2V0-71.23 Question 174
Select 4You are tasked with configuring image registry policies in a VMware Tanzu Kubernetes cluster to ensure security and compliance. The organization mandates that images can only be pulled from a trusted private registry and that no unauthenticated access to the registry is allowed. Which of the following configurations would satisfy these requirements?
- A
Configure Kubernetes to only allow image pulls from the organization’s private registry using a whitelist.
- B
Disable anonymous access to the private registry and enforce authentication for all image pulls.
- C
Allow image pulls from any public registry for flexibility in development workflows.
- D
Implement an ImagePolicyWebhook to validate images against the trusted private registry.
- E
Configure a network policy in the cluster to block access to any registry other than the trusted private one.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To comply with the organization's requirements, the configuration must enforce the use of a trusted private registry, disable unauthenticated access, and validate that images come from the allowed registry. Options 1, 2, 4, and 5 together ensure compliance with these requirements by restricting access to only the trusted registry, enforcing authentication, validating images, and preventing traffic to untrusted registries.
- A. Correct.
Correct: Whitelisting ensures that only trusted registries are used for pulling images, which aligns with the security and compliance mandate.
- B. Correct.
Correct: Disabling anonymous access ensures that only authenticated users can pull images, improving security.
- C. Incorrect.
Incorrect: Allowing image pulls from any public registry violates the organization's requirement to restrict access to a trusted private registry.
- D. Correct.
Correct: An ImagePolicyWebhook can enforce validation of images to ensure they originate from the trusted private registry.
- E. Correct.
Correct: A network policy restricting access to untrusted registries provides an additional layer of security, ensuring that traffic is only allowed to the trusted registry.