Which two tools are commonly used as Pod Admission Controllers to enforce policies?

Which two tools are commonly used as Pod Admission Controllers to enforce policies?

• A. Helm and Kustomize
• B. Kyverno and Open Policy Agent Gatekeeper
• C. Kubectl and Kubeadm
• D. Prometheus and Grafana

Answer: (B)

Pod admission controllers enforce policies at the moment a request to create or modify a pod is received by the Kubernetes API server, allowing either mutation of the request or denial based on defined rules. Kyverno and Open Policy Agent Gatekeeper are built for this purpose and are commonly used to implement policy-as-code in Kubernetes. Kyverno treats policies as Kubernetes resources and can automatically mutate pod specs, set defaults, and validate requirements before pods are admitted. Gatekeeper, driven by OPA with constraint templates and constraints, enforces policies using Rego logic, denying or allowing requests that meet or violate constraints. Together, they provide a robust way to enforce security, compliance, and organizational rules on pods, namespaces, and other resources. Helm and Kustomize are templating tools for generating manifests, not runtime policy enforcers. Kubectl and kubeadm are CLI tools for cluster management and operations, not admission controllers. Prometheus and Grafana are monitoring/observability tools, not policy enforcement mechanisms.

Pod admission controllers enforce policies at the moment a request to create or modify a pod is received by the Kubernetes API server, allowing either mutation of the request or denial based on defined rules. Kyverno and Open Policy Agent Gatekeeper are built for this purpose and are commonly used to implement policy-as-code in Kubernetes. Kyverno treats policies as Kubernetes resources and can automatically mutate pod specs, set defaults, and validate requirements before pods are admitted. Gatekeeper, driven by OPA with constraint templates and constraints, enforces policies using Rego logic, denying or allowing requests that meet or violate constraints. Together, they provide a robust way to enforce security, compliance, and organizational rules on pods, namespaces, and other resources.

Helm and Kustomize are templating tools for generating manifests, not runtime policy enforcers. Kubectl and kubeadm are CLI tools for cluster management and operations, not admission controllers. Prometheus and Grafana are monitoring/observability tools, not policy enforcement mechanisms.