Linux Foundation CKA Online Practice Questions and Exam Preparation

Linux Foundation CKA Online Questions & Answers

• Question 1:

  SIMULATION

  

  Task

  Schedule a Pod as follows: Name: kucc8 App Containers: 2 Container Name/Images:

  nginx

  consul

  Check the answer in explanation.

  ---

  explanation:

  Solution:

  

  

• Question 2:

  SIMULATION

  

  port: 80

  policyTypes:

  Context

  An existing Pod needs to be integrated into the Kubernetes built-in logging architecture (e.g. kubectl logs). Adding a streaming sidecar container is a good and common way to accomplish this requirement.

  Task

  Add a sidecar container named sidecar, using the busybox image, to the existing Pod big-corp-app. The new sidecar container has to run the following command:

  

  Use a Volume, mounted at /var/log, to make the log file big-corp-app.log available to the sidecar container.

  

  Check the answer in explanation.

  ---

  explanation:

  Solution:

  

  

• Question 3:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000056

  Task

  Review and apply the appropriate NetworkPolicy from the provided YAML samples. Ensure that the chosen NetworkPolicy is not overly permissive, but allows communication between the frontend and backend Deployments, which run in the frontend and backend namespaces respectively. First, analyze the frontend and backend Deployments to determine the specific requirements for the NetworkPolicy that needs to be applied. Next, examine the NetworkPolicy YAML samples located in the ~/netpol folder. Failure to comply may result in a reduced score.

  ❗ Do not delete or modify the provided samples. Only apply one of them.

  Finally, apply the NetworkPolicy that enables communication between the frontend and backend Deployments, without being overly permissive.

  Check the answer in explanation.

  ---

  explanation:

  1. SSH into the correct host

  ssh cka000056

  2. Analyze the Deployments

  Check the labels and ports used by the frontend and backend apps: kubectl get deployments -A -o wide

  kubectl describe deployment frontend -n frontend kubectl describe deployment backend -n backend Pay attention to:

  The labels used by the backend pods (e.g., app=backend)

  The ports exposed by backend containers (e.g., port 80 or 8080)

  The namespace separation: frontend ➝ frontend namespace, backend ➝ backend namespace

  3. Review NetworkPolicy samples

  List available files:

  ls ~/netpol

  Inspect each one:

  cat ~/netpol/.yaml

  You're looking for a NetworkPolicy that:

  Is created in the backend namespace

  Allows incoming connections from pods in the frontend namespace

  Has a specific podSelector (not empty, to avoid being overly permissive)

  Limits access to necessary ports only

  4. Apply the correct NetworkPolicy

  Once you've identified the correct YAML file, apply it:

  kubectl apply -f ~/netpol/.yaml

  Example Clues for the Correct File

  It should look something like this (example only):

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata:

  name: allow-frontend-to-backend namespace: backend spec: podSelector: matchLabels: app: backend ingress:

  -from:

  -namespaceSelector:

  matchLabels:

  name: frontend

  ports:

  -protocol: TCP

  -Ingress

• Question 4:

  SIMULATION

  Quick Reference

  ConfigMaps,

  Documentation Deployments,

  Namespace

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000048b

  Task

  An NGINX Deployment named nginx-static is running in the nginx-static namespace. It is configured using a ConfigMap named nginx-config. First, update the nginx-config ConfigMap to also allow TLSv1.2 connections. You may re-create, restart, or scale resources as necessary. You can use the following command to test the changes:

  [candidate@cka000048b] $ curl --tls-max 1.2 https://web.k8s.local

  Check the answer in explanation.

  ---

  explanation:

  1. SSH into the correct host:

  ssh cka000048b

  2. Edit the ConfigMap

  kubectl edit configmap nginx-config -n nginx-static

  Locate the configuration section that defines allowed protocols, typically under ssl_protocols, and ensure TLSv1.2 is allowed, e.g.:

  ssl_protocols TLSv1.2 TLSv1.3;

  If only TLSv1.3 is present, add TLSv1.2 to the list. Save and exit the editor.

  3. Restart the NGINX pods to apply the updated ConfigMap

  Since NGINX doesn't auto-reload config from a ConfigMap, restart the pods:

  kubectl rollout restart deployment nginx-static -n nginx-static

  OR manually delete pods:

  kubectl delete pod -l app=nginx-static -n nginx-static

  4. Test the connection

  Run:

  curl --tls-max 1.2 https://web.k8s.local

  You should get a valid HTTPS response if TLSv1.2 is accepted.

• Question 5:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000060

  Task

  Install Argo CD in the cluster by performing the following tasks:

  Add the official Argo CD Helm repository with the name argo.

  The Argo CD CRDs have already been pre-installed in the cluster.

  Generate a template of the Argo CD Helm chart version 7.7.3 for the argocd namespace and save it to ~/argo-helm.yaml.

  Configure the chart to not install CRDs.

  Check the answer in explanation.

  ---

  explanation:

  1. SSH into the host

  ssh cka000060

  2. Add the Argo CD Helm repository with the name argo

  helm repo add argo https://argoproj.github.io/argo-helm helm repo update

  3. Generate a template from the Argo CD Helm chart (version 7.7.3), disable CRDs, and save to a YAML file

  helm template argocd argo/argo-cd \ --namespace argocd \ --version 7.7.3 \ --set installCRDs=false \ > ~/argo-helm.yaml

  This command renders the manifest with CRD installation disabled, targeting the correct namespace and version.

  Optional: Verify YAML file is generated

  ls -l ~/argo-helm.yaml head ~/argo-helm.yaml

• Question 6:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh Cka000047

  Task

  A MariaDB Deployment in the mariadb namespace has been deleted by mistake. Your task is to restore the Deployment ensuring data persistence. Follow these steps:

  Create a PersistentVolumeClaim (PVC ) named mariadb in the mariadb namespace with the following specifications:

  Access mode ReadWriteOnce

  Storage 250Mi

  You must use the existing retained PersistentVolume (PV ).

  Failure to do so will result in a reduced score.

  There is only one existing PersistentVolume .

  Edit the MariaDB Deployment file located at ~/mariadb-deployment.yaml to use PVC you created in the previous step.

  Apply the updated Deployment file to the cluster.

  Ensure the MariaDB Deployment is running and stable.

  Check the answer in explanation.

  ---

  explanation:

  Explanation Step 1: SSH into the correct host

  ssh cka000047

  Step 2: Create the PersistentVolumeClaim (PVC)

  Use the specs provided:

  Name: mariadb

  Namespace: mariadb

  Access mode: ReadWriteOnce

  Storage: 250Mi

  # pvc-mariadb.yaml apiVersion: v1 kind: PersistentVolumeClaim metadata:

  name: mariadb namespace: mariadb spec: accessModes:

  -ReadWriteOnce

  resources:

  requests:

  storage: 250Mi

  Apply it:

  kubectl apply -f pvc-mariadb.yaml

  Step 3: Confirm the PVC is bound to the existing retained PV

  kubectl get pv kubectl get pvc -n mariadb

  Ensure the PVC named mariadb is Bound to the only existing Retained PV.

  Step 4: Edit the Deployment YAML file

  Edit ~/mariadb-deployment.yaml and update the volume section to mount the PVC.

  Add inside the spec:

  spec:

  containers:

  -

  name: mariadb

  image: mariadb

  volumeMounts:

  -

  name: mariadb-storage

  mountPath: /var/lib/mysql

  volumes:

  -name: mariadb-storage

  persistentVolumeClaim:

  claimName: mariadb

  Ensure this is placed under spec.template.spec in the deployment file.

  Step 5: Apply the updated Deployment

  kubectl apply -f ~/mariadb-deployment.yaml Step 6: Confirm the Deployment is running and stable kubectl get pods -n mariadb

  kubectl describe pod -n mariadb kubectl get deployment mariadb -n mariadb All pods should be in Running state, and the PVC should remain Bound.

• Question 7:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000051

  Context

  You manage a WordPress application. Some Pods are not starting because resource requests are too high. Your task is to prepare a Linux system for Kubernetes. Docker is already installed, but you need to configure it for kubeadm.

  Task

  Complete these tasks to prepare the system for Kubernetes:

  Set up cri-dockerd: Install the Debian package: ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb Debian packages are installed using dpkg. Enable and start the cri-docker service.

  Configure these system parameters: Set net.bridge.bridge-nf-call-iptables to 1

  Check the answer in explanation.

  ---

  explanation:

  Step 1: SSH into the correct host

  ssh cka000051 Required. Skipping this step results in a zero score.

  Step 2: Install the cri-dockerd Debian package

  sudo dpkg -i ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb If there are dependency issues, fix them with: sudo apt-get install -f

  Step 3: Enable and start the cri-docker service

  sudo systemctl enable cri-docker.service sudo systemctl start cri-docker.service

  Also enable and start the socket (recommended):

  sudo systemctl enable cri-docker.socket sudo systemctl start cri-docker.socket

  Step 4: Set net.bridge.bridge-nf-call-iptables to 1

  Temporarily:

  sudo sysctl net.bridge.bridge-nf-call-iptables=1

  To make it persistent, add this line to /etc/sysctl.conf or create a config file:

  echo "net.bridge.bridge-nf-call-iptables=1" | sudo tee /etc/sysctl.d/k8s.conf

  sudo sysctl --system

  Verification Commands

  # Check cri-docker status

  sudo systemctl status cri-docker.service

  # Check the system parameter

  sysctl net.bridge.bridge-nf-call-iptables

  You should see:

  net.bridge.bridge-nf-call-iptables = 1

• Question 8:

  SIMULATION

  

  Task

  Create a new Ingress resource as follows: Name: echo Namespace : sound-repeater Exposing Service echoserver-service on

  http://example.org/echo using Service port 8080

  The availability of Service

  echoserver-service can be checked

  using the following command, which should return 200 :

  [candidate@cka000024] $ curl -o /de v/null -s -w "%{http_code}\n" http://example.org/echo

  Check the answer in explanation.

  ---

  explanation:

  

  

  

• Question 9:

  SIMULATION You must connect to the correct host. Failure to do so may result in a zero score. [candidate@base] $ ssh cka000058

  Context

  You manage a WordPress application. Some Pods are not starting because resource requests are too high.

  Task

  A WordPress application in the relative-fawn namespace consists of: A WordPress Deployment with 3 replicas.

  Adjust all Pod resource requests as follows: Divide node resources evenly across all 3 Pods. Give each Pod a fair share of CPU and memory.

  Check the answer in explanation.

  ---

  explanation:

  Explanation Step 1: SSH into the correct host

  ssh cka000058 Required. Skipping this step results in a zero score.

  Step 2: Get total node resources (CPU and memory)

  Run:

  kubectl describe node | grep -A5 "Capacity"

  OR

  kubectl get nodes -o jsonpath="{.items[*].status.capacity}"

  Note the values for:

  cpu (e.g., 6 cores)

  memory (e.g., 12Gi = 12288Mi)

  Step 3: Divide node resources by 3 Pods

  Example (assuming node has 6 CPUs and 12Gi memory): CPU per Pod: 2000m Memory per Pod: 4096Mi

  Step 4: Edit the WordPress Deployment in the relative-fawn namespace

  kubectl edit deployment wordpress -n relative-fawn

  In the container spec, set the resource requests (under containers:) like this:

  resources:

  requests:

  cpu: "2000m"

  memory: "4096Mi"

  If there are limits defined, make sure they are equal to or greater than requests.

  Step 5: Save and Exit

  In vi: press Esc, type :wq, and press Enter.

  Step 6: Verify the Pods start successfully

  kubectl get pods -n relative-fawn kubectl describe pod -n relative-fawn

  Ensure all 3 WordPress pods are in Running state and not stuck in Pending.

• Question 10:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh Cka000055

  Task

  Verify the cert-manager application which has been deployed to your cluster .

  Using kubectl, create a list of all cert-manager Custom Resource Definitions (CRDs ) and save it to ~/resources.yaml .

  You must use kubectl 's default output format.

  Do not set an output format.

  Failure to do so will result in a reduced score.

  Using kubectl, extract the documentation for the subject specification field of the Certificate Custom Resource and save it to ~/subject.yaml.

  Check the answer in explanation.

  ---

  explanation:

  Explanation Task Summary

  You need to: SSH into the correct node: cka000055 Use kubectl to list all cert-manager CRDs, and save that list to ~/resources.yaml Do not use any output format flags like -o yaml Extract the documentation for the spec.subject field of the Certificate custom resource and save it to ~/subject.yaml

  Step-by-Step Instructions Step 1: SSH into the node

  ssh cka000055

  Step 2: List cert-manager CRDs and save to a file

  First, identify all cert-manager CRDs:

  kubectl get crds | grep cert-manager

  Then extract them without specifying an output format:

  kubectl get crds | grep cert-manager | awk '{print $1}' | xargs kubectl get crd > ~/resources.yaml

  This saves the default kubectl get output to the required file without formatting flags.

  Step 3: Get documentation for spec.subject in the Certificate CRD

  Run the following command:

  kubectl explain certificate.spec.subject > ~/subject.yaml

  This extracts the field documentation and saves it to the specified file.

  If you're not sure of the resource, verify it exists:

  kubectl get crd certificates.cert-manager.io

  Command Summary

  ssh cka000055 kubectl get crds | grep cert-manager | awk '{print $1}' | xargs kubectl get crd > ~/resources.yaml kubectl explain certificate.spec.subject > ~/subject.yaml