CKA Services and Networking — Timed 10 Questions

Question 1

You run 'kubectl get svc my-service -o yaml' and see 'type: ClusterIP'. The service has no endpoints. What is the most likely cause?

Accepted Answer

No pods with labels matching the service selector are running and ready.. A Kubernetes Service of type ClusterIP relies on a label selector to identify target Pods. If no Pods match the selector and are in the Ready state, the Service will have no endpoints, causing traffic to be dropped. The absence of endpoints directly indicates a mismatch or absence of matching, ready Pods.

Answer

The service type is ClusterIP, which does not support endpoints.

Answer

The service's port does not match the container port.

Answer

The service is misconfigured and needs to be deleted and recreated.

Question 2

An administrator runs 'kubectl run nginx --image=nginx --port=80' and then 'kubectl expose pod nginx --port=80 --type=NodePort'. Later, they run 'kubectl get svc nginx' and see that the NodePort is set to 0. What is the most likely reason?

Accepted Answer

The pod was not ready when the service was created, so NodePort assignment was delayed.. By default, Kubernetes restricts NodePort allocations to the range 30000-32767. If a user specifies a nodePort outside of this range (such as 8080) in the Service manifest, the API server will reject the creation with a validation error. This range can be customized using the `--service-node-port-range` flag on the kube-apiserver.

Answer

The nodePort field was explicitly set to 0 in the service YAML, but the administrator used a flag that was ignored.

Answer

The cluster has a mutating webhook that converted the service type to ClusterIP because NodePort is disabled.

Answer

The pod was created by a Deployment, so its labels do not match the service selector.

Question 3

A cluster has a NetworkPolicy that denies all ingress traffic by default. An administrator wants to allow TCP traffic on port 8080 from pods with label 'app: web' in the same namespace. Which NetworkPolicy egress rule is needed?

Accepted Answer

An ingress rule with podSelector matching 'app: web' and ports.. To allow incoming traffic to a pod that has a default-deny ingress policy, an ingress rule must be defined on that pod's NetworkPolicy. The rule needs to specify a podSelector matching the source pods ('app: web') and the destination port (8080).

Answer

An ingress rule with namespaceSelector matching the same namespace.

Answer

An egress rule with namespaceSelector and podSelector.

Answer

An egress rule with podSelector matching 'app: web' and ports.

Question 4

What is the default DNS name for a service named 'my-svc' in namespace 'default'?

Accepted Answer

my-svc.default.svc.cluster.local. In Kubernetes, the default DNS name for a service follows the pattern `..svc.cluster.local`. For a service named 'my-svc' in the 'default' namespace, the fully qualified domain name (FQDN) is `my-svc.default.svc.cluster.local`. This is defined by the cluster DNS specification (CoreDNS or kube-dns) and allows pods to resolve the service by name within the cluster.

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Answer

my-svc.cluster.local

Question 5

A developer runs 'kubectl port-forward service/my-service 8080:80'. What does this command do?

Accepted Answer

It forwards incoming traffic on local port 8080 to port 80 on the service's ClusterIP.. `kubectl port-forward` creates a tunnel from a local port on the client machine to a specified port on a Kubernetes resource, in this case a Service. It forwards traffic received on localhost:8080 to the Service's ClusterIP on port 80, allowing the developer to access the service without exposing it externally.

Answer

It creates a proxy that routes traffic from the service's ClusterIP to the local machine on port 8080.

Answer

It exposes the service as a NodePort on port 8080.

Answer

It creates a new service of type LoadBalancer on port 8080.

Question 6

Which of the following commands can be used to check the endpoints of a service named 'my-service'?

Accepted Answer

kubectl get endpoints my-service. The `kubectl get endpoints my-service` command directly retrieves the Endpoints object associated with the service, which lists the IP addresses and ports of the pods that match the service's selector. This is the standard and most direct way to check the active endpoints for a service in Kubernetes.

Answer

kubectl get pod my-service

Answer

kubectl get service my-service -o yaml

Answer

kubectl get svc my-service --show-endpoints

Question 7

What is the default kube-proxy mode in Kubernetes v1.29?

Accepted Answer

iptables. In Kubernetes v1.29, the default kube-proxy mode is `iptables`. This mode uses Linux iptables rules to handle service traffic, providing better performance and reliability than the older userspace mode. It is the default because it balances simplicity and efficiency for most cluster configurations.

Answer

nftables

Answer

userspace

Answer

ipvs

Question 8

Which TWO of the following are valid ways to expose a Deployment named 'web' as a service?

Accepted Answer

kubectl expose deployment web --port=80. Valid because `kubectl expose deployment web --port=80` creates a ClusterIP Service that selects Pods with the label `app=web`, which is automatically set by `kubectl create deployment` and matches the Deployment's Pods. Option D is valid because applying a Service manifest with `selector: app: web` manually creates a Service that targets the Pods. Option E is not valid because `kubectl create service clusterip web-service --tcp=80:80` creates a Service with the selector `app: web-service` (derived from the Service name), which does not match the Deployment's Pod label (`app: web`), so it does not target the Pods. Options A and B do not create Service objects: A uses `kubectl port-forward` which only forwards ports locally, and B uses the deprecated `kubectl run --expose` which creates a standalone Pod (not a Deployment) with a temporary Service.

Answer

kubectl port-forward deployment/web 8080:80

Answer

kubectl run web --image=nginx --port=80 --expose

Answer

kubectl create service clusterip web --tcp=80:80

Question 9

Which THREE of the following are requirements for an Ingress resource to work?

Accepted Answer

An Ingress controller must be deployed in the cluster.. For an Ingress resource to function and successfully route traffic:

1. **An Ingress controller must be deployed** (Option B): The Ingress resource itself is just a configuration. An Ingress controller (like ingress-nginx) is required to monitor Ingress resources and configure the data plane to route traffic.
2. **The backend services must have active endpoints** (Option D): The Ingress controller routes traffic directly to the Pod IPs (endpoints) of the backend services. If the services have no endpoints (e.g., no running pods or failing readiness probes), the Ingress controller cannot route traffic and will return an error (typically 503).
3. **The Ingress must define either a default backend or at least one routing rule** (Option E): The Kubernetes API validation requires that an Ingress spec contains either a `defaultBackend` or a list of `rules` (or both). An Ingress with neither is invalid and cannot be created.

Hosts (Option A) and TLS configuration (Option C) are optional.

Answer

The Ingress resource must specify a host.

Answer

The Ingress resource must have a TLS section.

Question 10

Which TWO of the following statements about NetworkPolicy are true?

Accepted Answer

A NetworkPolicy can have both ingress and egress rules.. A NetworkPolicy resource can define both `ingress` and `egress` rules in its spec, allowing administrators to control inbound and outbound traffic to and from selected pods. This is explicitly supported by the Kubernetes NetworkPolicy API, where each rule can specify `from` (for ingress) or `to` (for egress) selectors, along with ports and protocols.

Answer

NetworkPolicy can filter traffic based on source IP addresses.

Answer

NetworkPolicy is a cluster-scoped resource.

Answer

By default, pods are isolated and all traffic is denied.