Networking

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

Pods on a new cluster stay in ContainerCreating and the kubelet logs mention that the network plugin is not ready. Which extension interface is involved?

CNI is the container network interface, and Kubernetes ships no default implementation. Until a CNI plugin is installed and healthy, Pods cannot be given network namespaces and stay in ContainerCreating.

A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?

UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

An internal API must be reachable by other Pods in the cluster but must not be exposed outside it. Which Service type meets that, and how do the other types relate to it?

ClusterIP is the default and is reachable only from inside the cluster. NodePort and LoadBalancer build on top of it by adding external entry points.

A container listens on 8080. Clients inside the cluster must reach the Service on 80. Which combination of port and targetPort is correct?

port is the port clients use on the Service. targetPort is the port on the Pod that traffic is forwarded to. Here that means port 80 and targetPort 8080.

A Pod in the frontend namespace must reach a Service named api in the backend namespace. Which name resolves, and what is the fully qualified form?

A Service is reachable as api.backend from another namespace, and the fully qualified name is api.backend.svc.cluster.local. A bare api only resolves inside the Service's own namespace.

Two Pods on different nodes talk to each other directly by Pod IP with no port mapping anywhere. Which rule of the Kubernetes network model makes that work?

Every Pod gets its own cluster-wide IP, and Pods reach each other on that IP without NAT. The network plugin is what has to deliver that, not Kubernetes itself.

A StatefulSet's Pods must each be addressable individually so peers can form a cluster. Which Service configuration provides that, and what does DNS return?

A headless Service, clusterIP: None, allocates no virtual IP. DNS returns the Pod IPs directly, and each StatefulSet Pod also gets its own name under the Service.

A cluster must expose two applications on one external hostname, routed by URL path. Which object does the path-based routing, and what is still required underneath it?

An Ingress routes HTTP by host and path, which a Service cannot do. It still forwards to ClusterIP Services, and it needs an Ingress controller to be running.

Requests to a ClusterIP Service time out. kubectl get endpointslices shows no endpoints for it, though the Pods are Running. What are the TWO most likely causes?

A Service with no endpoints means nothing matched or nothing is ready. Check that the selector matches the Pod labels, and that the Pods pass their readiness probes.

An Ingress rule is written with path /api and no pathType field. The manifest is rejected. What does pathType control, and which value matches /api and /api/v1 alike?

pathType is required on every path. Prefix matches element by element, so /api also matches /api/v1. Exact matches the whole path only, and ImplementationSpecific leaves it to the controller.

A Service of type NodePort is created without specifying a node port. Which port is assigned, and what is the constraint if you want to pick one yourself?

Kubernetes allocates a port from the range set by the API server's --service-node-port-range flag, 30000-32767 by default. A port you choose by hand must be inside that range and free.

After applying a default-deny egress NetworkPolicy, Pods in the namespace cannot reach anything by name, though they can still reach IP addresses you allowed. Why?

A default-deny egress policy also blocks the UDP and TCP port 53 traffic that Pods send to CoreDNS, so every name lookup fails. DNS has to be allowed back explicitly.

An application needs the real client IP address. The Service is type LoadBalancer and currently reports the node IP as the source. Setting externalTrafficPolicy: Local fixes it. What is the cost?

Local preserves the client source IP by refusing to forward between nodes. A node with no local ready endpoint stops serving that Service, so traffic can be dropped and load can spread unevenly.

A Service must send cluster traffic to a database running on a VM outside the cluster, at a fixed IP. Which approach keeps the in-cluster name and works with a raw IP address?

A Service with no selector gets no endpoints automatically, so you create an EndpointSlice yourself pointing at the external address. ExternalName cannot be used with a bare IP.

You are asked what actually makes a ClusterIP reachable from a Pod, given that the cluster IP is not assigned to any network interface. What is the accurate explanation?

A cluster IP is a virtual address. kube-proxy programs packet forwarding rules on every node, in iptables, IPVS or nftables mode, which rewrite traffic for that IP to a chosen endpoint.

You apply a NetworkPolicy that should block all ingress to a namespace, but every Pod stays reachable. kubectl get networkpolicy shows the object exists. What is the most likely explanation?

NetworkPolicies are enforced by the network plugin. If the cluster's CNI plugin does not implement them, the objects are accepted by the API server and have no effect.

Write the smallest NetworkPolicy that denies all ingress traffic to every Pod in a namespace. Which spec achieves it?

An empty podSelector selects every Pod in the namespace, and policyTypes: Ingress with no ingress rules allows nothing. That combination is the documented default-deny policy.

A NetworkPolicy ingress rule has one from entry containing both a namespaceSelector (user=alice) and a podSelector (role=client). Which traffic is allowed?

Selectors inside one from entry are combined with AND. Splitting them into two entries in the from list makes it OR, and that single dash is the whole difference.

An Ingress resource for app.example.com has been applied and the object exists, but nothing responds and the ADDRESS column stays empty. What is missing?

An Ingress is only configuration. An Ingress controller has to be running to satisfy it, and the Ingress usually needs an ingressClassName telling that controller to pick it up.

A platform team owns the cluster's shared entry point and application teams own their own routes. Which Gateway API objects match that split?

GatewayClass describes an implementation, a Gateway is the entry point the platform team runs, and HTTPRoute is the routing an application team attaches to it. The kinds are modelled on those roles.

A shared Gateway lives in the infra namespace. A team applies an HTTPRoute in their own namespace referencing that Gateway, and it is not accepted. What is required?

A Gateway only accepts routes from its own namespace by default. Attaching a route from elsewhere requires the Gateway's listener to permit it through allowedRoutes.

During a rolling update, some requests fail with connection errors even though every Pod eventually becomes healthy. Which mechanism prevents this, and how?

A readiness probe keeps a Pod out of a Service's endpoints until it can serve. Without one, a Pod receives traffic as soon as its container starts.

A Pod cannot resolve any Service name. Other Pods in the cluster resolve names normally. Which check comes first?

With other Pods resolving fine, CoreDNS is healthy, so look at this Pod. Its /etc/resolv.conf and its dnsPolicy decide which resolver it uses at all.