Hard Difficulty Questions

Set resource requests for 'gpu' in the container spec.

Why wrong: GPUs are not standard resources; they are extended resources and must be requested with their specific name (e.g., nvidia.com/gpu).

Set nodeName to the name of a specific GPU node.

Why wrong: nodeName is too rigid and does not leverage node capabilities; it also does not check for GPU availability.

Add a toleration for a taint that GPU nodes have.

Why wrong: Tolerations allow scheduling on tainted nodes but do not guarantee the node has a GPU.

--client-cert-auth

Why wrong: This flag enables client certificate authentication, but is not a certificate file flag.

--peer-cert-file

Why wrong: This is for peer communication, not client authentication.

Change the Service type to NodePort to bypass the Ingress.

Why wrong: Changing Service type does not affect endpoint creation; the root cause is missing endpoints.

Update the Ingress to use a different backend service.

Why wrong: The Ingress is correctly configured; the issue is with the Service itself.

Modify the Service selector to match the pod labels exactly.

Why wrong: The selector already matches 'app: web'; this would not change anything.

Manually delete the /etc/kubernetes/manifests/kube-apiserver.yaml file and kill the process using port 6443.

Why wrong: This is not the recommended approach; kubeadm reset is safer.

Use a different port for the API server by specifying --apiserver-bind-port.

Why wrong: This would workaround but not clean up the existing cluster state.

Run kubeadm init with --force flag to override the errors.

Why wrong: There is no --force flag for kubeadm init.

db-service.svc.cluster.local

Why wrong: Missing the namespace component.

db-service

Why wrong: This only works if the Service is in the same namespace.

db-service.backend.cluster.local

Why wrong: Incorrect domain; should be 'svc.cluster.local'.

Run 'kubeadm init phase certs kubelet-client'

Why wrong: This command does not exist; certs are renewed with 'kubeadm certs renew'.

Renew all certificates using 'kubeadm certs renew all'

Why wrong: This renews all, but the question asks for the kubelet client certificate specifically.

Delete the old certificate and restart kubelet

Why wrong: Not a best practice; kubeadm provides renewal commands.

Calico is not configured with an overlay network.

Why wrong: Calico can work without an overlay using BGP; lack of overlay is not the issue.

A NetworkPolicy is blocking inter-node traffic.

Why wrong: The scenario says network policies are not enforced.

The pods are using different Service types.

Why wrong: Service type does not affect pod-to-pod communication.

Add a toleration for 'arch=amd64:NoSchedule' to the Pod.

Why wrong: Tolerations allow scheduling on tainted nodes, but the taint would need to be on non-amd64 nodes, which is not described.

Use podAntiAffinity to avoid scheduling on arm64 nodes.

Why wrong: Pod anti-affinity is for Pod-to-Pod placement, not node architecture.

Set a runtimeClassName for amd64 in the Pod spec.

Why wrong: RuntimeClassName specifies the runtime (e.g., gVisor), not architecture.

They can block traffic at the node level.

Why wrong: Network Policies operate at the pod level, not node level.

They can modify packet contents.

Why wrong: Network Policies only allow/deny; they do not modify packets.

The Ingress rule blocks all incoming traffic, preventing DNS responses.

Why wrong: The problem is egress, not ingress; DNS responses are not blocked by egress rules.

The policy is applied to all namespaces, causing a conflict.

Why wrong: The policy is in the default namespace and only affects that namespace.

The policy only applies to pods with specific labels.

Why wrong: The podSelector is empty, meaning it applies to all pods.

The kubelet is running out of disk space.

Why wrong: Disk space issues would cause write errors, not permission denied on read.

The kubelet is not able to reach the API server.

Why wrong: This would cause a connection timeout, not a permission denied error.

The kubelet binary is missing.

Why wrong: Missing binary would cause 'command not found', not permission denied.

Store the audit policy in a ConfigMap and reference it via --audit-policy-configmap.

Why wrong: There is no such flag; the policy file is passed directly.

Restart the kubelet on the control plane node.

Why wrong: The API server is a static pod; the kubelet does not need restart.

Use LUKS to encrypt the disk partition where etcd data is stored.

Why wrong: This is a valid approach but not Kubernetes-native; also requires manual management.

Use TLS certificates to encrypt communication between etcd and the API server.

Why wrong: TLS encrypts in transit, not at rest.

Configure etcd to use encryption at rest by setting --experimental-encryption-provider.

Why wrong: etcd does not have such a flag; encryption is handled by Kubernetes.

The kubelet is not configured with the correct node IP.

Why wrong: Incorrect IP would cause registration failure, not intermittent deadline exceeded.

The new node does not have enough disk space for container images.

Why wrong: Disk space would cause image pull failures, not node status update failures.

The API server is overloaded and cannot handle the node update request.

Why wrong: Other nodes are fine, so API server is likely not overloaded.

The kubelet configuration file has incorrect node IP.

Why wrong: That would cause connection issues, not bootstrap CA failure.

The node's RBAC permissions are misconfigured.

Why wrong: RBAC is checked after the node is registered.

The API server is not running.

Why wrong: The API server is assumed running if the kubelet can connect.

Add a toleration for the control-plane taint.

Why wrong: The taint is on the control-plane node, but the event says 3 nodes didn't match anti-affinity; the taint issue is only on one node, but the main problem is anti-affinity.

Increase the number of replicas of the app to spread the pods.

Why wrong: More pods would make the anti-affinity harder to satisfy, not easier.

Delete the existing pods of the same app to free up nodes.

Why wrong: That would reduce availability, not a good practice.

NeverSchedule

Why wrong: Not a valid taint effect.

PreferSchedule

Why wrong: The correct name is 'PreferNoSchedule'.

Limits must be equal to requests for a Pod to be scheduled.

Why wrong: Limits can be greater than or equal to requests.

CPU limits guarantee the Pod will get that amount of CPU.

Why wrong: CPU is compressible; limits throttle, not guarantee.

Taint all worker nodes with a custom taint and add tolerations to batch Pods.

Why wrong: Taints/tolerations control scheduling but not preemption behavior.

Use nodeAffinity to schedule batch Pods on dedicated nodes.

Why wrong: Node affinity does not provide preemption or disruption protection.

Use resource quotas to limit the batch Pods' resource consumption.

Why wrong: Resource quotas limit usage but do not affect scheduling priority or disruption.

Use nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution for the GPU label.

Why wrong: While possible, nodeSelector is simpler and sufficient.

Set resources.limits for 'nvidia.com/gpu' only.

Why wrong: Without nodeSelector, the Pod may be scheduled on a non-GPU node and remain pending.

Add a toleration for GPU node taints.

Why wrong: No indication that GPU nodes have taints.