Containers and Kubernetes

Question 1

Your company wants to deploy an Azure Kubernetes cluster. Azure AD users need to authenticate to the cluster using Azure AD creds. 3 Steps:

Answer 1

1. Create a server application: to provide Azure AD authentication for an AKS cluster, two applications are created. The first is a server component that provices user authentication.
2. Create the client application: this client application uses the server application for the actual authentication of the credentials provided by the client
3. Deploy the AKS cluster
4. Create an RBAC binding - before you use an Azure AD account with an AKS cluster, you must create role-binding or cluster role-binding. Bindings apply them to desired users. These assignments can be applied to a given namespace, or acros the entire cluster

Question 2

Kubernetes RBAC

Answer 2

Allows for grandular filtering of user actions within an AKS cluster

Question 3

Role-Bindings

Answer 3

grant permissions defined in a role to Azure AD users to perform actions within the cluster

Question 4

Cluster-Role Bindings

Answer 4

grant that acces cluster wide

Question 5

Ways to ensure the use of trusted container images

Answer 5

Azure Container Registry and Docker Trusted Registry

Question 6

Azure Container Registry Roles

Answer 6

ArcPush: can push an image and Pull (Contributor role can also Push images!)

ArcPull: can pull an image only

ArcSign is the only one that can sign an image

Reader: Can only do ARM things

Question 7

When integrated with Azure AD authentication, AKS clusters utilize OpenID Connect

Answer 7

Azure AD integrated allows for secure access control to Kubernetes resources in AKS cluster by using user identities or directory group memberships

Question 8

Ingress controller

Answer 8

a pieve of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes service

Question 9

Container Network Interface plug-in

Answer 9

-This is to connect Docker containers to the host-VMs VNet. the plug in supports both Linux and Windows.
-The plug in assigns IP addresses from a VNet to containers brought up in the VM, attaching them to the VNet, and connecting them directly to other containers and VNet resources

Question 10

Container Groups

Answer 10

a collection of containers that get scheduled on the same host machine. The containers in the container group share a lifecycle, resources, local network, and storage volumes. It is a similar concept to a pod in Kubernetes.