Linux Foundation Kubernetes Administrator CKA Questions & Answers

• Question 51:

  CORRECT TEXT

  

  Task

  Scale the deployment presentation to 6 pods.

  Correct Answer: Check the answer in explanation.

  kubectl get deployment kubectl scale deployment.apps/presentation --replicas=6

• Question 52:

  CORRECT TEXT

  Task

  

  Create a new PersistentVolumeClaim

  1.

  Name: pv-volume

  2.

  Class: csi-hostpath-sc

  3.

  Capacity: 10Mi

  Create a new Pod which mounts the PersistentVolumeClaim as a volume:

  1.

  Name: web-server

  2.

  Image: nginx

  3.

  Mount path: /usr/share/nginx/html

  Configure the new Pod to have ReadWriteOnce access on the volume.

  Finally, using kubectl edit or kubectl patch expand the PersistentVolumeClaim to a capacity of 70Mi and record that change.

  Correct Answer: Check the answer in explanation.

  Solution:

  vi pvc.yaml storageclass pvc apiVersion: v1 kind: PersistentVolumeClaim metadata: name: pv-volume spec: accessModes:

  -ReadWriteOnce volumeMode: Filesystem resources: requests: storage: 10Mi storageClassName: csi-hostpath-sc

  # vi pod-pvc.yaml apiVersion: v1 kind: Pod metadata: name: web-server spec: containers:

  -name: web-server

  image: nginx

  volumeMounts:

  -mountPath: "/usr/share/nginx/html"

  name: my-volume

  volumes:

  -name: my-volume

  persistentVolumeClaim:

  claimName: pv-volume

  # craete

  kubectl create -f pod-pvc.yaml

  #edit

  kubectl edit pvc pv-volume --record

• Question 53:

  CORRECT TEXT

  

  Context

  You have been asked to create a new ClusterRole for a deployment pipeline and bind it to a specific ServiceAccount scoped to a specific namespace.

  Task

  Create a new ClusterRole named deployment-clusterrole, which only allows to create the following resource types:

  1.

  Deployment

  2.

  StatefulSet

  3.

  DaemonSet

  Create a new ServiceAccount named cicd-token in the existing namespace app-team1.

  Bind the new ClusterRole deployment-clusterrole lo the new ServiceAccount cicd-token , limited to the namespace app-team1.

  Correct Answer: Check the answer in explanation.

  Task should be complete on node k8s -1 master, 2 worker for this connect use command [student@node-1] > ssh k8s kubectl create clusterrole deployment-clusterrole --verb=create -- resource=deployments,statefulsets,daemonsets kubectl create serviceaccount cicd-token --namespace=app-team1 kubectl create rolebinding deployment-clusterrole --clusterrole=deployment-clusterrole -- serviceaccount=default:cicd-token --namespace=app-team1

• Question 54:

  CORRECT TEXT

  

  Context An existing Pod needs to be integrated into the Kubernetes built-in logging architecture (e.g.kubectl logs). Adding a streaming sidecar container is a good and common way to accomplish this requirement. Task

  Add a sidecar container named sidecar, using the busybox Image, to the existing Pod big- corp-app. The new sidecar container has to run the following command:

  /bin/sh -c tail -n+1 -f /va r/log/big-corp-app.log Use a Volume, mounted at /var/log, to make the log file big-corp-app.log available to the sidecar container.

  

  Correct Answer: Check the answer in explanation.

  # kubectl get pod big-corp-app -o yaml # apiVersion: v1 kind: Pod metadata: name: big-corp-app spec: containers:

  -name: big-corp-app

  image: busybox

  args:

  -/bin/sh

  - -c

  ->

  i=0;

  while true;

  do

  echo "$(date) INFO $i" >> /var/log/big-corp-app.log; i=$((i+1));

  sleep 1;

  done

  volumeMounts:

  -

  name: logs

  mountPath: /var/log

  -

  name: count-log-1

  image: busybox

  args: [/bin/sh, -c, 'tail -n+1 -f /var/log/big-corp-app.log'] volumeMounts:

  -

  name: logs

  mountPath: /var/log

  volumes:

  -

  name: logs

  emptyDir: {

  }

  # kubectl logs big-corp-app -c count-log-1

• Question 55:

  CORRECT TEXT

  

  Task

  Reconfigure the existing deployment front-end and add a port specification named http exposing port 80/tcp of the existing container nginx. Create a new service named front-end-svc exposing the container port http.

  Configure the new service to also expose the individual Pods via a NodePort on the nodes on which they are scheduled.

  Correct Answer: Check the answer in explanation.

  kubectl get deploy front-end kubectl edit deploy front-end -o yaml #port specification named http #service.yaml apiVersion: v1 kind: Service metadata: name: front-end-svc labels: app: nginx spec: ports:

  -port: 80 protocol: tcp name: http selector: app: nginx type: NodePort # kubectl create -f service.yaml # kubectl get svc

  # port specification named http kubectl expose deployment front-end --name=front-end-svc --port=80 --tarport=80 -- type=NodePort

• Question 56:

  CORRECT TEXT

  

  Task

  Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.

  Further ensure that the new NetworkPolicy:

  1.

  does not allow access to Pods, which don't listen on port 9000

  2.

  does not allow access from Pods, which are not in namespace my-app

  Correct Answer: Check the answer in explanation.

  #network.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata:

  name: allow-port-from-namespace

  namespace: internal

  spec:

  podSelector:

  matchLabels: {

  }

  policyTypes:

  -Ingress ingress:

  -from:

  -podSelector: {

  } ports:

  -protocol: TCP port: 8080 #spec.podSelector namespace pod kubectl create -f network.yaml

• Question 57:

  CORRECT TEXT

  

  Task

  Check to see how many nodes are ready (not including nodes tainted NoSchedule ) and write the number to /opt/KUSC00402/kusc00402.txt.

  Correct Answer:

  kubectl describe nodes | grep ready|wc -l kubectl describe nodes | grep -i taint | grep -i noschedule |wc -l echo 3 > /opt/KUSC00402/kusc00402.txt

  # kubectl get node | grep -i ready |wc -l # taintsnoSchedule kubectl describe nodes | grep -i taints | grep -i noschedule |wc -l # echo 2 > /opt/KUSC00402/kusc00402.txt

• Question 58:

  CORRECT TEXT

  

  Task

  Given an existing Kubernetes cluster running version 1.20.0, upgrade all of the Kubernetes control plane and node components on the master node only to version 1.20.1.

  Be sure to drain the master node before upgrading it and uncordon it after the upgrade.

  

  You are also expected to upgrade kubelet and kubectl on the master node.

  

  Correct Answer:

  [student@node-1] > ssh ek8s kubectl cordon k8s-master kubectl drain k8s-master --delete-local-data --ignore-daemonsets --force apt-get install kubeadm=1.20.1-00 kubelet=1.20.1-00 kubectl=1.20.1-00 -- disableexcludes=kubernetes kubeadm upgrade apply 1.20.1 --etcd-upgrade=false systemctl daemon-reload systemctl restart kubelet kubectl uncordon k8s-master

• Question 59:

  CORRECT TEXT

  

  Task

  Create a new nginx Ingress resource as follows:

  1.

  Name: ping

  2.

  Namespace: ing-internal

  3.

  Exposing service hi on path /hi using service port 5678

  

  Correct Answer:

  vi ingress.yaml # apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: ping namespace: ing-internal spec: rules:

  -http: paths:

  -path: /hi pathType: Prefix backend: service: name: hi port: number: 5678 # kubectl create -f ingress.yaml

• Question 60:

  CORRECT TEXT

  

  Task

  Create a persistent volume with name app-data , of capacity 1Gi and access mode ReadOnlyMany. The type of volume is hostPath and its location is /srv/app-data .

  Correct Answer:

  #vi pv.yaml apiVersion: v1 kind: PersistentVolume metadata: name: app-config spec: capacity: storage: 1Gi accessModes:

  -ReadOnlyMany hostPath: path: /srv/app-config # kubectl create -f pv.yaml