Services and Networking Quiz

This quiz tests your understanding of Kubernetes networking concepts including service types, Ingress, network policies, and service discovery.

Multiple Choice Questions

1. What is the default service type in Kubernetes?
   • A) NodePort
   • B) LoadBalancer
   • C) ClusterIP
   • D) ExternalName

Show Answer

Answer: C) ClusterIP

Explanation: ClusterIP is the default service type in Kubernetes, providing an IP address that is only accessible within the cluster. This service allows other applications within the cluster to access the service, but it cannot be accessed from outside the cluster.

2. Which API object exposes HTTP and HTTPS routes from outside the cluster to services within the cluster?
   • A) Service
   • B) Ingress
   • C) Endpoint
   • D) NetworkPolicy

Show Answer

Answer: B) Ingress

Explanation: Ingress is an API object that exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Ingress provides load balancing, SSL termination, and name-based virtual hosting.

3. Which of the following is NOT a method provided by Kubernetes for service discovery?
   • A) Environment variables
   • B) DNS
   • C) Service Mesh
   • D) ConfigMap

Show Answer

Answer: D) ConfigMap

Explanation: Kubernetes provides two main service discovery methods: environment variables and DNS. ConfigMap is used to store configuration data and is not a service discovery mechanism.

4. Which service type in Kubernetes makes services accessible through a specific port on all nodes?
   • A) ClusterIP
   • B) NodePort
   • C) LoadBalancer
   • D) ExternalName

Show Answer

Answer: B) NodePort

Explanation: NodePort services make services accessible through a specific port on all nodes. This service type allows access to the service through each node's IP address and NodePort value (allocated by default in the range 30000-32767).

5. What type of service has no cluster IP and creates DNS records for each pod?
   • A) NodePort service
   • B) LoadBalancer service
   • C) Headless service
   • D) ExternalName service

Show Answer

Answer: C) Headless service

Explanation: A headless service is a service configured with clusterIP: None, which does not allocate a cluster IP and creates DNS records for each pod. This is useful when clients need to access specific pods behind the service directly.

6. Which resource provides a way to control communication between pods in Kubernetes?
   • A) Service
   • B) Ingress
   • C) NetworkPolicy
   • D) EndpointSlice

Show Answer

Answer: C) NetworkPolicy

Explanation: NetworkPolicy provides a way to control communication between pods. Using network policies, you can restrict ingress and egress traffic between pods.

7. What is used as the DNS server for Kubernetes clusters?
   • A) kube-dns
   • B) CoreDNS
   • C) NodeDNS
   • D) ClusterDNS

Show Answer

Answer: B) CoreDNS

Explanation: CoreDNS is a flexible and extensible DNS server used as the DNS server for Kubernetes clusters. Since Kubernetes 1.11, CoreDNS has been used as the default DNS server.

8. Which Linux kernel technology does Cilium utilize?
   • A) iptables
   • B) netfilter
   • C) eBPF
   • D) nftables

Show Answer

Answer: C) eBPF

Explanation: Cilium utilizes the Linux kernel's eBPF (extended Berkeley Packet Filter) technology to provide network connectivity, security, and observability for containerized applications.

9. Which of the following is NOT a main function of a service mesh?
   • A) Service discovery
   • B) Load balancing
   • C) Providing persistent storage
   • D) Encrypted communication

Show Answer

Answer: C) Providing persistent storage

Explanation: A service mesh is an infrastructure layer that manages communication between microservices, providing features such as service discovery, load balancing, encryption, authentication, authorization, and observability. Providing persistent storage is not a main function of a service mesh.

10. Which service type in Kubernetes provides an alias for an external service?
    • A) ClusterIP
    • B) NodePort
    • C) LoadBalancer
    • D) ExternalName

Show Answer

Answer: D) ExternalName

Explanation: ExternalName services provide an alias for an external service. This service type maps a DNS name to the DNS name of an external service.

Short Answer Questions

1. What is the name of the resource in Kubernetes that stores the IP addresses and ports of pods pointed to by a service?

Show Answer

Answer: Endpoints

Explanation: Endpoints is a resource that stores the IP addresses and ports of pods pointed to by a service. When there are pods matching the service's selector, Kubernetes automatically creates and manages endpoint objects.

2. What is the name of the ingress controller used to provision Application Load Balancers in AWS EKS?

Show Answer

Answer: AWS ALB Ingress Controller

Explanation: AWS ALB Ingress Controller is an ingress controller used to provision Application Load Balancers in AWS EKS. This controller converts Kubernetes Ingress resources into AWS ALBs.

3. What is the name of the pod DNS policy in Kubernetes that inherits the DNS settings of the node where the pod is running?

Show Answer

Answer: Default

Explanation: The Default DNS policy inherits the DNS settings of the node where the pod is running. This means using the node's /etc/resolv.conf file as-is for the pod.

4. What is the name of Cilium's observability layer that uses eBPF to monitor network flows and troubleshoot issues?

Show Answer

Answer: Hubble

Explanation: Hubble is Cilium's observability layer that uses eBPF to monitor network flows and troubleshoot issues. Hubble provides features such as network flow monitoring, service dependency mapping, security observation, performance analysis, and troubleshooting.

5. What is the name of the resource in Kubernetes that is a scalable alternative to Endpoints, providing better performance in large clusters?

Show Answer

Answer: EndpointSlice

Explanation: EndpointSlice is a scalable alternative to Endpoints, providing better performance in large clusters. EndpointSlice improves performance for large services by splitting endpoints into multiple slices for management.

Advanced Questions

1. Explain how a service mesh (e.g., Istio) is used to manage communication between microservices in Kubernetes and its benefits.

Show Answer

Answer:

A service mesh is an infrastructure layer that manages communication between microservices, implemented in the following ways:

1. Sidecar pattern: Proxy containers (e.g., Envoy) are injected into each pod to intercept and control all network traffic.

2. Control plane: A centralized management component (e.g., Istio's istiod) configures and manages all sidecar proxies.

3. Traffic management:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
    - reviews
  http:
    - match:
      - headers:
          end-user:
            exact: jason
      route:
        - destination:
            host: reviews
            subset: v2
    - route:
      - destination:
          host: reviews
          subset: v1

4. Security policies:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
  action: ALLOW
  rules:
    - from:
      - source:
          principals: ["cluster.local/ns/default/sa/sleep"]
      to:
        - operation:
            methods: ["GET"]
            paths: ["/info*"]

Benefits:

1. Traffic management: Supports advanced routing, load balancing, traffic splitting, canary deployments, and more.

2. Security: Provides mutual TLS (mTLS) encryption, authentication, and authorization between services.

3. Observability: Monitors communication between services through distributed tracing, metric collection, and logging.

4. Resilience: Improves system resilience through circuit breakers, retries, timeouts, and fault injection.

5. Policy enforcement: Can apply policies such as rate limiting, quotas, and access control.

6. Platform independence: These features can be added without changing application code.

Service meshes abstract the complexity of inter-service communication in complex microservice architectures, allowing developers to focus on business logic.

2. Explain the benefits that Cilium's eBPF technology provides compared to traditional networking approaches (e.g., iptables), and suggest ways to optimize Cilium in AWS EKS.

Show Answer

Answer:

Benefits of Cilium's eBPF Technology:

1. Performance: eBPF runs directly within the kernel to optimize packet processing paths, providing much higher performance than iptables. In particular, while iptables performs linear searches when there are many rules, eBPF can use efficient data structures like hash tables.

2. Scalability: eBPF maintains consistent performance even in large clusters. iptables performance degrades rapidly as the number of rules increases.

3. Programmability: eBPF can be programmed in a C-like language, enabling implementation of complex networking logic. iptables only supports a limited set of rules.

4. Observability: eBPF can collect detailed metrics about network flows, useful for troubleshooting and performance optimization.

5. L7 awareness: eBPF can recognize up to the application layer (L7), allowing fine-grained policies for protocols such as HTTP, gRPC, and Kafka.

Ways to Optimize Cilium in AWS EKS:

1. Enable AWS ENI mode:

helm install cilium cilium/cilium \
   --namespace kube-system \
   --set eni.enabled=true \
   --set ipam.mode=eni \
   --set egressMasqueradeInterfaces=eth0 \
   --set tunnel=disabled

This configuration leverages AWS Elastic Network Interfaces (ENI) to assign VPC-native IP addresses to pods and provides VPC-native networking without overlay networks.

2. Node group optimization:

• Choose instance types that provide sufficient ENIs and IP addresses (e.g., m5.large or larger)
• Configure appropriate maximum pod count (varies by instance type)

3. Performance optimization:

helm install cilium cilium/cilium \
   --namespace kube-system \
   --set eni.enabled=true \
   --set ipam.mode=eni \
   --set tunnel=disabled \
   --set bpf.masquerade=true \
   --set kubeProxyReplacement=strict \
   --set loadBalancer.mode=dsr \
   --set loadBalancer.acceleration=native

This configuration replaces kube-proxy and enables Direct Server Return (DSR) mode and native load balancing acceleration.

4. Enable Hubble:

helm upgrade cilium cilium/cilium \
   --namespace kube-system \
   --reuse-values \
   --set hubble.enabled=true \
   --set hubble.relay.enabled=true \
   --set hubble.ui.enabled=true

Enable Hubble to provide network flow monitoring and troubleshooting capabilities.

5. Cross-cluster connectivity: Configure Cilium Cluster Mesh to provide seamless networking between multiple EKS clusters.

6. Monitoring integration: Set up Prometheus and Grafana to collect and visualize Cilium metrics.

These optimizations can maximize Cilium's performance, security, and observability in AWS EKS.

Conclusion

Through this quiz, you tested your understanding of Kubernetes services and networking. Concepts covered include service types, Ingress, network policies, service discovery, CoreDNS, and Cilium. Understanding and utilizing these concepts enables you to build secure and scalable Kubernetes applications.