Examkin

Soru

Zorluk: ZorModernizing Workloads using Containers (ECS and EKS)

RetailPulse is modernizing its inventory tracking application by migrating it from an on-premises Kubernetes cluster to Amazon EKS. The Solutions Architect has decided to use EKS with AWS Fargate profiles to run the application pods. The pods must run in private subnets without direct internet access and cannot use a NAT gateway due to strict corporate security policies. The pods must securely connect to an Amazon RDS for PostgreSQL database located in a database VPC within the same region. The database uses IAM database authentication, and static credentials must not be stored within the containers. Additionally, the pods need to pull container images from an Amazon ECR private repository in the same region. Which TWO configurations must the Solutions Architect implement to meet these requirements?

  1. Configure an IAM OpenID Connect (OIDC) identity provider for the EKS cluster. Create an IAM role with the rds-db:connect permission and a trust policy that permits the OIDC provider to assume the role. Create a Kubernetes service account annotated with the IAM role ARN, and configure the application pods to use this service account.Cevap
  2. Set the EKS cluster endpoint access to private. Create interface VPC endpoints in the application VPC for ECR API and ECR Docker registry, and create a gateway VPC endpoint for Amazon S3. Establish a VPC peering connection or Transit Gateway between the application VPC and the database VPC, and update the VPC route tables and security groups accordingly.Cevap
  3. C
    Attach the rds-db:connect policy to the Amazon EKS Fargate execution role, and specify the database endpoints and execution parameters inside the Kubernetes ConfigMap associated with the Fargate profile.
  4. D
    Configure the EKS cluster endpoint access to public. Deploy a single NAT Gateway in a public subnet of the application VPC to allow the pods to pull images from the ECR registry and connect to the database VPC over the internet.
  5. E
    Deploy the Amazon EKS Pod Identity Agent on the Fargate nodes, and create an EKS Pod Identity association that maps the Kubernetes service account directly to an IAM role containing the rds-db:connect permissions.

Cevap

The correct configurations are to configure an IAM OpenID Connect (OIDC) identity provider for the EKS cluster to assign the database connection role via IRSA to the Kubernetes service account, and to set the EKS cluster endpoint to private while creating VPC endpoints for ECR and S3 along with VPC peering or Transit Gateway to reach the database VPC.
To authenticate with the RDS database using IAM database credentials without storing secrets, pods must assume an IAM role. Since EKS Pod Identities are not supported on EKS Fargate, the cluster must use IAM Roles for Service Accounts (IRSA) by configuring an IAM OIDC provider, creating an IAM role, and annotating the Kubernetes service account. Furthermore, to run pods in private subnets without a NAT gateway, the EKS cluster endpoint must be set to private so that pods can communicate with the control plane inside the VPC. Interface endpoints for ECR and a gateway endpoint for S3 are required to pull container images privately. A VPC peering or Transit Gateway connection allows private routing to the database VPC.

Adım Adım Çözüm

1
Configure the identity delegation mechanism for EKS Fargate workloads.
Since AWS Fargate does not support EKS Pod Identities, configure an IAM OIDC provider for the EKS cluster to enable IAM Roles for Service Accounts (IRSA). Create an IAM role with the necessary rds-db:connect permissions, modify its trust policy to trust the OIDC provider, annotate the Kubernetes service account, and specify it in the Pod definition.
This enables pods to assume IAM roles dynamically and authenticate with Amazon RDS using IAM database authentication without storing static credentials.
2
Establish private networking for container image downloads and control plane traffic.
Set the EKS cluster endpoint access configuration to private so control plane traffic stays within the VPC. Deploy Interface VPC Endpoints for ECR API and ECR Docker, and a Gateway VPC Endpoint for S3.
This allows EKS Fargate nodes to pull container images from ECR private registries and communicate with the EKS control plane without needing route access through a NAT Gateway.
3
Configure secure cross-VPC routing to the database VPC.
Establish a VPC peering connection or Transit Gateway between the application VPC and the database VPC, and configure the target route tables and security groups.
This ensures the application pods in the private subnets can connect to the database endpoint privately without traversing the public internet.

Anahtar Kavram

Configuring private container workloads on Amazon EKS with AWS Fargate, utilizing Interface VPC Endpoints for private ECR image downloads, private cluster endpoints, and setting up IAM Roles for Service Accounts (IRSA) for pod-level IAM authentication.
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru