B. Correct.
Admission controllers like OPA/Gatekeeper can enforce policies to validate image sources and reject deployments from unauthorized registries.
- C. Incorrect.
Allowing unrestricted access to all public registries contradicts the security requirements and introduces risks of pulling unverified or malicious images.
- D. Correct.
Implementing image scanning policies as part of the CI/CD pipeline ensures that only secure and vulnerability-free images are deployed.
- E. Incorrect.
Kubernetes NodePort services are used for exposing services externally, not for restricting or managing image registry access.