EX294 Coordinate rolling updates Practice Test 2 — 15 Questions

Question 1

Which THREE commands can verify the status of a rolling update on an OpenShift deployment?

Accepted Answer

oc describe deployment/. Option A, `oc describe deployment/`, is correct because the deployment's status section reports the rolling update state, including the updated replicas, available replicas, and conditions such as Progressing or Available, letting you confirm whether the rollout has completed. Option C, `oc get events`, is correct because rollout-related events (for example, scaling replicas up/down or failing to create pods) are recorded as Kubernetes events and reveal the progress or problems of a rolling update. Option E, `oc rollout status deployment/`, is correct because it is the purpose-built command that watches the deployment's rollout and reports whether it has successfully completed or is still in progress. Option B, `oc logs deployment/`, is not appropriate because logs show application output from the pods, not the deployment controller's rollout status, and a deployment object itself does not produce container logs. Option D, `oc get pods -l `, is not one of the marked answers because it only lists matching pods and their phases; while useful, it does not directly report the deployment's rolling update status as the three correct commands do.

Answer

oc logs deployment/<name>

Answer

oc get pods -l <selector>

Question 2

Which TWO Ansible playbook parameters directly control the number of host failures allowed before aborting a rolling update?

Accepted Answer

max_fail_percentage. Option A, max_fail_percentage, is correct because it sets a threshold percentage of hosts in the current batch that may fail before Ansible aborts the play for the remaining hosts, directly governing how many failures are tolerated during a rolling update. Option B, any_errors_fatal, is correct because when set to true it causes the play to abort immediately on the first host failure, effectively controlling whether any failure stops the rolling update. Option C, throttle, is incorrect because it limits the number of hosts executing a task concurrently, not the number of failures allowed. Option D, serial, is incorrect because it defines the batch size (how many hosts are updated per iteration), not the failure tolerance. Option E, ignore_errors, is incorrect because it allows a task to continue despite failure rather than controlling when the play aborts based on host failures.

Answer

throttle

Answer

serial

Answer

ignore_errors

Question 3

The deployment has 4 replicas. During a rolling update, what is the maximum number of pods that can be unavailable at any single time?

Accepted Answer

1. The default rolling update strategy for a Deployment in Kubernetes sets `maxUnavailable` to 25% of the desired replicas, rounded up. With 4 replicas, 25% equals 1, so at most 1 pod can be unavailable during the update. This ensures minimal disruption while allowing the update to proceed.

Answer

2

Answer

4

Answer

0

Answer

3

Question 4

There are 5 hosts in the webservers group. All updates succeed on the first batch of 2 hosts. On the second batch, one host fails. What is the result?

Accepted Answer

The play aborts due to max_fail_percentage being exceeded.. Assuming the default max_fail_percentage of 0% (or a low threshold), the failure of one host in the second batch causes the cumulative failure percentage to exceed the allowed limit. Since the threshold is exceeded, the play aborts, making option D correct. Option E suggests an immediate abort, but the abort is specifically due to max_fail_percentage being exceeded.

Answer

The play retries the failed host automatically.

Answer

The play marks the host as failed and continues with the next batch.

Answer

The play continues with the remaining 1 host in the third batch.

Answer

The play aborts immediately after the failure.

Question 5

You are managing a critical web application deployed on OpenShift with 12 replicas. The application must maintain at least 10 replicas available during updates to meet an SLA. You initiate a rolling update using the default strategy, but the rollout is progressing slowly because only 2 new pods are created at a time, causing a prolonged update duration. You need to speed up the rollout without violating the SLA (10 available replicas). The current Deployment configuration has maxSurge: 25% (3 pods) and maxUnavailable: 25% (3 pods). You have permission to update the DeploymentConfig during the active rollout. Which action should you take?

Accepted Answer

Set maxSurge to 10 and maxUnavailable to 2, then run 'oc rollout resume'.. The current maxSurge is 25% of 12, which is 3 pods, and maxUnavailable is 25%, which is 3 pods. To speed up the rollout while maintaining at least 10 available replicas, we need to ensure that maxUnavailable does not exceed 2 (since 12 - 2 = 10). Increasing maxSurge allows more new pods to be created simultaneously, speeding up the rollout. Setting maxSurge to 10 and maxUnavailable to 2 satisfies the SLA and significantly increases the number of new pods created at a time. The command 'oc rollout resume' is used to resume a paused rollout, but the question states the rollout is progressing slowly, not paused. However, in OpenShift, you can update the DeploymentConfig during a rollout, and the changes will apply to the ongoing rollout. The correct action is to set maxSurge to 10 and maxUnavailable to 2, then resume if needed. Option D is correct.

Answer

Cancel the current rollout, set maxSurge to 4 and maxUnavailable to 2, then start a new rollout.

Answer

Set maxSurge to 50% and maxUnavailable to 50%, then run 'oc rollout resume'.

Answer

Set maxSurge to 5 and maxUnavailable to 2, then run 'oc rollout retry'.

Question 6

An operations team is planning a rolling update of a production OpenShift cluster running Red Hat Enterprise Linux CoreOS nodes. Which three practices should be followed to ensure minimal downtime and proper rollback capability?

Accepted Answer

Use canary nodes to validate the update before full rollout.. Option A is correct because canary nodes let the team validate the update on a small subset of nodes before rolling it out to the entire production cluster, catching regressions early and limiting blast radius. Option C is correct because `oc adm update` (or the Cluster Version Operator-driven upgrade workflow) orchestrates the rolling update across nodes in a controlled, sequential manner, pausing if health checks fail so rollback or remediation is possible. Option D is correct because configuring a maximum surge (e.g., 25%) controls how many extra nodes are provisioned during the update, preventing resource exhaustion and preserving capacity for workloads while nodes drain and reboot. Option B is not among the marked correct answers; while monitoring cluster health is good practice, the specific command `oc get clusterversion` alone does not ensure minimal downtime or rollback capability. Option E is not correct because placing all nodes in the same Availability Zone reduces fault tolerance and does not simplify rollback; spreading nodes across zones is the recommended practice for resilience during updates.

Answer

Monitor cluster health via `oc get clusterversion` after each node update.

Answer

Place nodes in the same Availability Zone to simplify rollback.

Question 7

A systems administrator is performing a rolling update of a three-node Red Hat Enterprise Linux 8 cluster running a load-balanced web application. The update involves upgrading the httpd package. The administrator uses Ansible to update one node at a time. After updating the first node, the administrator checks the application health and finds that the node is serving requests correctly. The administrator proceeds to update the second node. However, after the second node update completes, the load balancer reports that both the first and second nodes are unavailable. What is the most likely cause?

Accepted Answer

The second node's update triggered a configuration change that disabled the health check endpoint on both nodes.. The most likely cause is that the second node's update triggered a configuration change that disabled the health check endpoint on both nodes. In a rolling update, a shared configuration (e.g., a load balancer health check path or a common config file managed by Ansible) can be altered in a way that affects all nodes, causing the load balancer to mark both as unavailable. The fact that the first node was healthy before the second update and then both failed points to a shared dependency or configuration change introduced during the second node's update.

Answer

The httpd service on both nodes experienced a segmentation fault after the update.

Answer

The first node was inadvertently excluded from the load balancer pool by the Ansible playbook.

Answer

The load balancer was configured to only allow one node to be active at a time.

Question 8

A DevOps engineer is responsible for coordinating a rolling update of a Red Hat OpenShift Container Platform 4.12 cluster with 10 worker nodes. The cluster hosts a stateful application that uses persistent volumes with ReadWriteOnce access mode. The update involves a minor version upgrade of the cluster from 4.12.0 to 4.12.5. The engineer uses the recommended `oc adm upgrade` command. During the update, after the first worker node is updated, the engineer notices that the node's status shows 'NotReady' and the cluster version operator reports a degraded status. A check of the node logs reveals 'kubelet: Failed to run kubelet: Could not get kubelet config from cluster: could not get config from cluster: context deadline exceeded'. Which action should the engineer take first?

Accepted Answer

Check the network connectivity between the updated node and the control plane nodes on port 6443.. The error indicates the kubelet cannot communicate with the control plane on port 6443, likely due to a network issue (e.g., firewall, DNS, or routing). Option A is wrong because rolling back the entire cluster is a drastic first step; the issue is likely isolated. Option C is wrong because changing kubelet parameters is not a standard resolution for connectivity problems. Option D is wrong because rebuilding the node from scratch is unnecessary and time-consuming; the issue is likely resolvable by restoring network connectivity.

Answer

Rebuild the node from scratch using the machine config operator.

Answer

Roll back the entire cluster to version 4.12.0 using the `oc adm upgrade --to=4.12.0` command.

Answer

Increase the kubelet's `--node-status-update-frequency` parameter on the updated node.

Question 9

An administrator runs this playbook against a group of 10 web servers. The update fails on the third host (host3) due to a yum error. What is the most likely outcome?

Accepted Answer

The playbook continues with the remaining hosts because the number of failures (1) is below the 25% threshold.. The playbook uses the `serial: 2` directive, which batches hosts in groups of two, and the `max_fail_percentage: 25` setting. With 10 hosts, 25% allows up to 2 failures (2.5 rounded down). Since only one failure occurred (on host3), the playbook continues processing the remaining batches after the failed batch completes.

Answer

Only the first batch (host1 and host2) are updated successfully; the remaining hosts are skipped.

Answer

All hosts are disabled in HAProxy and the playbook fails.

Answer

The playbook halts immediately after the failure on host3.

Question 10

An organization uses Ansible Automation Platform to perform rolling updates on a 5-node PostgreSQL replication cluster. The playbook uses `serial: 1` and includes tasks to promote a standby, demote the primary, update PostgreSQL packages, and then re-elect the original primary. The cluster health check task verifies that replication lag is under 10 seconds before proceeding to the next node. Recently, during an update of the primary node (node1), the health check after re-election fails because replication lag is 15 seconds due to a large write load. The playbook aborts, leaving the cluster in a degraded state with node1 updated but not serving as primary. The administrator needs to ensure that the update continues while still maintaining cluster integrity. Which action should the administrator take?

Accepted Answer

Wrap the update tasks in a block with a rescue handler that reverts the update on the failed host and then continues with the next host.. Wrapping the update tasks in a block with a rescue handler allows the playbook to catch the health check failure, perform remediation (such as reverting the update on the failed host or restoring the previous primary role), and then continue processing subsequent hosts. This preserves cluster integrity by ensuring the degraded node is handled gracefully rather than leaving it in an inconsistent state. The rescue block executes only on the host that failed, so the serial:1 rolling update can proceed to the next node without aborting the entire run.

Answer

Add `ignore_errors: yes` to the health check task so the playbook continues despite the failure.

Answer

Remove the health check task to allow the update to proceed without interruption.

Answer

Set `max_fail_percentage: 20` to allow up to one failure per update run.

Question 11

A site reliability engineer is rolling out a new application version to a 12-node cluster using an Ansible playbook with 'serial: 3'. The application requires that a node be drained from the load balancer before the update and re-added after a health check. Which combination of Ansible features best enforces this per-node sequence during the rolling update?

Accepted Answer

Use 'serial: 3' with a task list that drains, updates, and health-checks each host in order, and 'throttle: 1' to limit concurrent task execution.. To enforce a strict per-node drain, update, and re-add sequence while still using serial batching, the playbook must order tasks correctly and limit concurrency. throttle: 1 ensures only one host proceeds through those tasks at a time, preventing a second host from being updated before the first is healthy and re-added. This preserves the safety guarantees of the rolling update.

Answer

Use a block with 'delegate_to: localhost' around drain, update, and health-check tasks executed sequentially for each host.

Answer

Set 'serial: 1' and use handlers notified by the update tasks to perform the drain and health-check steps.

Answer

Use 'pre_tasks' and 'post_tasks' with 'run_once: true' to drain and re-add nodes for the entire batch.

Question 12

You are performing a rolling update of a 6-node web application cluster using an Ansible playbook. The application must always keep at least 4 nodes serving traffic. The playbook uses `serial: 2`. During the update of the first batch, one host fails to update because a package dependency cannot be resolved. You need the playbook to stop the entire update immediately so that no further hosts are modified. Which Ansible directive or configuration should you add to the playbook to achieve this?

Accepted Answer

max_fail_percentage: 0. To stop a rolling update immediately upon any host failure, you must set max_fail_percentage to 0. This directive defines the maximum percentage of hosts that can fail before the play aborts for all hosts. With a value of 0, even a single failure triggers an abort, ensuring that no additional hosts are updated and the cluster maintains the required number of active nodes.

Answer

serial: 1

Answer

ignore_errors: no

Answer

any_errors_fatal: false

Question 13

You are performing a rolling update of a 12-node web server fleet using an Ansible playbook that uses `serial: 3`. During the update of the second batch, a host fails a health check and the playbook aborts. You want to continue the update with the remaining hosts without restarting the entire play. Which Ansible feature should you use?

Accepted Answer

`--limit` with a host pattern of the remaining unprocessed hosts. When a rolling update aborts mid-way, the already-updated batches should not be touched again. The `--limit` option restricts the play to a subset of inventory, so you can target only the hosts that were not yet updated and let `serial` batch them again. This avoids re-running tasks on completed hosts and continues the update safely.

Answer

`--start-at-task`

Answer

`--step`

Answer

`--limit @retry_file`

Question 14

You are managing a rolling update of a 10-node application cluster using Ansible. The playbook uses `serial: 2` and includes a task that drains connections from a node before updating it. During the third batch, the drain task fails on one host because the load balancer API is temporarily unreachable. You want the playbook to continue with the remaining hosts in the batch but stop the entire playbook if more than 20% of hosts fail. Which combination of keywords should you use?

Accepted Answer

Set `any_errors_fatal: false` at the play level and `max_fail_percentage: 20` at the play level.. The default `any_errors_fatal` is false, meaning a failure on one host does not stop the play for other hosts in the batch. `max_fail_percentage` set at the play level will abort the play if the percentage of failed hosts exceeds the threshold. In this scenario, with `serial: 2`, a single host failure is 50% of the batch, which exceeds 20%, so the play would abort. To truly continue with remaining hosts, you might need a larger batch or a different threshold, but the keywords are correct.

Answer

Set `force_handlers: yes` on the play and `max_fail_percentage: 20` on the drain task.

Answer

Set `serial: 2` with `throttle: 1` and `max_fail_percentage: 20` at the play level.

Answer

Set `ignore_errors: yes` on the drain task and `max_fail_percentage: 20` at the play level.

Question 15

You are designing an Ansible playbook for a rolling update of a load-balanced web server fleet. The playbook must update servers in batches of 3, and if more than 20% of the hosts in a batch fail, the play should abort for all hosts. You also need to ensure that the load balancer removes each server from rotation before the update and adds it back after the update succeeds. Which two actions should you take to meet these requirements? (Choose two.)

Accepted Answer

Set `max_fail_percentage: 20` in the play definition.. To update in batches of 3, set serial to 3. To abort the play if more than 20% of hosts in a batch fail, set max_fail_percentage to 20. These two directives together control the rolling update pace and failure tolerance, ensuring that the update proceeds in controlled batches and stops if the failure rate exceeds the threshold.

Answer

Set `any_errors_fatal: true` to ensure the playbook stops on any error.

Answer

Add a task that uses the `uri` module to call the load balancer API to disable the server before update and enable it after.

Answer

Use the `serial` keyword with a list of values, such as `[1, 3, 5]`, to gradually increase the batch size.