Night-shift charts keep deploying privileged pods and hostPath volumes on AKS. How should the security engineer enforce Kubernetes guardrails without writing a custom admission-controller manifest?
Select an answer to reveal the explanation.
Short Explanation
Stop shipping home-grown admission YAML for every chart. Flip on the Azure Policy add-on for AKS and assign the built-in Kubernetes policies—no privileged pods, resource limits required.
Full Explanation
The Azure Policy add-on for AKS evaluates Kubernetes resources against assigned Azure Policy definitions, including built-in policies that deny privileged pods or require resource limits. That is the managed hardening lever for this bullet. Dumping raw admission-controller manifests or large Policy initiative JSON as the primary answer drifts into CKAD or Domain 4 Policy administration rather than enabling the AKS policy add-on and assigning built-in Kubernetes policies.