ANS-C01 Question 93
Select 3You are deploying an HTTPS service on an Amazon EKS cluster and want to use the AWS Load Balancer Controller to provision an Application Load Balancer (ALB) automatically. Which of the following configurations and steps must you ensure for a successful deployment?
- A
The Kubernetes Ingress resource must have proper annotations specifying ALB-specific configurations.
- B
A TLS certificate must be created and associated with the ALB using AWS Certificate Manager (ACM).
- C
The AWS Load Balancer Controller must be installed in the EKS cluster with the necessary IAM permissions.
- D
The Kubernetes Service type for the application must be set to 'NodePort' to connect to the ALB.
- E
The EKS worker nodes must have public IPs for the ALB to function properly.
Show answer and explanation
Correct answers: A, B, C
Explanation
To use the AWS Load Balancer Controller in an Amazon EKS cluster, specific configurations such as Ingress annotations, a valid TLS certificate for HTTPS, and the installation of the controller with proper IAM permissions are necessary. These ensure that the ALB can be provisioned and managed correctly. However, the worker nodes do not need public IPs, and the service type does not need to be 'NodePort,' as the ALB handles traffic routing using the Kubernetes Ingress resource.
- A. Correct.
Correct. The Kubernetes Ingress resource requires specific annotations (e.g., 'alb.ingress.kubernetes.io/scheme') to define ALB behavior.
- B. Correct.
Correct. For HTTPS traffic, a valid TLS certificate is required, which can be managed using AWS Certificate Manager and associated with the ALB.
- C. Correct.
Correct. The AWS Load Balancer Controller must be installed in the cluster, and it needs the appropriate IAM permissions to provision and manage the ALB.
- D. Incorrect.
Incorrect. The application service type does not need to be 'NodePort.' The ALB uses the Ingress resource to route traffic to the appropriate Kubernetes services, which can be of type 'ClusterIP.'
- E. Incorrect.
Incorrect. The ALB does not rely on EKS worker nodes having public IPs. Instead, it uses the VPC networking and security groups to manage traffic.