An administrator is designing a hybrid networking architecture to connect an on-premises d… — Microsoft Azure Administrator (AZ-104)

An administrator is designing a hybrid networking architecture to connect an on-premises datacenter to Azure using an ExpressRoute connection. The Azure environment consists of a hub virtual network (`VNet-Hub` with address space $10.100.0.0/16$ ) and a peered spoke virtual network (`VNet-Spoke` with address space $10.105.0.0/16$ ).

You plan to deploy an Azure Kubernetes Service (AKS) cluster into a subnet named `AKS-Subnet` ( $10.105.4.0/22$ ) within `VNet-Spoke`. The cluster will host standard microservices and a specialized high-performance GPU-intensive workload.

You must configure the cluster to meet the following requirements:
* Pods must be allocated IP addresses from a private network range that does not consume IP addresses from the `VNet-Spoke` address space.
* The Kubernetes API server must be accessible only via a private IP address within the virtual network.
* The specialized GPU-intensive workload must run on a dedicated node pool named `gpu-pool`, and no standard microservice pods may be scheduled on the GPU nodes.

Which of the following configurations should you implement to meet the requirements? (Select two.)

Deploy the AKS cluster as a private cluster and use the Azure CNI Overlay network plugin.Answer
Apply a taint with the value sku=gpu:NoSchedule to the gpu-pool node pool.Answer
C
Deploy the AKS cluster as a private cluster and use the Kubenet network plugin with a pod CIDR of $10.105.4.0/22$ .
D
Apply a node label with the value sku=gpu to the gpu-pool node pool and configure standard microservice pods with node selectors.
E
Create a Kubernetes Service of type LoadBalancer with an internal load balancer annotation to expose the API server.

Answer

To configure the cluster according to the requirements, you should deploy the AKS cluster as a private cluster using the Azure CNI Overlay network plugin, and apply a taint with the value sku=gpu:NoSchedule to the dedicated gpu-pool node pool.

To satisfy the networking requirements, deploying the AKS cluster as a private cluster ensures that the Kubernetes API server is accessible only via a private endpoint in the virtual network. Utilizing the Azure CNI Overlay network plugin allows pods to be assigned IP addresses from a private CIDR range that is completely separate from the virtual network's IP address space, preventing the depletion of virtual network IPs while maintaining direct pod-to-pod routing. To meet the workload isolation requirement, applying a taint with the value sku=gpu:NoSchedule to the gpu-pool node pool prevents the Kubernetes scheduler from placing any pods on these nodes unless they have a matching toleration. Standard microservice pods without the toleration will not be scheduled on the GPU nodes.

Step-by-Step Solution

Select the appropriate networking model for IP conservation and security.

Deploy the cluster as a private cluster using the Azure CNI Overlay network plugin.

Private cluster mode assigns a private IP to the API server. Azure CNI Overlay assigns pods IP addresses from a private CIDR block separate from the virtual network, preventing virtual network IP exhaustion.

Isolate the GPU node pool to prevent regular workloads from running on it.

Configure the gpu-pool node pool with the taint sku=gpu:NoSchedule.

Taints prevent pods from scheduling on nodes unless the pods have a matching toleration. This guarantees the node pool is dedicated only to the GPU workload.

Key Concept

Configuring AKS network models (Azure CNI Overlay and Private Cluster) and node pool scheduling constraints (taints and tolerations).

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic