Explanation
This is not how they should be distributed across three datacenters or availability zones, because having one manager in one datacenter or availability zone creates a single point of failure and reduces the fault tolerance of the swarm. According to the official documentation, managers should be distributed evenly across datacenters or availability zones to ensure that the swarm can survive the loss of any one datacenter or availability zone.
References: https://docs.docker.com/engine/swarm/admin_guide/#add-manager-nodes-for-fault-tolerance

Explanation
The networkPolicy will block this traffic because it only allows ingress traffic from pods that have the tier: api label. Pods that have the tier: backend label do not match this selector and are therefore denied access to pods that have the tier: frontend label.
References:
https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource

Explanation
his is not a way to accomplish this, because creating one pod and adding all the resources needed for each application is not a good practice for deploying applications in Kubernetes. According to the official documentation, pods are not intended to run multiple instances of an application or different applications that are tightly coupled. Pods are also not meant to hold resources that are shared across applications, such as secrets or configMaps.
References: https://kubernetes.io/docs/concepts/workloads/pods/#what-is-a-pod

Explanation
This is not how a user can prevent an image from being overwritten by another user with push access to the repository, because making all tags in the repository immutable will also prevent the user from updating their own image tags. According to the official documentation, a better way to prevent an image from being overwritten is to use promotion policies that only allow certain users or teams to push images with specific tags.
References: https://docs.docker.com/ee/dtr/user/promotion-policies/overview/

Explanation
The networkPolicy will block this traffic. A networkPolicy is a Kubernetes resource that defines how pods are allowed to communicate with each other and with other network endpoints. A networkPolicy has two main sections: podSelector and policyTypes. The podSelector selects which pods the networkPolicy applies to. The policyTypes specifies whether the networkPolicy affects ingress (incoming) traffic, egress (outgoing) traffic, or both. In this case, the networkPolicy applies to pods that have a label app: webserver and affects both ingress and egress traffic. The networkPolicy also has two optional sections: ingress and egress. The ingress section defines the rules for allowing ingress traffic to the selected pods. The egress section defines the rules for allowing egress traffic from the selected pods. If either section is missing or empty, it means that no traffic of that type is allowed. In this case, the networkPolicy has an empty ingress section, which means that no ingress traffic is allowed to the pods that have a label app: webserver. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by this networkPolicy, since it is an ingress traffic to a pod that has a label app: webserver. References:
https://kubernetes.io/docs/concepts/services-networking/network-policies/,
https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#networkpolicy-v1-networking-k8s-io