EX280 Troubleshooting And Diagnostics — 25 Questions

Question 1

An OpenShift cluster upgrade stalled because a MachineConfigPool is paused. The administrator needs to verify which MachineConfigPool is paused and unpause it. Which command accomplishes this?

Accepted Answer

oc get machineconfigpools. Checking the MachineConfigPool resource YAML or status shows the paused state, which can be modified using oc patch or oc edit.

Answer

oc adm upgrade resume

Answer

oc get mcp --show-paused

Answer

oc resume machineconfigpool/worker

Question 2

An application pod fails to start because of a volume mount permission error (Permission Denied). Which TWO settings or configurations should an administrator investigate? (Choose TWO)

Accepted Answer

The cluster version operator status.. Checking SecurityContextConstraints (SCCs) and pod security settings (runAsUser, fsGroup) resolves permission denied issues on mounted volumes.

Answer

The ingress router certificate expiration.

Question 3

An administrator needs to troubleshoot an OpenShift Route that returns a '503 Service Unavailable' error. Which THREE resources or objects should be inspected? (Choose THREE)

Accepted Answer

oc describe route <route-name>. Checking the Route configuration, the backing Service endpoints, and the Ingress Controller logs resolves 503 errors.

Answer

oc get clusteroperator etcd

Question 4

An OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?

Accepted Answer

oc logs -n openshift-authentication deployment/oauth-openshift. Checking the operator pods in openshift-authentication namespace using oc logs on the oauth-openshift deployment provides the exact HTTP communication errors.

Answer

oc get events -n openshift-config-managed

Answer

oc get clusteroperator authentication -o yaml

Answer

oc adm must-gather --image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...

Question 5

An OpenShift administrator needs to investigate a pod that is failing with an 'OOMKilled' exit code. Which command reveals the memory limit configuration and historical usage right before the crash?

Accepted Answer

oc describe pod <pod-name>. oc describe pod provides the last state, exit code 137 (OOMKilled), and configured limits, while telemetry metrics can show usage.

Answer

oc top pod <pod-name> --containers

Answer

oc get pod <pod-name> -o yaml

Answer

oc adm diagnostics

Question 6

An administrator is troubleshooting a failing MachineConfig update in an OpenShift cluster. The MachineConfigPool 'worker' is degraded and reports that a node is failing to apply the rendered-worker configuration. Which log stream is critical for determining why the Machine Config Daemon failed to update system files on the target node?

Accepted Answer

oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon. The Machine Config Daemon runs as a DaemonSet across all nodes in the openshift-machine-config-operator namespace. Accessing its logs on the affected node via oc logs or oc debug is necessary.

Answer

oc describe machineconfigpool worker

Answer

oc logs -n openshift-cluster-version-operator deployment/cluster-version-operator

Answer

journalctl -u kubelet -e

Question 7

A cluster administrator suspects that an API rate-limiting issue is causing intermittent client timeouts. Which component logs should be inspected to confirm that clients are exceeding their API request limits?

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. The Kubernetes API server logs record throttling and rate-limiting events when clients exceed request limits.

Answer

oc get events --all-namespaces

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc logs -n openshift-kube-apiserver-operator deployment/cluster-kube-apiserver-operator

Question 8

An administrator wants to view the logs of a specific container named 'backend' inside a pod with multiple containers. Which command should be used?

Accepted Answer

oc logs pod/my-pod -c backend. When a pod has multiple containers, the container name must be explicitly specified with the -c flag in the oc logs command.

Answer

oc logs pod/my-pod backend

Answer

oc rsh pod/my-pod backend

Answer

oc describe pod/my-pod -c backend

Question 9

A developer reports that their pod is unable to start because it cannot mount a persistent volume claim (PVC). Where should the administrator look to diagnose volume attachment issues related to the CSI driver?

Accepted Answer

oc describe pvc my-pvc. The cluster-wide CSI provisioner and attacher controllers log storage attachment issues, typically found in the logs of the pods within the openshift-cluster-storage-operator namespace or the specific CSI driver namespace.

Answer

oc get events -n openshift-storage

Answer

oc debug node/worker-0

Answer

oc logs -n openshift-cluster-storage-operator deployment/csi-snapshot-controller-operator

Question 10

A pod in the 'production' namespace is crashing repeatedly due to a segmentation fault in the application binary. The administrator needs to inspect the file system of the crashing container without altering the deployment spec permanently. Which command is most appropriate?

Accepted Answer

oc debug pod/my-app-6b79f-abcde. oc debug with a pod target creates a debugging pod that shares the namespace and mounts the containers of the target pod, allowing file system inspection.

Answer

oc logs pod/my-app-6b79f-abcde --previous

Answer

oc rsh deployment/my-app

Answer

oc exec -it pod/my-app-6b79f-abcde -- /bin/sh

Question 11

An administrator needs to collect cluster-wide diagnostic information from an OpenShift 4.14 cluster for a Red Hat support case. Which command should be executed?

Accepted Answer

oc adm must-gather. The oc adm must-gather command collects debugging information from the cluster, including logs, cluster operator status, and node details, packaging them into a compressed archive for Red Hat Support.

Answer

oc adm diagnose

Answer

oc cluster-info dump

Answer

oc get clusteroperators -o yaml

Question 12

An application pod is failing its liveness probe and continuously restarting. Where can an administrator quickly check the reason for the liveness probe failure?

Accepted Answer

oc describe pod <pod-name>. oc describe pod displays container events, including recent liveness and readiness probe failures and exit statuses.

Answer

oc get routes

Answer

oc get pod <pod-name> -o json

Answer

oc adm diagnostics

Question 13

An administrator notices that the Cluster Version Operator (CVO) is blocked during an upgrade because a cluster operator is missing version annotations. Which command allows checking the current status and payload version of the CVO?

Accepted Answer

oc get clusterversion. oc get clusterversion provides the high-level status of the cluster upgrade, available updates, and active version history.

Answer

oc adm upgrade status

Answer

oc get clusteroperators

Answer

oc version

Question 14

A node in an OpenShift cluster goes into 'NotReady' status. The administrator uses 'oc debug node/<node-name>' to inspect the node's root filesystem. Where are the host's system logs mounted inside the debug chroot environment?

Accepted Answer

/host/var/log. When using oc debug to access a node, the host's root filesystem is mounted under /host, making host logs available under /host/var/log.

Answer

/rootfs/var/log

Answer

/mnt/host/log

Answer

/var/log

Question 15

An OpenShift cluster experiences severe etcd latency spikes, causing leader elections to fail. Which metric or diagnostic tool should be used to inspect etcd peer round-trip times directly from the command line within the cluster?

Accepted Answer

oc rsh -n openshift-etcd pod/etcd-<node-name> etcdctl endpoint health. etcd provides built-in tooling and metrics. The etcdctl endpoint health or etcdctl check perf commands can be run from within an etcd pod to verify cluster performance.

Answer

oc adm inspect etcd

Answer

oc adm diagnostics etcd-latency

Answer

oc get etcd -o yaml

Question 16

An administrator wants to stream logs from all pods belonging to a specific Deployment named 'web-frontend' in real-time. Which command achieves this?

Accepted Answer

oc logs deployment/web-frontend -f. oc logs supports targeting a Deployment directly via the resource type, streaming logs from all associated pods.

Answer

oc watch deployment/web-frontend

Answer

oc logs pods -l app=web-frontend

Answer

oc rsh deployment/web-frontend

Question 17

A pod fails to start with a 'CreateContainerConfigError' error message. What is the most common cause of this error that an administrator should investigate?

Accepted Answer

A referenced ConfigMap or Secret in the pod specification does not exist.. CreateContainerConfigError typically occurs when a referenced ConfigMap or Secret does not exist or is misspelled in the pod specification.

Answer

The liveness probe timed out before the application started.

Answer

The container image pull policy is set to Always and the registry is down.

Answer

The container exceeded its memory limit upon initialization.

Question 18

An OpenShift cluster's SDN (OVN-Kubernetes) experiences packet loss between nodes. The administrator needs to inspect the Open vSwitch (OVS) flow tables on a specific worker node. How should they access the node to run 'ovs-ofctl dump-flows'?

Accepted Answer

oc debug node/ -- chroot /host ovs-ofctl dump-flows br-int. Using oc debug node/ provides a shell where chroot /host allows executing host-level commands like ovs-ofctl.

Answer

oc adm diagnostics ovs

Answer

oc exec daemonset/ovn-controller -- ovs-ofctl dump-flows

Answer

oc rsh daemonset/ovnkube-node

Question 19

An administrator needs to check the cluster events across all namespaces sorted by timestamp to identify recent infrastructure warnings. Which command should they use?

Accepted Answer

oc get events --sort-by='.metadata.creationTimestamp'. oc get events --sort-by='.metadata.creationTimestamp' lists all events ordered by creation time.

Answer

oc adm events --all

Answer

oc show events --recent

Answer

oc cluster-events

Question 20

A container inside a pod is failing with 'ImagePullBackOff'. The administrator verifies the image tag exists. What is the next most logical troubleshooting step to check authentication or registry access?

Accepted Answer

Check if a pull secret is correctly configured and bound to the service account.. Checking the ImageStream or Secret associated with image pull credentials (such as dockercfg secrets) is necessary when pulling from private registries.

Answer

Inspect the etcd cluster operator status.

Answer

Run 'oc debug' to inspect the container file system.

Answer

Restart the cluster version operator.