The cluster must refuse to run unsigned or wrongly signed images from OCIR for the tax-assessor workloads. Where is that enforcement configured?
Select an answer to reveal the explanation.
Short Explanation
Signature enforcement is a cluster door policy, not a Dockerfile sticker. Enable OKE image verification and name the Vault master keys that must have signed the OCIR image—so unsigned or wrongly signed pulls are refused for tax-assessor workloads.
Full Explanation
Official OKE can require signed OCIR images by enabling image verification on the cluster and specifying the Vault master keys that must sign those images. Enforcement is cluster policy, not a Dockerfile LABEL, not disabling TLS via ConfigMap, and not substituting an OCI DevOps pipeline stage for admission. Combined with signing in OCIR/Vault, the cluster refuses unsigned or incorrectly signed pulls.