Kubernetes Administrator (CKA) Practice Questions: Second Edition Part 2

Which uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API?

When you access the cluster (for example, using kubectl), you are authenticated by the apiserver as a particular User Account currently. It is usually admin unless your cluster administrator has customized your cluster. Processes running within pods can also communicate with the apiserver. When they do, they are authenticated as a particular _______?

Which pipeline provides a limited set of metrics related to cluster components such as the Horizontal Pod Autoscaler controller, as well as the kubectl top utility? These metrics are gathered by the lightweight, in-memory metrics-server and made available via the metrics.k8s.io API.

An RBAC contains which rules that represent a set of permissions? Permissions are purely additive (there are no “deny” rules).

Which is a command-line tool that allows you to interact with Kubernetes. kubectl uses the Kubernetes API to communicate with the cluster and carry out your commands. You can use that to deploy applications, inspect and manage cluster resources, and view logs?

Which is the default scheduler for Kubernetes and runs as part of the control plane? It is designed so that, if you want and need to, you can write your scheduling component and use that instead.

Which is the simplest recommended form of node selection constraint that is a field of PodSpec? It specifies a map of key-value pairs, and for the pod to be eligible to run on a node, the node must have each indicated key-value pairs as labels (it can have additional labels). The most common usage is one key-value pair.

Which of the following is the simplest form of node selection constraint, but it is typically not used due to its limitations? It is also a field of PodSpec. If it is not empty, the scheduler disregards the pod and the kubelet running on the identified node attempts to run it. Thus, if that is provided in the PodSpec, does it take precedence over the above methods for node selection?

Which of the following ensures that all or some Nodes run a copy of a Pod? Pods are added to nodes when they are added to the cluster. Pods are trash collected as nodes are removed from the cluster. Thus, deleting it cleans up the Pods it created.

Which of the following are controlled directly by the kubelet daemon on a single node rather than through the API server? Unlike Pods handled by the control plane (for example, a Deployment), the kubelet instead monitors each static Pod and restarts it if it fails?

The kubelet automatically creates a __________ on the Kubernetes API server for each static Pod. It means that the Pods running on a node are visible on the API server but cannot be controlled from there. The Pod names are suffixed with the node hostname with a leading hyphen

Which of the following provides declarative updates for Pods and ReplicaSets? You describe the desired state, and the Deployment Controller changes the actual state to the desired state at a controlled rate. You can choose whether to construct new ReplicaSets or delete current Deployments and replace them with new Deployments.

Whose purpose is to maintain a stable set of replica Pods running at any given time? Is it frequently used to ensure the availability of a certain quantity of identical Pods?

Which of the following are used for identifying and selecting a specific group of objects using their labels?

Which key-value pairs are attached to Kubernetes objects, e.g., Pods and ReplicaSets?

Which of the following is enabled in your cluster, so you can set up an autoscaler for your Deployment and choose the minimum and maximum number of Pods you want to run based on the CPU utilization of your existing Pods.

RollingUpdate Deployments support multiple running versions of an application at the same time. When you or an autoscaler scales a RollingUpdate Deployment in the middle of a rollout (either in progress or paused), the Deployment controller balances the additional replicas in the existing active ReplicaSets (ReplicaSets with Pods) to mitigate risk. Which of the following scaling is this called?

Which are specifications for creating Pods and are included in workload resources such as Deployments, Jobs, and DaemonSets?

Which of the following creates one or more Pods to perform a given task? This object takes responsibility for Pod failures and ensures that the work at hand is accomplished. When the work is finished, all of the Pods immediately terminate.

Which is an algorithm-based controller API resource that automatically adjusts the number of replicas in a ReplicaSet, Deployment, or Replication Controller based on CPU utilization?

Which is selected by passing Kubelet the –network-plugin=cni command-line option. Kubelet reads a file from –cni-conf-dir (default /etc/cni/net.d) and uses which configuration from that file to set up each pod’s network?

Besides providing the interface to configure and clean up pod networking, the plugin may also need specific support for kube-proxy. The iptables proxy depends on iptables, and the plugin may need to ensure that container traffic is made available to iptables?

Which of the following is a basic, simple network plugin, where Linux does not implement advanced features like cross-node networking or network policy? It is typically used with a cloud provider that sets up routing rules for communication between nodes or in single-node environments.

Suppose you want to control traffic flow at the IP address or port level OSI layer 3 or 4. In that case, you might consider using Kubernetes _____________ for particular applications in your cluster?

Each NetworkPolicy may include a list of allowed _________ rules. Does each rule allow traffic that matches both the form and ports sections?

Which of the following is an abstract way to expose an application running on a set of Pods as a network? You do not need to rewrite your application to utilize an unknown service discovery technique with Kubernetes. Kubernetes gives Pods their IP addresses and a single DNS name for a set of Pods, and can load-balance across them.

In Kubernetes, which of the following contains references to a set of network endpoints? The control plane automatically creates that for any Kubernetes Service with a selector specified, including references to all the Pods that match the Service selector. This group network endpoints together by unique protocol combinations, port number, and Service name. The name of that object must be a valid DNS subdomain name.

Which of the following is the default ServiceType> A Service receives a Virtual IP address that is used for communicating with the Service and is accessible only within the cluster.

Which of the following service type is useful when we want to make our Services accessible from the external world? The end-user connects to any worker node on the specified high-port, which internally proxies the request to the Service’s ClusterIP, after which the request is passed to the apps executing within the cluster. Administrators can establish a reverse proxy – an ingress – and define rules that target Services within the cluster to access numerous apps from the outside world.

Which of the following service type only works if the underlying infrastructure supports the automatic creation of Load Balancers and has the respective support in Kubernetes, as with the Google Cloud Platform and AWS? If no such feature is configured, the LoadBalancer IP address field is not populated, and the Service work the same way as a NodePort type Service.

On-disk files in a container are ephemeral, which presents some problems for non-trivial applications when running in containers. When a container crashes, one issue is the loss of files. The kubelet restarts the container, but from scratch. A second issue arises when exchanging files across containers operating in a Pod. Which of the following abstraction solves both of these problems in the Kubernetes? Familiarity with Pods is suggested.

Which of the following is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using Storage Classes? It is a resource in the cluster, just like a node is a cluster resource?

Which of the following is a snapshot taken from a volume in the cluster that an administrator has provisioned? It is a resource in the cluster, just like a PersistentVolume is a cluster resource.

Which volumes are specified inline in the Pod spec, simplifying application deployment and management?

Which provisioning allows storage volumes to be created on-demand? Without that, cluster administrators have to manually make calls to their cloud or storage provider to create new storage volumes and then create PersistentVolume objects to represent them in Kubernetes. This feature eliminates the need for cluster administrators to pre-provision storage; instead, it automatically provisions storage when users request it.