Kubernetes and Cloud Native Security Associate (KCSA) free question 9 / 10 · Domain 5: Platform Security
During an outage of a validating webhook service, Pods that the webhook would have refused were created without any check. Which setting explains this, according to "Dynamic Admission Control"?
- The webhook used the default failurePolicy, which lets every request through when a call fails.
- The webhook returned allowed: false, which the API server counts as a failure and then ignores.
- The calls timed out, and a timed-out webhook call admits the request whatever the policy says.
- The webhook was set to failurePolicy Ignore, so an error calling it let the API request continue.
Show the answer and explanation
Answer: D
Why this is correct
The page says "failurePolicy defines how errors encountered while calling the admission webhook are handled. Allowed values are Ignore or Fail." The deciding line is: "Ignore means that an error calling the webhook is ignored and the API request is allowed to continue." The errors it covers include "Network errors, timeouts, or connection failures when contacting the webhook" and a "non-2xx HTTP response or a malformed response", which is what an outage produces. The default is the safer one: "The default failurePolicy for an admission webhooks is Fail", under which the same outage would have rejected the requests. Choosing between them is a trade-off. Fail keeps the policy in force but blocks matching requests while the webhook is down; Ignore keeps the cluster working but lets requests skip the check.
Why the other options are wrong
"The webhook used the default failurePolicy, which lets every request through when a call fails." … The page says "The default failurePolicy for an admission webhooks is Fail", and "Fail means that an error calling the webhook causes the admission to fail and the API request to be rejected."
"The calls timed out, and a timed-out webhook call admits the request whatever the policy says." … The page says "If the timeout expires before the webhook responds, the webhook call will be ignored or the API call will be rejected based on the failure policy."
"The webhook returned allowed: false, which the API server counts as a failure and then ignores." … An explicit rejection is not a failure: "The Kubernetes API server does not apply a failure policy when the webhook is reached successfully, and the webhook implementation has explicitly rejected the request (by specifying allowed: false in the response)."
Ignore fails open, Fail fails closed
failurePolicy decides what happens when a webhook cannot be called. Ignore lets the request continue unchecked; Fail, the default, rejects it.