VPCs, egress, edge and multi-cloud connectivity.
5 items at advanced level · all topics
A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?
UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.
An application needs the real client IP address. The Service is type LoadBalancer and currently reports the node IP as the source. Setting externalTrafficPolicy: Local fixes it. What is the cost?
Local preserves the client source IP by refusing to forward between nodes. A node with no local ready endpoint stops serving that Service, so traffic can be dropped and load can spread unevenly.
You are asked what actually makes a ClusterIP reachable from a Pod, given that the cluster IP is not assigned to any network interface. What is the accurate explanation?
A cluster IP is a virtual address. kube-proxy programs packet forwarding rules on every node, in iptables, IPVS or nftables mode, which rewrite traffic for that IP to a chosen endpoint.
A NetworkPolicy ingress rule has one from entry containing both a namespaceSelector (user=alice) and a podSelector (role=client). Which traffic is allowed?
Selectors inside one from entry are combined with AND. Splitting them into two entries in the from list makes it OR, and that single dash is the whole difference.
A shared Gateway lives in the infra namespace. A team applies an HTTPRoute in their own namespace referencing that Gateway, and it is not accepted. What is required?
A Gateway only accepts routes from its own namespace by default. Attaching a route from elsewhere requires the Gateway's listener to permit it through allowedRoutes.