2V0-71.23 Question 25
Single answerYou are tasked with implementing security best practices for a Kubernetes cluster deployed on VMware Tanzu. One of the requirements is to ensure that application pods are restricted from running as the root user. What is the most appropriate method to achieve this?
- A
Enable PodSecurityPolicy (PSP) and configure it to disallow root user privileges for pods.
- B
Use Kubernetes Network Policies to restrict pods from running as root.
- C
Add a securityContext to pod specifications with
runAsNonRoot: true. - D
Use Resource Quotas to prevent pods from running as root.
Show answer and explanation
Correct answer: A
Explanation
The correct answer is to enable PodSecurityPolicy and configure it to disallow root user privileges for pods. PSP provides a centralized and enforceable mechanism to apply security restrictions, including preventing pods from running as the root user. While other options may contribute to security, they do not address the specific requirement or lack cluster-wide enforcement.
- A. Correct.
PodSecurityPolicy (PSP) is a Kubernetes feature that allows you to enforce security restrictions on pods, such as preventing them from running as the root user. Configuring PSPs appropriately is the most direct and effective way to meet the requirement.
- B. Incorrect.
Kubernetes Network Policies are used to control network-level communication between pods and do not address restrictions on user privileges within pods.
- C. Incorrect.
While setting the
securityContextwithrunAsNonRoot: trueat the pod specification level can prevent pods from running as root, this approach relies on developers to implement it and does not enforce the restriction cluster-wide. - D. Incorrect.
Resource Quotas are used to limit resource consumption (e.g., CPU, memory) and do not provide controls for restricting user privileges within pods.