2V0-71.23 Question 171
Select 3Your organization is using VMware Tanzu Kubernetes Grid (TKG) and wants to enforce policies for image registries to ensure security and compliance. Which of the following are valid considerations or configurations when defining image registry policies in TKG?
- A
Restricting workloads to pull images only from approved registries
- B
Enabling anonymous access to public registries for faster deployment
- C
Using signed images to verify authenticity before deployment
- D
Implementing network restrictions to block access to unapproved registries
- E
Configuring TKG clusters to allow images from any registry by default
Show answer and explanation
Correct answers: A, C, D
Explanation
Enforcing image registry policies in VMware Tanzu Kubernetes Grid (TKG) is critical for maintaining security, compliance, and operational stability. Best practices include restricting access to approved registries, verifying image authenticity using signed images, and implementing network restrictions to prevent access to unapproved registries. These measures help ensure that only trusted and verified images are used in your Kubernetes clusters.
- A. Correct.
Restricting workloads to pull images only from approved registries is a common best practice to ensure that images come from trusted sources, reducing the risk of using malicious or unverified images.
- B. Incorrect.
Enabling anonymous access to public registries is not a recommended practice as it can lead to security vulnerabilities and unauthorized access to potentially harmful images.
- C. Correct.
Using signed images ensures that the images are authentic and have not been tampered with, which is critical for maintaining security and compliance.
- D. Correct.
Implementing network restrictions to block access to unapproved registries is an effective way to enforce security policies and prevent workloads from pulling images from untrusted sources.
- E. Incorrect.
Allowing images from any registry by default weakens security and goes against best practices, as it increases the risk of deploying harmful or unverified images.