A security auditor requires that all container images used in the cluster are scanned for vulnerabilities before deployment. The team uses a private registry with image signing. Which solution enforces that only signed and scanned images are deployed?
Cosign admission controller can enforce signature verification at pod creation.
Why this answer
Cosign is a tool for signing container images, and deploying a validating webhook (e.g., the cosigned admission controller) enforces that only images with valid signatures are admitted. This directly meets the requirement to deploy only signed and scanned images, as the webhook verifies the signature before the pod is created.
Exam trap
CNCF often tests the distinction between admission-time enforcement (webhooks) and post-deployment scanning (CronJobs), and the trap here is that candidates confuse scanning with enforcement, or assume Binary Authorization is a generic Kubernetes feature when it is actually GKE-specific.
How to eliminate wrong answers
Option B is wrong because a CronJob scanning images and updating a ConfigMap does not enforce admission-time control; it only provides a reactive list of allowed images, which can be bypassed or become stale. Option C is wrong because OPA Gatekeeper verifying the registry origin (e.g., checking the image path) does not verify image signatures or scan results; it only ensures the image comes from the private registry, not that it is signed or scanned. Option D is wrong because Binary Authorization is a Google Cloud-specific service (GKE) and is not a generic Kubernetes-native solution; it is not available in a standard CKS cluster environment.