Examkin

Soru

Zorluk: OrtaModernizing Workloads using Containers (ECS and EKS)

Helios Energy Services is modernizing an on-premises containerized telemetry application by migrating it to Amazon EKS on AWS Fargate. The application must run in a secure VPC within private subnets that have no direct route to the internet. The EKS pods must pull container images from an Amazon ECR repository located in a separate shared services AWS account. The container images in ECR are encrypted using a Customer Managed Key (CMK) in AWS KMS. Additionally, the application pods must be exposed to external clients through an Application Load Balancer (ALB) managed by the AWS Load Balancer Controller. Which TWO configurations are required to establish the network routing, image retrieval, and load balancing for this architecture? (Select TWO.)

  1. Configure the AWS Load Balancer Controller to target the pods using target type `ip` within the Kubernetes Service or TargetGroupBinding configuration.Cevap
  2. B
    Configure the Application Load Balancer to route traffic to the EKS Fargate worker nodes using target type `instance` to allow node-level port mapping.
  3. Attach an IAM policy to the EKS Fargate Pod Execution Role that allows `kms:Decrypt` and `kms:DescribeKey` actions on the Customer Managed Key, and update the key policy in the shared services account to trust the Pod Execution Role.Cevap
  4. D
    Create Route 53 Private Hosted Zones for the ECR interface VPC endpoints in the shared services account VPC, without associating them with the EKS VPC, and rely on Kubernetes CoreDNS for cross-account host resolution.
  5. E
    Deploy a single NAT Gateway in one Availability Zone within the EKS VPC and update the route tables of all private subnets across all Availability Zones to route outbound internet traffic through this NAT Gateway.

Cevap

The correct configurations are to configure the AWS Load Balancer Controller to target pods using target type 'ip' in the Kubernetes Service or TargetGroupBinding configuration, and to attach an IAM policy to the EKS Fargate Pod Execution Role allowing decryption using the Customer Managed Key while updating the key policy to trust this role.
Because EKS Fargate pods run in the awsvpc network mode with their own ENIs, the AWS Load Balancer Controller must target them directly using target type 'ip'. Additionally, the EKS Fargate Pod Execution Role (not the Kubernetes Service Account) is used by the Fargate infrastructure to pull images from ECR. If the ECR repository is encrypted with a Customer Managed Key, this execution role must have explicit decrypt permissions on the key, and the key policy must trust the role.

Adım Adım Çözüm

1
Analyze EKS Fargate networking requirements for load balancing.
Since pods run in awsvpc mode on Fargate, they receive unique IP addresses inside the VPC. The AWS Load Balancer Controller must target pods using target type 'ip'.
Targeting by instance ID is invalid since there are no accessible EC2 instances managed by the user.
2
Determine the IAM role responsible for image pulling on EKS Fargate and configure KMS permissions.
The Fargate infrastructure uses the EKS Fargate Pod Execution Role to pull images from ECR. The execution role must be granted 'kms:Decrypt' and 'kms:DescribeKey' permissions on the Customer Managed Key, and the key policy must trust this role.
Without these permissions, the Fargate agent cannot pull the encrypted container images from ECR, leading to pod launch failures.

Anahtar Kavram

EKS Fargate requires target type 'ip' for ALB integration because pods are allocated dedicated ENIs. Image decryption during container startup is handled by the Pod Execution Role, which requires explicit KMS and ECR permissions.
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru