An organization uses a container registry and wants to ensure that only images that pass vulnerability scanning are deployed to production Kubernetes clusters. Which enforcement mechanism BEST implements this policy?

Question

Accepted Answer

B. Configure a Kubernetes admission controller (webhook) to reject pods referencing images that have not passed a vulnerability scan gate in the CI/CD pipeline. Kubernetes admission controllers (validating admission webhooks) can inspect pod specifications at admission time and reject deployments that reference images lacking a valid vulnerability scan attestation or that fail registry policy. This enforces the policy at the cluster level regardless of developer action. The CAS-005 V5 objectives list container security and CI/CD pipeline under Security Architecture and Security Engineering.

An organization uses a container registry and wants to ensure that only images that pass vulnerability scanning are deployed to production Kubernetes clusters. Which enforcement mechanism BEST implements this policy?

Related Questions

Discussion