An airline runs its booking microservices on an Amazon EKS cluster. A CodeBuild project builds each service's image and then runs kubectl commands to roll the new image out to a namespace called bookings.
The pipeline's IAM role currently maps to cluster-admin through a hand-edited aws-auth ConfigMap, and the security team wants that role limited to the bookings namespace without any long-lived Kubernetes tokens. Deployments also cause short outages, because the current manifest removes every old pod before the new ones pass their readiness probes.
The rollout should keep at least the current number of healthy pods serving requests during each release.
Which TWO changes meet these requirements? (Choose two.)
Choose two answers.
AA. Store a Kubernetes service account token for the cluster-admin role in AWS Secrets Manager, and have the build fetch it at run time so that kubectl can apply manifests in any namespace.
BB. Create an EKS access entry for the pipeline role and attach an access policy scoped to the bookings namespace, so the role can deploy there and nowhere else, with no aws-auth edits.
CC. Change the Deployment to use the Recreate strategy, so that all old pods stop before the new ones start, and let the pipeline apply the manifest with a shorter timeout.
DD. Set the Deployment's rolling update to a maxUnavailable of zero and a maxSurge of one, and define readiness probes so that a new pod receives traffic only after it passes its checks.
EE. Add a CronJob that restarts every bookings pod each night and remove the readiness probes, so that stale pods are replaced before peak hours and unready pods are not a concern.
Show the answer and explanation
Answers: B, D
A. Wrong: A long-lived cluster-admin token is the opposite of what the security team asked for, and it reaches every namespace. Storing it in Secrets Manager does not reduce that access. Learn more: What is AWS Secrets Manager? (opens in a new tab)
B. Right: Correct. EKS access entries map IAM principals to Kubernetes access without editing the aws-auth ConfigMap, and an access policy can be limited to one namespace. The pipeline keeps working in bookings and cannot change other namespaces. Learn more: Associate access policies with access entries (opens in a new tab)
C. Wrong: Recreate removes every old pod before creating new ones, which causes the outage the airline wants to end. A shorter timeout does not change how many pods serve traffic.
D. Right: Correct. With maxUnavailable at zero, Kubernetes keeps every current pod running until a replacement is ready, and readiness probes keep unready pods out of service. Together they keep the healthy pod count at its current level during each release.
E. Wrong: Restarts add outages on their own schedule. Removing readiness probes also lets unready pods receive traffic, which makes each release less safe.
Explanation
Access entries let an IAM role receive Kubernetes permissions limited to one namespace, without shared tokens or hand-edited aws-auth data. A rolling update with maxUnavailable set to zero, plus readiness probes, keeps existing healthy pods in service until new ones pass their checks. Cluster-admin tokens and the Recreate strategy each miss one of the requirements.
Want more on Deployments for ECS and EKS? The 5 full-length practice sets have 8 more Deployments for ECS and EKS questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →