Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What does TLS termination at the ingress controller mean?

   1. ATLS is disabled
   2. BThe controller decrypts HTTPS with the certificate, then forwards requests to the backend (plain HTTP or re-encrypted)
   3. CThe backend must have the certificate
   4. DOnly TCP is supported
   Show answer

   B. Termination lets the controller route by host and path. With re-encryption it opens a new TLS connection to the backend as well.

   From lesson 07 · Ingress controllers & TLS

2. Q2. Why does SNI matter for ingress TLS?

   1. AIt speeds up DNS
   2. BThe client sends the hostname during the TLS handshake, so one IP can serve different certificates for different hosts
   3. CIt encrypts headers
   4. DIt's only for HTTP/3
   Show answer

   B. Without SNI, a shared ingress IP couldn't pick the right certificate. Test with -servername / --resolve to see what a given host gets.

   From lesson 07 · Ingress controllers & TLS

3. Q3. An Ingress has no ingressClassName and nothing happens. Why?

   1. AIngress is deprecated
   2. BNo controller claimed it: either set ingressClassName or mark an IngressClass as the cluster default
   3. CThe Service is wrong
   4. DTLS is required
   Show answer

   B. Controllers only act on Ingresses of their class. Without a class (and without a default IngressClass), nobody picks it up.

   From lesson 07 · Ingress controllers & TLS

4. Q4. In Gateway API, who typically owns the Gateway object?

   1. AEach app team
   2. BThe platform/cluster operator team: it defines listeners, TLS and which namespaces may attach routes
   3. CThe cloud provider only
   4. DNobody
   Show answer

   B. Role separation is the point: infrastructure owns GatewayClasses, the platform owns Gateways, app teams own Routes.

   From lesson 08 · Gateway API

5. Q5. An HTTPRoute in namespace shop stays unattached to a Gateway in namespace infra. What should you check first?

   1. AThe pod image
   2. BThe Gateway listener's allowedRoutes (which namespaces may attach) and the Route's status.parents conditions
   3. CCoreDNS
   4. DThe node taints
   Show answer

   B. Gateways explicitly allow route attachment from namespaces. The Route's status explains whether it was Accepted and why not.

   From lesson 08 · Gateway API

6. Q6. What does a ReferenceGrant do?

   1. AGrants RBAC to users
   2. BLets objects in one namespace reference specific objects in another (e.g. a Route pointing at a Service elsewhere)
   3. CIssues certificates
   4. DCreates a load balancer
   Show answer

   B. Cross-namespace references are denied by default. The namespace that owns the target must opt in with a ReferenceGrant.

   From lesson 08 · Gateway API

7. Q7. You apply a default-deny egress policy and every app breaks, even calls to allowed Services. What did you forget?

   1. ARBAC
   2. BAllowing DNS: pods can't resolve Service names without egress to CoreDNS (UDP and TCP port 53)
   3. CA LoadBalancer
   4. DThe ingress controller
   Show answer

   B. Name resolution is itself network traffic. Default-deny egress needs an explicit rule allowing DNS to kube-system.

   From lesson 09 · Network policies & mTLS

8. Q8. Do NetworkPolicies work with every CNI?

   1. AYes, Kubernetes enforces them itself
   2. BNo: the CNI plugin enforces them; some simple CNIs ignore them silently
   3. COnly on cloud providers
   4. DOnly for egress
   Show answer

   B. The API server stores policies; the CNI (Calico, Cilium, others) implements them. With a non-enforcing CNI, policies have no effect.

   From lesson 09 · Network policies & mTLS

9. Q9. What does mTLS add that NetworkPolicy doesn't?

   1. ANothing
   2. BEncryption of traffic in transit and cryptographic workload identity (not just IP-based rules)
   3. CFaster DNS
   4. DPod scheduling
   Show answer

   B. NetworkPolicy filters by labels and IPs. mTLS encrypts traffic and proves which workload is on each end.

   From lesson 09 · Network policies & mTLS