EX280 Networking And Network Policies — 20 Questions

Question 1

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A custom label defined in the namespaceSelector of the NetworkPolicy spec. When using namespaceSelector in a NetworkPolicy, the target namespace must be labeled appropriately so the label matches the selector criteria specified in the ingress rule.

Answer

openshift.io/cluster-monitoring=true

Answer

security.openshift.io/scc=restricted

Answer

kubernetes.io/metadata.name matching the namespace name

Question 2

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

Accepted Answer

Via the /etc/resolv.conf file automatically managed inside the pod container. Kubernetes automatically injects the nameserver configuration into the /etc/resolv.conf file of every container based on the cluster DNS configuration.

Answer

By querying the OpenShift API server directly on port 6443 for DNS records

Answer

Through an environment variable named CLUSTER_DNS injected into every container

Answer

By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller

Question 3

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

Accepted Answer

30000-32767. Kubernetes and OpenShift allocate NodePort services within the standard port range of 30000-32767.

Answer

1024-65535

Answer

80-443

Answer

8000-9000

Question 4

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

Accepted Answer

backend.production.svc.cluster.local. The standard FQDN format for a Kubernetes service is ..svc.cluster.local.

Answer

backend.production.pod.cluster.local

Answer

backend.production.router.default.svc

Answer

svc.production.backend.cluster.local

Question 5

An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?

Accepted Answer

The Service selector labels do not match any active Pod labels.. A 503 error with zero endpoints typically indicates that the selector in the Service definition does not match the labels on any running pods.

Answer

The Route YAML has an invalid TLS certificate format.

Answer

The Ingress controller pods have crashed across all worker nodes.

Answer

The cluster DNS operator is degraded.

Question 6

An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?

Accepted Answer

EgressIP. In OVN-Kubernetes, EgressIP is a native custom resource used to assign a dedicated external IP to specific pods or namespaces.

Answer

ClusterNetwork

Answer

HostSubnet

Answer

EgressRouter

Question 7

An administrator needs to create a Service of type ClusterIP that exposes an application running on port 8080 inside the container, mapping it to port 80 on the Service. Which command should the administrator use?

Accepted Answer

oc expose pod frontend --port=80 --target-port=8080 --type=ClusterIP. The oc expose service or oc create service command correctly maps the targetPort inside the container to the service port using the syntax --port=80 --target-port=8080.

Answer

oc create service clusterip frontend --tcp=80:8080

Answer

oc create service clusterip frontend --port=80 --port=8080

Answer

oc expose deployment frontend --port=8080 --target-port=80

Question 8

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Accepted Answer

Edge TLS termination. Edge termination terminates TLS at the Ingress controller/router and requires the user to supply the TLS certificate and key in the Route specification.

Answer

Re-encrypt TLS termination

Answer

Unsecured Route with an external proxy

Answer

Insecure plain HTTP route

Answer

Passthrough TLS termination

Question 9

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

Accepted Answer

oc get route webapp -o jsonpath='{.spec.host}'. Using jsonpath with the oc get command allows extracting specific fields like the host spec of a route directly.

Answer

oc get route webapp --show-url

Answer

oc describe route webapp --url

Answer

oc extract route/webapp --field=host

Question 10

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

Accepted Answer

ingresscontroller.operator.openshift.io named 'default'. The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.

Answer

deployment named router-default in openshift-ingress namespace

Answer

configmap named router-config in openshift-ingress-operator

Answer

service named router-default-http in openshift-ingress

Question 11

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

Accepted Answer

A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'. A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Answer

A NetworkPolicy blocking egress in namespace 'dev'

Answer

A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

Answer

An EgressFirewall object in namespace 'dev'

Question 12

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

Accepted Answer

The cloud controller manager or cloud credentials operator is not configured to provision external load balancers.. A LoadBalancer service requires a cloud provider integration (such as an Ingress operator or cloud controller manager) to provision an external load balancer. Without proper configuration or cloud credentials, it remains pending.

Answer

The cluster is missing a valid Ingress controller deployment.

Answer

The NetworkPolicy is blocking cloud provider traffic.

Answer

The NodePort range is exhausted.

Question 13

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

Accepted Answer

spec:
  tls:
    termination: passthrough. A passthrough route requires setting tls.termination to passthrough.

Answer

spec:
  tls:
    termination: reencrypt

Answer

spec:
  tls:
    termination: edge

Answer

spec:
  tls:
    insecureEdgeTerminationPolicy: Allow

Question 14

A cluster uses OVN-Kubernetes as its CNI network provider. An administrator needs to inspect the logical switches and routers created by OVN within a node. Which command-line tool inside the ovn-node pod should be used?

Accepted Answer

ovn-nbctl. ovn-nbctl is the Open Virtual Network Northbound CLI utility used to inspect logical entities like switches, routers, and ports.

Answer

ip route show

Answer

iptables-save

Answer

ovs-vsctl

Question 15

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

Accepted Answer

In the same ingress 'from' array item, combining namespaceSelector and podSelector. A single ingress rule in a NetworkPolicy can contain both a namespaceSelector and a podSelector within the same 'from' array element to target specific pods in specific namespaces.

Answer

By referencing an external ClusterRole binding with label selectors

Answer

Using a peerSelector object that nests both labels

Answer

In separate ingress rules, where one rule has namespaceSelector and another has podSelector

Question 16

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

Accepted Answer

nc. nc (netcat) or telnet or curl are commonly used tools, but nc/netcat is standard for raw TCP connectivity checks.

Answer

ifconfig

Answer

traceroute

Answer

ping

Question 17

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

Accepted Answer

The NetworkPolicy blocks outbound traffic to port 53 on the cluster DNS service.. Pods rely on CoreDNS services for name resolution. If egress rules are applied without explicitly allowing UDP/TCP traffic to port 53 on the cluster DNS service or cluster CIDR, DNS queries are blocked.

Answer

NetworkPolicies automatically disable the OpenShift SDN controller.

Answer

CoreDNS pods do not have valid security context constraints.

Answer

External DNS servers reject requests originating from OpenShift node IPs.

Question 18

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Accepted Answer

In the IngressController resource named 'default' in openshift-ingress-operator. The default certificate for routes is configured in the IngressController custom resource under the 'defaultCertificate' spec.

Answer

In a ConfigMap named 'router-certs' in the default namespace

Answer

In the apiserver.config.openshift.io cluster object

Answer

In the DNS cluster operator configuration

Question 19

An administrator needs to list all Services across all namespaces in the OpenShift cluster. Which command should be used?

Accepted Answer

oc get svc -A. The --all-namespaces or -A flag with oc get services lists services across every namespace.

Answer

oc get services --cluster

Answer

oc describe service --all

Answer

oc adm top services

Question 20

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

Accepted Answer

ovs-ofctl. ovs-ofctl is used to inspect and manipulate OpenFlow rules in Open vSwitch bridges, which underpin OVN-Kubernetes data paths.

Answer

nmcli connection show

Answer

ethtool -S

Answer

ovn-trace