Examkin

Question

Difficulty: MediumConfigure Azure Kubernetes Service (AKS)

Your company is deploying a new Azure Kubernetes Service (AKS) cluster named 'aks-secure' to host a hybrid application in 'VNet1' (address space 172.16.0.0/12) using the subnet 'aks-subnet' (172.16.1.0/24). The application consists of standard web services and high-performance computing (HPC) batch workloads. The HPC workloads must run only on GPU-enabled virtual machines, while the standard web services must not run on the GPU-enabled nodes. You need to configure the AKS cluster and workloads to enforce this isolation. Which two actions should you perform? (Select two.)

  1. Add a new node pool with a taint of 'sku=gpu:NoSchedule' to the AKS cluster.Answer
  2. In the pod specification of the HPC workloads, add a toleration that matches the 'sku=gpu:NoSchedule' taint.Answer
  3. C
    In the pod specification of the standard workloads, add a toleration that matches the 'sku=gpu:NoSchedule' taint.
  4. D
    In the pod specification of the standard workloads, add a nodeSelector pointing to the GPU-enabled node pool.
  5. E
    Configure an Azure Kubernetes Service (AKS) network policy to restrict scheduling to the GPU-enabled subnet.

Answer

To isolate the workloads, you must add a node pool with a taint of 'sku=gpu:NoSchedule' to the AKS cluster and configure a toleration matching this taint in the pod specification of the HPC workloads.
Applying a taint with the 'NoSchedule' effect to the GPU-enabled node pool ensures that no workloads can be scheduled on those nodes unless they carry a matching toleration. By adding the toleration only to the HPC workloads, you ensure that they can be scheduled on the GPU nodes, while standard web services (which lack the toleration) are prevented from scheduling there, maintaining isolation.

Step-by-Step Solution

1
Determine the isolation mechanism for the GPU-enabled node pool.
Identify that applying a taint with the 'NoSchedule' effect to the GPU node pool will block all pods from scheduling on these nodes by default.
Taints prevent pods from being scheduled on specific nodes unless those pods have a matching toleration.
2
Configure the GPU-enabled node pool in the AKS cluster.
Add a new node pool with the taint 'sku=gpu:NoSchedule'.
Applying the taint at the node pool level ensures all nodes generated in that pool inherit the taint.
3
Allow the HPC workloads to run on the tainted GPU nodes.
Add a matching toleration for 'sku=gpu:NoSchedule' to the pod specification of the HPC workloads.
Only pods with the corresponding toleration can bypass the node taint and be scheduled on the GPU nodes, while standard workloads without the toleration remain on standard nodes.

Key Concept

AKS Node Pool Taints and Tolerations
Rate this question

Topics

Configure Azure Kubernetes Service (AKS)

More questions from this topic