2V0-71.23 Question 218
Select 2Your organization has deployed multiple Tanzu Kubernetes Clusters (TKCs) and wants to implement role-based access control (RBAC) for developers and administrators. The team also requires centralized authentication using the existing enterprise identity provider (IdP) integrated with OpenID Connect (OIDC). Which of the following methods should you configure to achieve authentication and authorization in the TKCs?
- A
Integrate the Tanzu Kubernetes Cluster with the enterprise IdP using the Pinniped supervisor.
- B
Create Kubernetes RoleBindings and ClusterRoleBindings to manage authorization for users.
- C
Configure kubeconfig files manually for each developer to provide cluster access credentials directly.
- D
Use Kubernetes Service Accounts as the primary method for developer authentication.
- E
Enable Dex as an authentication proxy for the enterprise IdP.
Show answer and explanation
Correct answers: A, B
Explanation
To implement authentication and authorization in Tanzu Kubernetes Clusters, you should integrate with an enterprise IdP using Pinniped for centralized authentication and use Kubernetes RBAC (RoleBindings and ClusterRoleBindings) to manage user and group permissions. This ensures secure and efficient access control for both developers and administrators, aligning with enterprise security policies.
- A. Correct.
Correct: The Pinniped supervisor is a key component in Tanzu for enabling OIDC-based authentication with an enterprise IdP. It allows for centralized authentication integration.
- B. Correct.
Correct: Kubernetes RoleBindings and ClusterRoleBindings are essential for implementing RBAC to control user and group permissions within the cluster.
- C. Incorrect.
Incorrect: Manually configuring kubeconfig files for each developer is insecure and inefficient, especially in an enterprise environment that already has centralized authentication.
- D. Incorrect.
Incorrect: Kubernetes Service Accounts are typically used for workloads, not for user authentication. They are not suitable for managing developer or administrator access.
- E. Incorrect.
Incorrect: While Dex is an authentication proxy for Kubernetes, Tanzu Kubernetes Clusters use Pinniped for integrating with enterprise IdPs, making Dex unnecessary in this context.