Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. In the VPC module, what does one_nat_gateway_per_az = true (with single_nat_gateway = false) give you?

   1. AOne NAT for the whole VPC
   2. BA NAT gateway in each AZ, with each private subnet routing to the NAT in its own AZ
   3. CNo NAT
   4. DNAT only for public subnets
   Show answer

   B. Per-AZ NAT removes a cross-AZ single point of failure and cross-AZ data charges. Use single_nat_gateway for cheap dev environments.

   From lesson 04 · The VPC as code

2. Q2. Why tag subnets with kubernetes.io/role/elb and kubernetes.io/role/internal-elb in Terraform?

   1. ACost reporting only
   2. BSo the AWS Load Balancer Controller can discover which subnets to place internet-facing and internal load balancers in
   3. CEKS refuses untagged subnets
   4. DFor Karpenter only
   Show answer

   B. Subnet discovery by tag keeps load-balancer placement correct without hard-coding subnet IDs in every Ingress.

   From lesson 04 · The VPC as code

3. Q3. What's the risk of changing the VPC CIDR or subnet CIDRs in Terraform later?

   1. ANone
   2. BSubnets (and everything in them, including nodes) must be replaced
   3. COnly tags change
   4. DThe plan fails
   Show answer

   B. CIDR changes force replacement. Plan address space generously once, and add a secondary CIDR rather than resizing.

   From lesson 04 · The VPC as code

4. Q4. Why set bootstrap_cluster_creator_admin_permissions = false?

   1. AIt's faster
   2. BSo cluster-admin isn't silently granted to whichever identity ran the apply; admin access is declared explicitly as access entries
   3. CIt disables RBAC
   4. DIt's required for Fargate
   Show answer

   B. The creator (often a CI role) would otherwise get hidden admin rights. Declaring admins as access entries keeps access reviewable in code.

   From lesson 05 · The EKS cluster as code

5. Q5. Why ignore changes to desired_size on a managed node group?

   1. AIt's deprecated
   2. BThe autoscaler changes it at runtime; without ignore_changes every plan would try to reset it
   3. CIt forces replacement
   4. DIt isn't supported
   Show answer

   B. Terraform owns min and max; the autoscaler owns the current size. ignore_changes stops the two from fighting.

   From lesson 05 · The EKS cluster as code

6. Q6. Why pin add-on versions instead of always using the latest?

   1. ALatest is not allowed
   2. BSo add-on upgrades are deliberate, reviewed changes tested with the cluster version, not side effects of an unrelated apply
   3. CPinning is cheaper
   4. DThe API requires it
   Show answer

   B. A data source with most_recent = true changes the plan whenever AWS publishes a version. Pin, then bump in a pull request.

   From lesson 05 · The EKS cluster as code

7. Q7. Why build IAM policies with the aws_iam_policy_document data source instead of raw JSON strings?

   1. AIt's required
   2. BValidation at plan time, composition and conditional statements in HCL, and consistent formatting that avoids spurious diffs
   3. CIt's faster to apply
   4. DJSON isn't supported
   Show answer

   B. Policy documents in HCL are easier to review, reuse and combine; the data source renders normalised JSON.

   From lesson 06 · IAM as code: access entries, Pod Identity & IRSA

8. Q8. A module lets teams request pod roles. How do you stop a team role from granting itself admin?

   1. ATrust the teams
   2. BEvery role the module creates carries a platform-owned permissions boundary, and an SCP denies creating roles without it
   3. CUse IRSA
   4. DName the roles carefully
   Show answer

   B. A boundary caps effective permissions regardless of attached policies; the SCP makes the boundary unavoidable.

   From lesson 06 · IAM as code: access entries, Pod Identity & IRSA

9. Q9. For IRSA in Terraform, which resource registers the cluster's issuer with IAM?

   1. Aaws_eks_access_entry
   2. Baws_iam_openid_connect_provider
   3. Caws_eks_pod_identity_association
   4. Daws_iam_group
   Show answer

   B. IRSA needs the cluster's OIDC issuer as an IAM identity provider; role trust policies then reference it with sub and aud conditions.

   From lesson 06 · IAM as code: access entries, Pod Identity & IRSA

10. Q10. Which is the usual boundary between Terraform and GitOps on an EKS platform?

    1. ATerraform installs every Helm chart
    2. BTerraform owns AWS resources and the minimal bootstrap (e.g. Karpenter, Argo CD); Argo CD owns in-cluster add-ons and workloads
    3. CGitOps creates the VPC
    4. DThere is no boundary
    Show answer

    B. Terraform is good at AWS APIs and ordering; Argo CD is good at continuously reconciling Kubernetes objects. Each does what it's best at.

    From lesson 07 · Add-ons, Karpenter & the GitOps hand-off

11. Q11. How do in-cluster add-ons installed by Argo CD learn AWS values like role ARNs or the interruption queue name?

    1. AHard-coded in Git
    2. BTerraform writes them as annotations on the Argo CD cluster secret (or to SSM), and ApplicationSets template them into Helm values
    3. CThey query Terraform state
    4. DThey don't need them
    Show answer

    B. This 'GitOps bridge' keeps AWS identifiers generated by Terraform flowing into GitOps without duplicating them by hand.

    From lesson 07 · Add-ons, Karpenter & the GitOps hand-off

12. Q12. Why must Karpenter itself not run on nodes that Karpenter manages?

    1. ALicensing
    2. BIf Karpenter's own node is consolidated or lost, nothing is left to launch capacity; run it on the managed system node group (or Fargate)
    3. CPerformance
    4. DIt's not supported on EC2
    Show answer

    B. The capacity manager must live on stable capacity it doesn't manage.

    From lesson 07 · Add-ons, Karpenter & the GitOps hand-off