Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What replaced editing the aws-auth ConfigMap for granting cluster access?

   1. ANothing
   2. BEKS access entries (with the API authentication mode), managed through the EKS API and Terraform
   3. CKubernetes RBAC only
   4. DSecurity groups
   Show answer

   B. Access entries are AWS API objects: auditable, manageable as code, and no risk of breaking access with a malformed ConfigMap.

   From lesson 05 · Identity

2. Q2. What does EKS Pod Identity give a pod?

   1. AA public IP
   2. BTemporary AWS credentials for an IAM role associated with its ServiceAccount, without node-level credentials
   3. CCluster-admin
   4. DAn SSH key
   Show answer

   B. The Pod Identity Agent exchanges the pod's ServiceAccount token for role credentials. Each app gets only its own permissions.

   From lesson 05 · Identity

3. Q3. Why not just give the node's instance role all the permissions pods need?

   1. AIt doesn't work
   2. BEvery pod on the node would get every permission, breaking least privilege; block pod access to IMDS and use per-pod roles instead
   3. CIt's more expensive
   4. DInstance roles can't access S3
   Show answer

   B. Node roles are shared by everything on the node. Per-ServiceAccount roles keep a compromised pod from reaching other apps' data.

   From lesson 05 · Identity

4. Q4. What triggers Karpenter to launch a node?

   1. ACPU usage over 80%
   2. BPods that the scheduler can't place (Pending/unschedulable)
   3. CA cron schedule
   4. DThe HPA
   Show answer

   B. Karpenter watches unschedulable pods, computes what capacity they need (resources, zones, architecture, taints) and launches matching instances.

   From lesson 06 · Capacity with Karpenter

5. Q5. What does consolidation do?

   1. AMerges clusters
   2. BRemoves empty or under-used nodes, or replaces them with cheaper ones, when their pods can run elsewhere
   3. CCompresses images
   4. DAdds Spot instances only
   Show answer

   B. Consolidation is how Karpenter saves money continuously, bounded by disruption budgets and PDBs.

   From lesson 06 · Capacity with Karpenter

6. Q6. Why does Karpenter need an interruption queue (SQS) for Spot?

   1. ATo store logs
   2. BTo receive EC2 interruption warnings and rebalance events, so it can cordon and drain nodes before AWS reclaims them
   3. CFor billing
   4. DTo launch nodes faster
   Show answer

   B. Spot instances get a two-minute warning. Handling it gives pods time to move gracefully.

   From lesson 06 · Capacity with Karpenter

7. Q7. Why must the gp3 StorageClass use volumeBindingMode: WaitForFirstConsumer on EKS?

   1. Agp3 requires it
   2. BEBS volumes are zonal; waiting until the pod is scheduled creates the volume in the pod's AZ
   3. CIt's faster
   4. DIt enables encryption
   Show answer

   B. With Immediate binding, the volume could land in an AZ where the pod can't run, leaving it stuck.

   From lesson 07 · Storage tiers

8. Q8. Which option gives pods in different AZs a shared read-write filesystem?

   1. Agp3
   2. BEFS with the EFS CSI driver
   3. CInstance store
   4. Dio2
   Show answer

   B. EFS is regional NFS supporting ReadWriteMany; EBS attaches to one node in one AZ.

   From lesson 07 · Storage tiers

9. Q9. How should the EBS CSI driver get permission to create volumes?

   1. AAdmin credentials in a Secret
   2. BA least-privilege IAM role for its ServiceAccount via Pod Identity or IRSA
   3. CThe node role with full EC2 access
   4. DNo permissions needed
   Show answer

   B. The controller calls EC2 APIs. A dedicated role (AWS provides a managed policy for it) keeps those permissions off every node.

   From lesson 07 · Storage tiers

10. Q10. What does target-type: ip mean for an ALB created by the controller?

    1. AThe ALB gets a static IP
    2. BThe ALB sends traffic directly to pod IPs (registered in the target group), skipping NodePorts
    3. COnly IPv6 is used
    4. DPods get public IPs
    Show answer

    B. With the VPC CNI, pods have VPC IPs, so the ALB can target them directly: fewer hops, and better health checking.

    From lesson 08 · Ingress

11. Q11. How do several Ingresses share one ALB (and one bill)?

    1. AThey can't
    2. BGive them the same alb.ingress.kubernetes.io/group.name annotation (IngressGroup)
    3. CUse the same namespace
    4. DUse a NodePort
    Show answer

    B. IngressGroups merge rules from multiple Ingresses into one ALB. Group only Ingresses with the same trust level.

    From lesson 08 · Ingress

12. Q12. The controller logs 'unable to resolve at least one subnet'. What's missing?

    1. AAn ACM certificate
    2. BSubnet tags (kubernetes.io/role/elb or internal-elb) or explicit subnet annotations
    3. CA PDB
    4. DCoreDNS
    Show answer

    B. The controller discovers subnets by tag. Tag your public and private subnets in Terraform when you create the VPC.

    From lesson 08 · Ingress

13. Q13. What's the right order for an EKS upgrade?

    1. ANodes, then control plane
    2. BControl plane, then add-ons, then nodes, one minor version at a time
    3. CAll at once
    4. DAdd-ons only
    Show answer

    B. Nodes must never be newer than the control plane, and add-ons must match the new version. Upgrades go one minor at a time.

    From lesson 09 · Upgrades & add-ons

14. Q14. How does Karpenter roll nodes onto a new AMI or version?

    1. AIt doesn't
    2. BThrough drift: when the NodeClass AMI selection changes, nodes no longer match and are replaced gradually within disruption budgets
    3. CBy rebooting nodes in place
    4. DOnly on Spot interruption
    Show answer

    B. Change the AMI selection (or let a pinned alias move), and drift replaces nodes respecting PDBs and disruption budgets.

    From lesson 09 · Upgrades & add-ons

15. Q15. When is a blue/green cluster upgrade worth the extra effort?

    1. AAlways
    2. BFor risky jumps (several versions behind, CNI changes, major redesigns) where an easy rollback matters more than cost and effort
    3. CNever
    4. DOnly for dev
    Show answer

    B. A new cluster built from code, with traffic shifted gradually, gives a clean rollback path. In-place is simpler for routine minor upgrades.

    From lesson 09 · Upgrades & add-ons