Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Veloce Telemetry is migrating a Kubernetes-based telemetry application from an on-premises data center to AWS. The application must connect to an Amazon Aurora PostgreSQL database located in a separate dedicated Database VPC. The application pods must also securely pull container images from a central Amazon ECR repository in a Shared Services VPC. The architecture must prevent all traffic, including container image pulls and database queries, from traversing the public internet. Infrastructure management and operational overhead must be minimized, and the solution must remain highly available across multiple Availability Zones. The database endpoint is resolved using a Route 53 Private Hosted Zone (PHZ) created in the Database VPC. Which TWO actions should a Solutions Architect take to design a solution that meets these requirements? (Select TWO.)

  1. Deploy the telemetry workload on Amazon EKS using AWS Fargate profiles, and configure interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) in the EKS VPC to pull container images privately.Answer
  2. Create an AWS Transit Gateway to route private network traffic between the EKS VPC, the Database VPC, and the Shared Services VPC, and associate the database Route 53 Private Hosted Zone with the EKS VPC.Answer
  3. C
    Deploy the telemetry workload on Amazon EKS using Self-Managed Node Groups in a single Availability Zone, and route outbound image pulls and database traffic through a single NAT Gateway in that zone.
  4. D
    Configure the telemetry pods to use the Kubernetes hostNetwork and hostPort parameters in their specifications to bypass the VPC CNI and directly utilize the host's network namespace for database connectivity.
  5. E
    Create a Transit Gateway Route Table in the Shared Services account, add a static route pointing to the database VPC, and configure the database Private Hosted Zone to delegate query resolution via the Transit Gateway.

Answer

Deploy the telemetry workload on Amazon EKS using AWS Fargate profiles, configure interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) in the EKS VPC, establish private network connectivity between the VPCs using AWS Transit Gateway, and associate the database Route 53 Private Hosted Zone with the EKS VPC.
The correct solution involves deploying the telemetry application on Amazon EKS with AWS Fargate profiles to minimize the operational overhead of node management. Interface VPC endpoints for Amazon ECR are configured in the EKS VPC to allow the EKS control plane and Fargate pods to pull container images privately. To enable private connectivity between the EKS, database, and shared services environments, AWS Transit Gateway is deployed to route traffic. Finally, the database's Route 53 Private Hosted Zone is associated with the EKS VPC, enabling the pods to resolve the database DNS endpoint privately.

Step-by-Step Solution

1
Select a serverless compute option for Amazon EKS to minimize node management.
AWS Fargate profiles are chosen for the EKS cluster, removing the need to manage, scale, or patch EC2 instances.
This directly addresses the constraint to minimize operational overhead.
2
Ensure container images can be pulled securely without traversing the public internet.
Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) are created in the EKS VPC.
Since the pods run in private subnets and cannot use the public internet, VPC endpoints enable private connections to Amazon ECR.
3
Configure private network routing between the EKS VPC, Database VPC, and Shared Services VPC.
An AWS Transit Gateway is deployed with VPC attachments to all three VPCs.
This establishes private network connectivity across the multi-account architecture without exposing traffic to the public internet.
4
Enable domain name resolution for the database from the EKS cluster VPC.
The Route 53 Private Hosted Zone for the database is associated with the EKS VPC.
By default, Route 53 PHZs are only resolvable within the VPCs they are associated with. Association is required for pods in the EKS VPC to resolve the database DNS endpoint.

Key Concept

Modernizing Kubernetes applications using Amazon EKS on AWS Fargate with multi-VPC private routing via Transit Gateway and Route 53 Private Hosted Zone association.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic