Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ48

Supporting compliance requirements

For compliance purposes, an organization must ensure that in-scope PCI Kubernetes Pods run only on designated in-scope Nodes, and that these Nodes are restricted to running only the in-scope Pods (no other Pods may be scheduled on them). What should the organization do to meet this requirement?

  • A Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
  • B Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
  • C Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
  • D Run all in-scope Pods in the namespace ג€in-scope-pciג€.
Explanation

Applying a taint to the in-scope Nodes (labeled inscope: true) with effect NoSchedule, and configuring a matching toleration on the in-scope Pods, ensures that only Pods carrying that toleration can be scheduled onto those tainted Nodes. This satisfies the requirement that in-scope Nodes contain only in-scope Pods, since any Pod lacking the toleration is blocked from scheduling there. A nodeSelector by itself only directs eligible Pods toward matching Nodes but does not prevent other, non-tolerating Pods from also being scheduled on those same Nodes, so it fails the 'Nodes can only contain in-scope Pods' constraint. Pod Security Policies govern security context settings, not node placement exclusivity, and namespaces do not control which Nodes a Pod is scheduled to.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!