Your company plans to deploy an Azure Kubernetes Service (AKS) cluster named AKS1. The cluster will host a multi-tier application consisting of a web frontend and a database backend.
You need to configure AKS1 to meet the following requirements:
- The database backend pods must run only on a specific node pool named dbpool. No other pods must run on dbpool.
- Traffic between the frontend pods and the backend pods must be restricted using rules applied within the cluster.
Which two configurations should you implement? (Choose two.)
- Apply a taint to the dbpool node pool and add a corresponding toleration to the database backend pods.Answer
- Enable a network policy provider when deploying the AKS cluster.Answer
- CCreate an Azure Network Security Group (NSG) and associate it with the AKS subnet to filter pod-to-pod traffic.
- DConfigure a Kubernetes ClusterRole and ClusterRoleBinding to restrict pod placement.
- EDeploy the web frontend pods and database backend pods to separate Azure Virtual Networks.
Answer
To meet the requirements, you must apply a taint to the dbpool node pool and add a corresponding toleration to the database backend pods to isolate the database workload. Additionally, you must enable a network policy provider when deploying the AKS cluster to filter traffic between pods.
To ensure database pods run exclusively on the dbpool node pool, you must apply a taint to the node pool and add a matching toleration to the database pods. This prevents other pods from being scheduled on these nodes. To restrict pod-to-pod network traffic, you must enable a network policy provider (such as Azure Network Policy or Calico) during AKS cluster creation, which allows Kubernetes network policies to filter traffic between the frontend and backend pods.
Step-by-Step Solution
Key Concept
Configuring node pool isolation using taints/tolerations and securing pod-to-pod traffic with network policies in Azure Kubernetes Service (AKS).