ANS-C01 Question 92
Select 2You are managing a Kubernetes cluster running on Amazon EKS and need to expose a pod-based application to external traffic using an Application Load Balancer (ALB). The cluster has the AWS Load Balancer Controller installed. What steps must you take to ensure that the ALB is provisioned and the application is accessible?
- A
Annotate the Kubernetes service with the 'service.beta.kubernetes.io/aws-load-balancer-type: external' annotation.
- B
Create an Ingress resource in the cluster with the appropriate rules for routing traffic to the application.
- C
Ensure the IAM role associated with the AWS Load Balancer Controller has the necessary permissions to manage ALB resources.
- D
Configure a Kubernetes NodePort service to expose the application to the ALB.
- E
Enable the 'alb.ingress.kubernetes.io/scheme: internal' annotation to allow public access to the ALB.
Show answer and explanation
Correct answers: B, C
Explanation
When using the AWS Load Balancer Controller to expose Kubernetes applications to external traffic, you must create an Ingress resource to define the routing rules and ensure that the controller has the necessary IAM permissions to manage ALB resources. The controller does not require a NodePort service, and the correct annotations must be used for proper configuration. Misconfiguring annotations or IAM policies can lead to failure in provisioning the ALB or exposing the application.
- A. Incorrect.
This option is incorrect because the correct annotation for provisioning an ALB with the AWS Load Balancer Controller is 'service.kubernetes.io/aws-load-balancer-type: alb', not 'service.beta.kubernetes.io/aws-load-balancer-type: external'.
- B. Correct.
This option is correct because creating an Ingress resource is required when using the AWS Load Balancer Controller to define routing rules for traffic to the application.
- C. Correct.
This option is correct because the AWS Load Balancer Controller requires an IAM role with permissions to manage ALB resources, such as creating, updating, and deleting ALBs.
- D. Incorrect.
This option is incorrect because the AWS Load Balancer Controller does not rely on a NodePort service to expose applications. Instead, it uses the Ingress resource for routing traffic.
- E. Incorrect.
This option is incorrect because the 'alb.ingress.kubernetes.io/scheme' annotation is used to specify whether the ALB is internal or internet-facing, but 'internal' would restrict public access, not allow it.