kubectl configuration for EKS in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the purpose of aws eks update-kubeconfig

What is the main purpose of running the command aws eks update-kubeconfig --name cluster_name?

A It upgrades the EKS cluster to the latest Kubernetes version.

B It deploys the Kubernetes cluster on AWS EKS.

C It deletes the existing kubeconfig file from the local machine.

D It creates or updates the local kubeconfig file with cluster access details for kubectl.

💡 Hint

Think about what kubectl needs to connect to a cluster.

The aws eks update-kubeconfig command fetches cluster details and updates the local kubeconfig file so kubectl can communicate with the EKS cluster.

❓ Configuration

intermediate

Correct kubectl context after updating kubeconfig

After running aws eks update-kubeconfig --name my-cluster, which command correctly switches kubectl to use the new EKS cluster context?

A kubectl config use-context my-cluster

B kubectl switch context my-cluster

C kubectl set context my-cluster

D kubectl config set-context default

💡 Hint

Look for the correct kubectl command to change context.

The kubectl config use-context command switches kubectl to the specified cluster context. The context name for EKS is usually the cluster name.

❓ Architecture

advanced

Role of IAM in kubectl authentication for EKS

Which statement best describes how IAM roles are used when configuring kubectl to access an EKS cluster?

A IAM roles provide temporary credentials that kubectl uses to authenticate with the EKS API server via the aws-iam-authenticator.

B IAM roles are not involved; kubectl uses static tokens stored in kubeconfig for authentication.

C IAM roles directly replace Kubernetes service accounts for pod permissions.

D IAM roles are only used for EC2 instances, not for kubectl access.

💡 Hint

Think about how AWS secures API access with temporary credentials.

kubectl uses the aws-iam-authenticator plugin which leverages IAM roles to generate temporary tokens for authenticating to the EKS API server.

❓ security

advanced

Securing kubeconfig file for EKS access

What is the best practice to secure your kubeconfig file that contains EKS cluster access information?

A Disable authentication in the kubeconfig file to simplify access.

B Share the kubeconfig file with all team members via email for easy access.

C Set file permissions to allow only the owner to read and write the kubeconfig file.

D Store the kubeconfig file in a public cloud storage bucket for backup.

💡 Hint

Think about who should have access to sensitive credentials.

Restricting kubeconfig file permissions prevents unauthorized users from accessing cluster credentials, enhancing security.

❓ service_behavior

expert

Effect of changing cluster endpoint in kubeconfig

If you manually edit the kubeconfig file to change the EKS cluster endpoint to an incorrect URL, what will happen when you run kubectl get pods?

A kubectl will connect to the wrong cluster and show pods from that cluster.

B kubectl will fail to connect and return a connection error.

C kubectl will ignore the endpoint and use a cached connection.

D kubectl will automatically correct the endpoint to the original URL.

💡 Hint

Consider what happens if the API server address is wrong.

kubectl relies on the endpoint URL to connect to the cluster API server. An incorrect URL causes connection failure.