The cluster must refuse to run unsigned or wrongly signed images from OCIR for the tax-assessor workloads. Where is that enforcement configured?
Select an answer to reveal the explanation.
Short Explanation
Signature enforcement is a cluster door policy, not a Dockerfile sticker. Enable OKE image verification and name the Vault master keys that must have signed the OCIR image—so unsigned or wrongly signed pulls are refused for tax-assessor workloads.
Full Explanation
Unsigned or wrongly signed OCIR images are refused by configuring an OKE cluster image-verification policy that names the Vault master keys which must have signed admitted images. Enforcement sits at the cluster admission/policy layer for tax-assessor workloads, not as a decorative label in a Dockerfile. Only images signed with the trusted keys are allowed to run. A LABEL instruction inside each Dockerfile is not a cryptographic signature kubelet enforces. Labels are image metadata; without cluster verification policy tied to Vault keys, unsigned images still run. A public ConfigMap in kube-public that disables TLS for registry pulls weakens transport security and does not implement signature verification. It is unrelated to admitting only signed images. An OCI DevOps test stage can scan or gate builds in CI, but it does not replace cluster admission for every namespace at runtime. Build-time tests alone cannot stop someone from deploying an unsigned tag directly to the cluster. Exam caveat: image verification must trust the correct Vault keys and cover the namespaces/workloads in scope—policy misconfiguration can either block legitimate signed images or fail to protect tax-assessor namespaces. Operational check: enable the cluster image-verification policy with the intended Vault master keys, attempt to run an unsigned image (expect refusal), deploy a correctly signed tax-assessor image (expect success), and audit policy coverage after key rotation.