CKS Supply Chain Security Practice Question
Which TWO of the following are valid methods to ensure only signed images are deployed in a Kubernetes cluster?
⚠ Common exam trap
CNCF CKS often tests the distinction between admission control mechanisms and runtime or manual verification; the trap here is that candidates may think manual verification (Option C) or pull policies (Option B) are sufficient for cluster-wide enforcement, when in fact only admission controllers or policy engines that intercept pod creation can guarantee that only signed images are deployed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure ImagePolicyWebhook to require signatures
The ImagePolicyWebhook admission controller can be configured to reject pods that reference images without valid signatures. It works by sending an admission review request to an external webhook service (e.g., using Cosign or Notary) that validates the image signature before allowing the pod to be created. This enforces signature verification at admission time, preventing unsigned images from running in the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure ImagePolicyWebhook to require signatures
Why this is correct
This admission controller intercepts Pod creation requests and sends the image reference to an external webhook endpoint that performs signature verification (e.g., using sigstore/cosign) before returning an admission response. If the webhook rejects the image as unsigned, the API server refuses to admit the Pod, enforcing the policy cluster-wide at admission time. Because the check happens automatically during the API request lifecycle, it cannot be skipped by operators or developers.
- ✗
Set imagePullPolicy: Always
Why it's wrong here
Setting imagePullPolicy: Always forces the kubelet to pull the image from the registry each time a container is started, even if a copy already exists on the node. This ensures the latest tag is fetched, but it does nothing to validate the image's cryptographic signature, provenance, or integrity. It addresses image freshness, not authenticity, and thus cannot prevent an attacker from pushing a malicious image to a valid tag.
- ✗
Run 'cosign verify' manually before every deployment
Why it's wrong here
Manual verification depends on a human executing the cosign command every time and correctly interpreting the output, which is error-prone and not enforceable. There is no integration with the Kubernetes API request flow, so a deployment initiated without this step will proceed without any signature check. The cluster itself never sees the verification result, and the policy is not centrally enforced, leaving a gap for operational mistakes or insider actions.
- ✓
Use Kyverno policy to verify image signatures
Why this is correct
Kyverno acts as a dynamic admission controller that can evaluate images in Pod requests against a cluster policy, using cosign to verify signatures and reject resources that fail. Unlike a separate webhook service, Kyverno policies are declarative YAML rules that are versioned with the cluster and can be extended to also validate attestations or enforce other supply-chain constraints. The admission check is performed automatically for every matching resource, providing consistent enforcement without external infrastructure.
- ✗
Use NodeRestriction admission controller
Why it's wrong here
NodeRestriction is designed to prevent a compromised kubelet from modifying nodes or pod objects outside its own node; it limits writes to the node's own pod and node objects for security. It performs no image inspection whatsoever and has no ability to verify signatures, inspect container configurations, or reject images. Its purpose is to narrow the API surface for node agents, and it is orthogonal to image supply-chain security.
Go deeper
Related to this question
Learn chapter
Supply Chain Security: Policy Enforcement and Admission Controllers
Key term
OPA Gatekeeper
OPA Gatekeeper is a Kubernetes admission controller that enforces custom security and compliance policies on resources before they are created or updated in a cluster.
Key term
Node Restriction
A Kubernetes admission controller that limits what a kubelet can modify on its own node to prevent privilege escalation and unauthorized access.
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team wants to ensure that only signed images are deployed in the cluster. They have set up an ImagePolicyWebhook admission controller. After configuring the webhook, they notice that pods with unsigned images are still being created. What is the most likely cause?
medium- A.The ImagePolicyWebhook is failing open due to a misconfigured failure policy
- B.The container runtime does not support image signing
- C.The images are signed but the signature is invalid
- ✓ D.The ImagePolicyWebhook is not enabled in the kube-apiserver configuration
Why D: The ImagePolicyWebhook admission controller must be explicitly enabled in the kube-apiserver configuration via the `--enable-admission-plugins=ImagePolicyWebhook` flag. If it is not enabled, the kube-apiserver will not invoke the webhook at all, allowing unsigned images to be deployed regardless of the webhook's configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.