VMware 2V0-71.23 Dumps

The object in Kubernetes used to grant permissions to a cluster-wide resource is ClusterRoleBinding. A ClusterRoleBinding is a cluster-scoped object that grants permissions defined in a ClusterRole to one or more subjects, such as users, groups, or service accounts5. A ClusterRole is a cluster-scoped object that defines a set of permissions on cluster-scoped resources (like nodes) or namespaced resources (like pods) across all namespaces5. For example, a ClusterRoleBinding can be used to allow a particular user to run kubectl get pods --all-namespaces by granting them the permissions defined in a ClusterRole that allows listing pods in any namespace6. References: Using RBAC Authorization | Kubernetes, Cluster Roles and Cluster Roles Binding in Kubernetes | ANOTE.DEV

Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms. VMware Tanzu Kubernetes Grid uses Cluster API to deploy and manage Kubernetes clusters on various platforms. The three Cluster API providers being used in VMware Tanzu Kubernetes Grid are:

• CAPZ: Cluster API Provider for Azure. This provider enables Cluster API to create Kubernetes clusters on Microsoft Azure4.
• CAPV: Cluster API Provider for vSphere. This provider enables Cluster API to create Kubernetes clusters on vSphere 6.7 or later5.
• CAPA: Cluster API Provider for AWS. This provider enables Cluster API to create Kubernetes clusters on Amazon Web Services5.

References: VMware Tanzu Kubernetes Grid Documentation, Taking Kubernetes to the People: How Cluster API Promotes Self … - VMware

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps:

• Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1
• Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2

References: 1: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html  2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html