CKS Practice Question 7: Image Policy Webhook Admission
Certified Kubernetes Security Specialist (CKS) · Test 1 · question 7 of 10
Your organisation runs an external image-attestation service that answers "allow" or "deny" for a given image reference. Every Pod admitted to the cluster must be checked against it by the API server itself, and if the service is unreachable the Pod must be rejected rather than admitted.
Which configuration meets these requirements?
Show answer and explanation
Answer:
ImagePolicyWebhook is the built-in admission controller designed for exactly this: it sends the images referenced by an incoming Pod to a backend and admits or rejects based on the reply. It is enabled with --enable-admission-plugins=ImagePolicyWebhook and cannot be configured through flags alone; the kubeconfig for the backend and its behavioural settings live in the file given to --admission-control-config-file. defaultAllow controls the fail-open/fail-closed decision when the backend cannot be reached; false gives the fail-closed behaviour the stem demands.
Option A only forces an image pull, which proves the caller can access the registry. It performs no policy evaluation and would admit a freshly pulled but unattested image.
Option B uses a legitimate mechanism (a validating admission webhook is a perfectly good way to enforce image policy), but failurePolicy: Ignore fails open, which directly contradicts the requirement. failurePolicy: Fail would have been needed.
Option C picks the right controller with the wrong setting: defaultAllow: true admits Pods whenever the backend is unavailable, leaving an obvious bypass for an attacker who can disrupt the service.
Reference: Admission Controllers Reference