2V0-71.23 Question 23
Select 3You are managing a Kubernetes cluster using VMware Tanzu Kubernetes Grid (TKG). To secure the cluster and its applications, you are tasked with implementing measures to ensure that unauthorized containers cannot run in the environment. Which of the following actions should you take?
- A
Enable Pod Security Admission (PSA) to enforce pod-level security policies.
- B
Implement Role-Based Access Control (RBAC) to restrict access to specific Kubernetes resources.
- C
Disable container image scanning to improve cluster performance.
- D
Use Network Policies to restrict communication between pods and external systems.
- E
Configure image pull policies to allow only signed and trusted container images.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure a Kubernetes cluster and prevent unauthorized containers from running, it is vital to enforce Pod Security Admission (PSA) policies, implement RBAC to control access to resources, and configure image pull policies to use only trusted images. These measures ensure compliance with security best practices and reduce the attack surface of the cluster. Network Policies and container image scanning, while important, address different aspects of cluster security.
- A. Correct.
Enabling Pod Security Admission (PSA) allows cluster administrators to enforce security policies at the pod level, such as disallowing privileged containers or restricting host network access. This is crucial for ensuring only authorized workloads run in the cluster.
- B. Correct.
RBAC is essential to secure cluster resources by assigning specific permissions to users, groups, and service accounts. It minimizes the risk of unauthorized access to the cluster.
- C. Incorrect.
Disabling container image scanning reduces security by allowing potentially vulnerable or malicious images to be deployed in the cluster. This is not a recommended practice.
- D. Incorrect.
While Network Policies improve pod-to-pod and external communication security, they do not directly prevent unauthorized containers from running in the cluster.
- E. Correct.
Configuring image pull policies to ensure only signed and trusted images are used is critical to prevent unauthorized or tampered containers from being deployed.