Question

A DevSecOps team runs a Kubernetes platform where developers can push arbitrary images to the cluster's namespaces. Recent incident review found a workload running an unsigned image pulled from an untrusted public registry that contained a cryptominer. The team already signs internal images using Cosign and stores public keys in a trusted store. Which control most directly prevents unsigned or untrusted images from being deployed to the cluster going forward?

Accepted Answer

Deploy an admission controller policy that verifies image signatures against trusted public keys and blocks pods whose images fail verification

Answer

Enable image vulnerability scanning in the CI pipeline and fail builds that exceed a critical CVE threshold

Answer

Configure network egress filtering so cluster nodes cannot reach untrusted public registries

Answer

Apply Pod Security Standards at the 'restricted' level to prevent privileged containers from running