2V0-71.23 Question 22
Select 3You are responsible for securing a Kubernetes cluster deployed using Tanzu Kubernetes Grid (TKG). The cluster hosts critical applications that process sensitive customer data. To enhance security, you must implement measures to restrict unauthorized access to pods, ensure sensitive data is securely managed, and prevent privilege escalation attacks. Which actions should you take to address these requirements?
- A
Enable Role-Based Access Control (RBAC) to define granular access permissions for users and service accounts.
- B
Use Kubernetes Secrets to store sensitive information like database credentials and ensure they are encrypted at rest.
- C
Allow containers to run as root to simplify application deployment and avoid permission issues.
- D
Enable Pod Security Policies (PSPs) or use Open Policy Agent (OPA)-based policies to prevent privilege escalation.
- E
Expose the Kubernetes API server to the public internet to allow easier management of the cluster.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure a Kubernetes cluster and its applications, it is important to follow best practices such as enabling RBAC for access control, securing sensitive data with Kubernetes Secrets, and using Pod Security Policies or OPA to enforce security constraints. These measures collectively help prevent unauthorized access, data breaches, and privilege escalation attacks. Avoid practices like running containers as root or exposing the API server publicly, as they compromise the cluster's security posture.
- A. Correct.
Enabling RBAC is essential for defining granular permissions and restricting unauthorized access to the cluster's resources. This is a critical security best practice.
- B. Correct.
Using Kubernetes Secrets ensures that sensitive information is securely stored and encrypted. This protects data such as API keys and passwords from being exposed in plain text.
- C. Incorrect.
Allowing containers to run as root is a significant security risk and violates best practices. It increases the attack surface and can lead to privilege escalation vulnerabilities.
- D. Correct.
Pod Security Policies or OPA-based policies are effective in enforcing security constraints on pods, such as disallowing privilege escalation. This is crucial for preventing unauthorized access or exploitation.
- E. Incorrect.
Exposing the Kubernetes API server to the public internet is highly insecure as it increases the risk of unauthorized access and attacks on the cluster.