Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

An energy infrastructure company, GridOps Core, is modernizing its legacy SCADA telemetric aggregation application, which runs on-premises and communicates directly with power substations. To comply with national regulations and maintain sub-millisecond latency to local hardware controllers, the company must deploy the containerized workload onto Amazon EKS running on AWS Outposts. The EKS cluster control plane is hosted in the parent AWS Region. The containerized pods must be assigned IP addresses that are directly routable from the on-premises network to allow bidirectional communication with the substations. Furthermore, the pods must securely pull images from a private Amazon Elastic Container Registry (Amazon ECR) repository in the parent Region, and resolve hostnames in the on-premises domain `ops.grid.local` along with Route 53 Private Hosted Zones, without traversing the public internet.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create EKS node groups on Amazon EC2 instances on the AWS Outpost. Provision interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the Outpost subnets, and create a gateway VPC endpoint for Amazon S3 associated with the Outpost subnet route tables. Configure a Route 53 Resolver outbound endpoint in the VPC, and create a resolver rule to forward queries for ops.grid.local to the on-premises DNS servers.Answer
  2. Configure EKS worker nodes on EC2 instances in the Outpost subnets. Configure the Amazon VPC CNI plugin with custom networking to assign pod IPs from a dedicated VPC secondary CIDR block, and configure the Outpost Local Gateway (LGW) route table with Direct VPC Routing to advertise the pod CIDR block to the on-premises network.Answer
  3. C
    Deploy EKS worker nodes using AWS Fargate profiles mapped to the Outpost subnets. Configure the pods to use host networking mode to bypass the VPC CNI and gain direct access to the on-premises network.
  4. D
    Update the VPC DHCP options set to list the on-premises DNS server IP addresses as the primary resolvers. Create the Route 53 Private Hosted Zone (PHZ) in the AWS account, and associate it with the VPC to enable local resolution.
  5. E
    Configure the EKS worker nodes' subnet route tables to route all ECR and S3 traffic through a single NAT Gateway deployed in a public subnet of the parent AWS Region. Create an interface VPC endpoint for Amazon S3 in the Outpost subnets to cache image layers locally.

Answer

The correct configurations are to deploy the EKS node groups on EC2 instances on the Outpost, configure ECR interface endpoints and an S3 gateway endpoint, configure Route 53 Resolver outbound endpoints for hybrid DNS resolution, and configure the Amazon VPC CNI with custom networking alongside Direct VPC Routing on the Outpost Local Gateway.
The correct design combines EKS node groups running on EC2 instances on AWS Outposts, private VPC endpoints (ECR interface endpoints and an S3 gateway endpoint) for private image retrieval, and a Route 53 Resolver outbound endpoint to forward on-premises queries. To achieve direct routability of pod IP addresses on the local network, the Amazon VPC CNI plugin is configured with custom networking to pull from a secondary CIDR, which is advertised to the customer network using Direct VPC Routing at the Outpost Local Gateway.

Step-by-Step Solution

1
Determine compute placement on AWS Outposts.
Identify that EC2-backed EKS node groups must be deployed since AWS Fargate is not supported on Outposts.
Ensures the containerized SCADA workload runs locally on physical Outposts infrastructure to meet latency and sovereignty requirements.
2
Design private image pulling mechanics.
Configure interface VPC endpoints for ECR api and dkr, and a gateway VPC endpoint for S3.
Allows container nodes to pull images from the private ECR registry in the parent region securely without traversing the public internet.
3
Establish hybrid DNS resolution.
Deploy Route 53 Resolver outbound endpoints in the VPC and map the on-premises domain to the local DNS servers.
Enables pods to resolve names in the on-premises domain while preserving the ability of the Route 53 Resolver to resolve private hosted zones and local Kubernetes services.
4
Configure pod IP routing on the local network.
Enable custom networking in the VPC CNI for secondary CIDR allocation, and configure Direct VPC Routing on the Outpost Local Gateway.
Provides pods with routable IP addresses that can communicate bidirectionally with on-premises substation controllers without NAT.

Key Concept

Modernizing workloads on AWS Outposts using Amazon EKS with hybrid connectivity, private container registry access, and integrated DNS resolution.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic