Cloud Native Operations

English

한국어

English

한국어

Appearance

Services and Networking Quiz ​

This quiz tests your understanding of Kubernetes networking concepts including service types, Ingress, network policies, and service discovery.

Multiple Choice Questions ​

  1. What is the default service type in Kubernetes?
    • A) NodePort
    • B) LoadBalancer
    • C) ClusterIP
    • D) ExternalName
Show Answer

Answer: C) ClusterIP

Explanation: ClusterIP is the default service type in Kubernetes, providing an IP address that is only accessible within the cluster. This service allows other applications within the cluster to access the service, but it cannot be accessed from outside the cluster.

  1. Which API object exposes HTTP and HTTPS routes from outside the cluster to services within the cluster?
    • A) Service
    • B) Ingress
    • C) Endpoint
    • D) NetworkPolicy
Show Answer

Answer: B) Ingress

Explanation: Ingress is an API object that exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Ingress provides load balancing, SSL termination, and name-based virtual hosting.

  1. Which two are the built-in Kubernetes Service discovery mechanisms? (Select two.)
    • A) Environment variables
    • B) DNS
    • C) Service Mesh
    • D) ConfigMap
Show Answer

Answer: A) Environment variables and B) DNS

Explanation: Kubernetes provides two main service discovery methods: environment variables and DNS. ConfigMap is used to store configuration data and is not a service discovery mechanism.

  1. Which service type in Kubernetes makes services accessible through a specific port on all nodes?
    • A) ClusterIP
    • B) NodePort
    • C) LoadBalancer
    • D) ExternalName
Show Answer

Answer: B) NodePort

Explanation: NodePort services make services accessible through a specific port on all nodes. This service type allows access to the service through each node's IP address and NodePort value (allocated by default in the range 30000-32767).

  1. What type of service has no cluster IP and creates DNS records for each pod?
    • A) NodePort service
    • B) LoadBalancer service
    • C) Headless service
    • D) ExternalName service
Show Answer

Answer: C) Headless service

Explanation: A headless service is a service configured with clusterIP: None, which does not allocate a cluster IP and creates DNS records for each pod. This is useful when clients need to access specific pods behind the service directly.

  1. Which resource provides a way to control communication between pods in Kubernetes?
    • A) Service
    • B) Ingress
    • C) NetworkPolicy
    • D) EndpointSlice
Show Answer

Answer: C) NetworkPolicy

Explanation: NetworkPolicy provides a way to control communication between pods. Using network policies, you can restrict ingress and egress traffic between pods.

  1. What is used as the DNS server for Kubernetes clusters?
    • A) kube-dns
    • B) CoreDNS
    • C) NodeDNS
    • D) ClusterDNS
Show Answer

Answer: B) CoreDNS

Explanation: CoreDNS is a flexible and extensible DNS server used as the DNS server for Kubernetes clusters. Since Kubernetes 1.11, CoreDNS has been used as the default DNS server.

  1. Which Linux kernel technology does Cilium utilize?
    • A) iptables
    • B) netfilter
    • C) eBPF
    • D) nftables
Show Answer

Answer: C) eBPF

Explanation: Cilium utilizes the Linux kernel's eBPF (extended Berkeley Packet Filter) technology to provide network connectivity, security, and observability for containerized applications.

  1. Which of the following is NOT a main function of a service mesh?
    • A) Service discovery
    • B) Load balancing
    • C) Providing persistent storage
    • D) Encrypted communication
Show Answer

Answer: C) Providing persistent storage

Explanation: A service mesh is an infrastructure layer that manages communication between microservices, providing features such as service discovery, load balancing, encryption, authentication, authorization, and observability. Providing persistent storage is not a main function of a service mesh.

  1. Which service type in Kubernetes provides an alias for an external service?
    • A) ClusterIP
    • B) NodePort
    • C) LoadBalancer
    • D) ExternalName
Show Answer

Answer: D) ExternalName

Explanation: ExternalName services provide an alias for an external service. This service type maps a DNS name to the DNS name of an external service.

Short Answer Questions ​

  1. What is the name of the resource in Kubernetes that stores the IP addresses and ports of pods pointed to by a service?
Show Answer

Answer: EndpointSlice

Explanation: EndpointSlices store Service backend addresses and ports. The controller manages them for selector-based Services. Legacy Endpoints serve a similar purpose but are deprecated since v1.33.

  1. What is the name of the ingress controller used to provision Application Load Balancers in AWS EKS?
Show Answer

Answer: AWS Load Balancer Controller

Explanation: AWS Load Balancer Controller is an ingress controller used to provision Application Load Balancers in AWS EKS. This controller converts Kubernetes Ingress resources into AWS ALBs.

  1. What is the name of the pod DNS policy in Kubernetes that inherits the DNS settings of the node where the pod is running?
Show Answer

Answer: Default

Explanation: The Default DNS policy inherits the DNS settings of the node where the pod is running. This means using the node's /etc/resolv.conf file as-is for the pod.

  1. What is the name of Cilium's observability layer that uses eBPF to monitor network flows and troubleshoot issues?
Show Answer

Answer: Hubble

Explanation: Hubble is Cilium's observability layer that uses eBPF to monitor network flows and troubleshoot issues. Hubble provides features such as network flow monitoring, service dependency mapping, security observation, performance analysis, and troubleshooting.

  1. What is the name of the resource in Kubernetes that is a scalable alternative to Endpoints, providing better performance in large clusters?
Show Answer

Answer: EndpointSlice

Explanation: EndpointSlice is a scalable alternative to Endpoints, providing better performance in large clusters. EndpointSlice improves performance for large services by splitting endpoints into multiple slices for management.

Advanced Questions ​

  1. Explain how a service mesh (e.g., Istio) is used to manage communication between microservices in Kubernetes and its benefits.
Show Answer

Answer:

A service mesh is an infrastructure layer that manages communication between microservices, implemented in the following ways:

  1. Sidecar pattern: Proxy containers (e.g., Envoy) are injected into each pod to intercept and control all network traffic.

  2. Control plane: A centralized management component (e.g., Istio's istiod) configures and manages all sidecar proxies.

  3. Traffic management:

yaml
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
    - reviews
  http:
    - match:
      - headers:
          end-user:
            exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
      - destination:
          host: reviews
          subset: v1
  1. Security policies:
yaml
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
    - from:
      - source:
          principals: ["cluster.local/ns/default/sa/sleep"]
      to:
        - operation:
            methods: ["GET"]
            paths: ["/info*"]

Benefits:

  1. Traffic management: Supports advanced routing, load balancing, traffic splitting, canary deployments, and more.

  2. Security: Provides mutual TLS (mTLS) encryption, authentication, and authorization between services.

  3. Observability: Monitors communication between services through distributed tracing, metric collection, and logging.

  4. Resilience: Improves system resilience through circuit breakers, retries, timeouts, and fault injection.

  5. Policy enforcement: Can apply policies such as rate limiting, quotas, and access control.

  6. Platform independence: These features can be added without changing application code.

Service meshes abstract the complexity of inter-service communication in complex microservice architectures, allowing developers to focus on business logic.

  1. Explain the benefits that Cilium's eBPF technology provides compared to traditional networking approaches (e.g., iptables), and suggest ways to optimize Cilium in AWS EKS.
Show Answer

Answer:

Benefits of Cilium's eBPF Technology:

  1. Performance: eBPF runs directly within the kernel to optimize packet processing paths, providing much higher performance than iptables. In particular, while iptables performs linear searches when there are many rules, eBPF can use efficient data structures like hash tables.

  2. Scalability: eBPF maintains consistent performance even in large clusters. iptables performance degrades rapidly as the number of rules increases.

  3. Programmability: eBPF can be programmed in a C-like language, enabling implementation of complex networking logic. iptables only supports a limited set of rules.

  4. Observability: eBPF can collect detailed metrics about network flows, useful for troubleshooting and performance optimization.

  5. L7 policy: Cilium combines eBPF with userspace Envoy for HTTP/L7 inspection; this work is not entirely in kernel eBPF.

Ways to Optimize Cilium in AWS EKS:

  1. Select IPAM and routing deliberately: AWS VPC CNI chaining keeps aws-node; Cilium ENI mode requires EC2 permissions and a controlled transition of ENI ownership. Use the chapter's reviewed Helm values and official installation procedure.

  2. Size node networking: Check actual instance ENI/IP limits, subnet capacity, and Pod density; an instance family name alone is not sufficient.

  3. Measure before tuning: Current Helm values use routingMode: native and boolean kubeProxyReplacement: true where appropriate, not removed tunnel=disabled or kubeProxyReplacement=strict. Replacement also needs API-server connectivity and a migration plan. DSR and XDP require compatible AWS networking, NIC/kernel support, and measured validation; enabling every setting is not a universal optimization recipe.

  4. Enable Hubble:

bash
cilium hubble enable --ui

Enable Hubble to provide network flow monitoring and troubleshooting capabilities.

  1. Cross-cluster connectivity: Configure Cilium Cluster Mesh to provide seamless networking between multiple EKS clusters.

  2. Monitoring integration: Set up Prometheus and Grafana to collect and visualize Cilium metrics.

These optimizations can maximize Cilium's performance, security, and observability in AWS EKS.

Conclusion ​

Through this quiz, you tested your understanding of Kubernetes services and networking. Concepts covered include service types, Ingress, network policies, service discovery, CoreDNS, and Cilium. Understanding and utilizing these concepts enables you to build secure and scalable Kubernetes applications.