DOP-C02 · Question #334
A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic…
The correct answer is A. Create an IAM OpenID Connect (OIDC) provider for the EKS cluster. AM OpenID Connect (OIDC) provider is a crucial part of the IAM roles for service accounts feature in Amazon EKS, which enables Pod Identity access. With this, you can associate IAM roles with Kubernetes service accounts. This allows pods running in the EKS cluster to securely…
Question
A company is using Amazon Elastic Kubernetes Service (Amazon EKS) to run its applications. The EKS cluster is successfully running multiple pods. The company stores the pod images in Amazon Elastic Container Registry (Amazon ECR). The company needs to configure Pod Identity access for the EKS cluster. The company has already updated the node IAM role by using the permissions for Pod Identity access. Which solution will meet these requirements?
Options
- ACreate an IAM OpenID Connect (OIDC) provider for the EKS cluster.
- BEnsure that the nodes can reach the EKS Auth API. Add and configure the EKS Pod Identity
- CCreate an EKS access entry that uses the API_AND-CONFIG_MAP cluster authentication mode.
- DConfigure the AWS Security Token Service (AWS STS) endpoint for the Kubernetes service
How the community answered
(48 responses)- A71% (34)
- B8% (4)
- C4% (2)
- D17% (8)
Explanation
AM OpenID Connect (OIDC) provider is a crucial part of the IAM roles for service accounts feature in Amazon EKS, which enables Pod Identity access. With this, you can associate IAM roles with Kubernetes service accounts. This allows pods running in the EKS cluster to securely and automatically assume the associated IAM roles and access AWS resources such as ECR. By setting up the OIDC provider, you enable the EKS cluster to use IAM roles for service accounts without needing to configure credentials in containers manually. The OIDC provider enables the Kubernetes service account to assume the role and obtain temporary AWS
Topics
Community Discussion
No community discussion yet for this question.