問題文
A security engineer asks whether the scheduler can be used to keep untrusted workloads away from nodes that run sensitive workloads. Which description of the scheduler's role is correct?
選択肢
- The scheduler evaluates the security context of each Pod and refuses to place any Pod that requests privileged mode, so placement doubles as a policy enforcement point.
- The scheduler authenticates the Pod's service account before placing it on a node, so a Pod whose identity is not accepted is never scheduled.
- The scheduler enforces network isolation between the nodes it selects and Pods placed on different nodes cannot reach one another.
- The scheduler decides which node a Pod is placed on, so taints, tolerations and node selectors can steer placement, but it does not restrict what the Pod may do once it is running.