In a multi-tenant cluster, an image has already been pulled onto a node once. The security team wants every new Pod start to require valid registry credentials instead of reusing that local copy without a fresh authorization check. Which control best matches that requirement?

Question

Accepted Answer

B. Enable the AlwaysPullImages admission controller. The AlwaysPullImages admission controller forces new Pods to pull images so valid credentials are required each time. Option c is wrong because digest pinning improves immutability, but it does not force a fresh authorization check for every start.

In a multi-tenant cluster, an image has already been pulled onto a node once. The security team wants every new Pod start to require valid registry credentials instead of reusing that local copy without a fresh authorization check. Which control best matches that requirement?

Related Questions

Discussion