Kyverno
Hard
Security
A Kyverno verifyImages rule has mutateDigest: true. What does it do once the signature is verified?
Select your answer:
Show answer and explanation
Answer: Replaces the image tag in the pod spec with the verified digest
Explanation
A tag can be moved to point at a different image after verification. mutateDigest pins the pod to the exact digest Kyverno checked, so the node pulls the image that was verified. It is enabled by default.
More hard Kyverno questions
- In a Kyverno mutate overlay (patchStrategicMerge), what does the +() anchor do, as in '+(imagePullPolicy): IfNotPresent'?
- In a Kyverno validate pattern, what does the X() negation anchor mean, as in 'X(hostPath): "null"'?
- Which Kyverno resource exempts specific resources from a policy rule without editing the policy?
- What does the 'kyverno test' command read to run policy tests?
- Why must background be set to false on a Kyverno policy whose rules use request.userInfo, such as the requesting user's name or roles?
- In recent Kyverno versions, where should you set Enforce or Audit for a validate rule?