Kubernetes and Cloud Native Associate (KCNA)Cloud Native SecurityHard
A large enterprise is implementing a custom security policy that requires all container images deployed in their Kubernetes clusters to originate from an internal, trusted image registry and be scanned for vulnerabilities within the last 24 hours. This policy needs to be enforced automatically at deployment time. Which Kubernetes extensibility mechanism, often paired with an external policy engine, is best suited to enforce this dynamic, custom policy?
- AValidating Admission Webhooks
- BCustom Resource Definitions (CRDs)
- CNetworkPolicy
- DPod Security Admission (PSA)
Show answer & explanationAnswer & explanation
Correct answer: A. Validating Admission Webhooks
Validating Admission Webhooks allow external services (policy engines like OPA Gatekeeper, Kyverno, or custom logic) to intercept and validate Kubernetes API requests before they are persisted. This makes them ideal for enforcing complex, dynamic, and custom policies like requiring images from a specific registry and checking scan freshness, which go beyond the capabilities of built-in admission controllers like PSA.
Why the other options are wrong
- B. CRDs define new API objects but do not enforce policies on existing or incoming resources.
- C. NetworkPolicy controls network traffic flow, not image deployment policies.
- D. PSA enforces predefined Pod Security Standards and is not designed for highly custom, dynamic policies like registry origin and scan freshness.
Validating Admission Webhooks
An out-of-process admission controller that sends API requests to an external HTTP service for validation, allowing for custom and dynamic policy enforcement.
- Intercepts API requests before persistence.
- Can reject requests if they violate custom policies.
- Used with policy engines (e.g., OPA Gatekeeper, Kyverno).
- Enables flexible, dynamic, and complex policy enforcement.
Memory trick: Webhooks are the custom policy police for your API.