Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why must the control-plane endpoint (VIP) exist before `kubeadm init`?

   1. AIt doesn't matter
   2. BIt's written into certificates and every kubeconfig; changing it later is painful, and other control planes and workers join through it
   3. Ckube-vip requires it
   4. DFor MetalLB
   Show answer

   B. Decide the endpoint first: VIP or load balancer, with a stable name/IP.

   From lesson 03 · Bare-metal HA lab: kube-vip, MetalLB, ingress, TLS

2. Q2. Why shrink the libvirt network's DHCP range before using MetalLB and kube-vip?

   1. AFor speed
   2. BSo DHCP never hands out the addresses reserved for the API VIP and the MetalLB pool; overlapping assignments cause IP conflicts
   3. CMetalLB needs DHCP
   4. DCilium requires it
   Show answer

   B. Static/VIP ranges must be outside the DHCP pool.

   From lesson 03 · Bare-metal HA lab: kube-vip, MetalLB, ingress, TLS

3. Q3. cp1 is shut down. What should still work?

   1. ANothing
   2. Bkubectl via the VIP (kube-vip moves it), etcd with 2 of 3 members (quorum), and all workloads; the scheduler and controllers fail over to another control plane
   3. COnly the pods on cp1
   4. DOnly DNS
   Show answer

   B. That's the point of three control planes and a VIP.

   From lesson 03 · Bare-metal HA lab: kube-vip, MetalLB, ingress, TLS

4. Q4. Why delete the Ingress before `terraform destroy`?

   1. AIt's faster
   2. BThe ALB was created by the controller, not Terraform; if the cluster is destroyed first, the ALB and its security groups can be left behind (still costing money) and block VPC deletion
   3. CTerraform requires it
   4. DTo keep the image
   Show answer

   B. Resources created by in-cluster controllers must be removed by those controllers.

   From lesson 04 · EKS with Terraform and an ALB

5. Q5. How does the AWS Load Balancer Controller get permission to create ALBs?

   1. ANode IAM role with admin
   2. BAn IAM role bound to its Kubernetes ServiceAccount (IRSA or EKS Pod Identity) with the controller's IAM policy
   3. CStatic access keys in a Secret
   4. DIt doesn't need permissions
   Show answer

   B. Per-workload IAM keeps permissions scoped to the controller.

   From lesson 04 · EKS with Terraform and an ALB

6. Q6. Why can EKS nodes pull from ECR without an imagePullSecret?

   1. AECR is public
   2. BThe node IAM role includes ECR read permissions and the kubelet on EKS AMIs is configured with the ECR credential provider
   3. CKubernetes ignores auth
   4. DBecause of the ALB
   Show answer

   B. Compare with project 1, where self-managed nodes needed extra setup.

   From lesson 04 · EKS with Terraform and an ALB