ACloudGuru - Chapter 3: Container Orchestration

Question 1

**What is a Container Runtime?

What is the CRI?

What are two examples of container runtimes that implement the CRI standard?**

Answer 1

A piece of software responsible for actually
running containers.

Standard protocol for
communication between kubelet and the container runtime.

CRI-O and containerd.

Question 2

What are the 4 C’s of Cloud Native Security?

Answer 2

Cloud, Clusters, Containers, and Code. As you go from left to right, you gain responsibility and control.

Question 3

What are 3 common ways of authenticating to the Kubernetes cluster?

Answer 3

Client Certificates: API Server uses a signed X509 client certificate.

Bearer Token: <>

OpenID Connect: Uses a JSON Web Token (JWT) signed by an external identity provider to authenticate a user.

Question 4

What opensource tool can integrate with the Kubernetes API to enable the creation of API policies?

Answer 4

OPA Gatekeeper

Question 5

<Networking>
</Networking>

Question 6

Define a Service

Answer 6

Kubernetes resource that exposes a Pod(s) as a network service.

Question 7

What are 4 common Services?

Answer 7

ClusterIP: Expose internally within the cluster network.

NodePort: Expose externally on a port on each Node. Not best practice to use.

LoadBalancer: Expose using a cloud provider’s load balancer. Relies on cloud controller manager for load balancer. Layer 3 or 4.

ExternalName: Provide a DNS name for an external service.

Question 8

What is a Headless Service?

Answer 8

A Service with no cluster IP address.

Question 9

What are the 2 main service discovery methods in Kubernetes?

Answer 9

DNS and environment variables.

Question 10

What is an Ingress?

Answer 10

Exposes an application externally using the ingress controller (Nginx, Cloud Provider LB, etc.) and routes traffic to a Service. It can provide layer 7 functionality like SSL termination and path based routing.

Question 11

How does a Service without a selector discover service targets?

Answer 11

They must be manually configured.

Question 12

Define service mesh?

What are the 2 main components of a service mesh?

Answer 12

A tool that manages communication between
application components, often adding additional functionality, like logging, tracing, or encryption.

Control plane and service proxy/data plane

Question 13

<Storage>
</Storage>