Certified Kubernetes Application Developer CKAD (CKAD) — Questions 826–900

Option A is correct because Prometheus is the de facto standard for monitoring in Kubernetes, and scraping a Pod's /metrics endpoint is the recommended approach for collecting application-level metrics. This follows the Kubernetes best practice of exposing metrics via an HTTP endpoint that a monitoring system can scrape, rather than relying on ephemeral commands or resource-level metrics.

Service type LoadBalancer (C) exposes the Service externally by provisioning a cloud load balancer (e.g., AWS ELB, GCP L7) that routes external traffic to the Service's ClusterIP. Service type NodePort (D) exposes the Service on a static port (30000-32767) on every node's IP, allowing external access via <NodeIP>:<NodePort>. Both are valid methods for external exposure in Kubernetes.

To switch traffic, update the Service's selector to point to the green deployment's pods, which have label 'version: green'. kubectl patch is a direct way to update the selector.

Option B is correct because `--from-file` can take a key-value pair in the form `--from-file=<key>=<source>`, which creates a ConfigMap entry with the key `app.properties` and the value from the file `app.properties`. Option C is correct because `--from-env-file` reads a file containing key=value lines and creates a ConfigMap with each line as a separate entry. Option E is also correct because `--from-file=app.properties` creates a ConfigMap with a single entry whose key is the filename and value is the file content.

Option B is correct because it uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Kubernetes Secret of type Opaque. The `secretKeyRef` is the proper mechanism to inject a single key from a Secret as an environment variable, mapping the key 'password' to the environment variable name 'DB_PASSWORD'.

Option C is correct because the `kubectl create role` command uses the `--verb` flag (singular) with comma-separated values and the `--resource` flag (singular) with the lowercase plural resource name 'pods'. This matches the Kubernetes API convention where resources are specified as lowercase plurals (e.g., 'pods', 'deployments') and verbs are comma-separated.

Multi-stage builds allow you to copy artifacts from one stage to another using COPY --from. This reduces the final image size by discarding build dependencies.

To allow ingress only from pods in namespace 'backend', you need to use namespaceSelector under from, and also select the pod (optional if any pod). The correct YAML has a namespaceSelector matching the namespace label for 'backend'.

Cross-namespace DNS requires the full service name: 'service.namespace.svc.cluster.local'.

To enable TLS, you must specify a `tls` block with hosts and a secret name containing the certificate.

Option B is correct because Prometheus is the standard open-source monitoring and alerting toolkit in the Kubernetes ecosystem. By exposing metrics endpoints on each pod (typically at /metrics) and configuring a Prometheus server to scrape them, you can collect detailed performance data such as request latency, error rates, and resource utilization, which directly helps diagnose high-latency issues.

The pod is in CrashLoopBackOff with an OOMKilled message, which indicates the container is being terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it has exceeded its memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being killed, directly addressing the root cause.

A Pending state typically means the pod cannot be scheduled, often due to insufficient resources or node selector issues. Other options like container crash or readiness failure would result in different states.

Option A is correct because removing 'runAsNonRoot: true' eliminates the constraint that the container image must run as a non-root user. Since the image runs as root by default and no 'runAsUser' is set, the Pod fails. Removing the flag allows the container to start with its default root user.

When a Pod is in CrashLoopBackOff and `kubectl logs mypod` returns no output, the most likely cause is that the application crashes before it can write any logs to stdout/stderr. The container starts, runs briefly, and exits before the logging framework initializes, so no log data is captured by the container runtime.

kubectl describe pod provides detailed information about a pod.

Option C is correct because a startup probe is specifically designed for slow-starting containers. It runs before the liveness probe and allows the container extra time to initialize without being killed. By setting a high failureThreshold (e.g., 30) and an appropriate initialDelaySeconds, the probe can wait up to 5 minutes for the application to start, after which the liveness probe takes over.

A Role and RoleBinding are necessary because the pod's ServiceAccount 'my-sa' needs permissions to list pods within a specific namespace. A Role defines the allowed API operations (e.g., 'list pods') scoped to a namespace, and a RoleBinding binds that Role to the ServiceAccount, granting those permissions within that namespace. This is the standard RBAC pattern for namespace-scoped access in Kubernetes.

The `kubectl expose` command with `--type=LoadBalancer` creates a LoadBalancer Service.

A LoadBalancer Service in Kubernetes relies on an external cloud provider (e.g., AWS, GCP, Azure) to provision a real load balancer and assign its external IP. If no cloud provider is configured (e.g., in a bare-metal or Minikube cluster), the external IP will remain <pending> indefinitely because there is no controller to allocate the IP.

An Ingress with canary annotations or a Service Mesh such as Istio are commonly used. A single Service with multiple selectors does not split traffic. NetworkPolicy controls access, not routing.

Helm upgrade modifies a release with new values or chart changes. The --set flag overrides values inline.

The 'kubectl expose' command with appropriate flags creates a ClusterIP service by default. Option B is the correct command.

With maxUnavailable=0, no pods can be unavailable during the update. With maxSurge=1, one extra pod can be created above the desired 5, so total running pods can be 6. The new pod is created first, then the old pod is terminated, ensuring 5 pods are always available.

The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler attempted to place the pod on a node but found that the node's allocatable memory is less than the pod's memory request. The pod's memory request must be satisfied by at least one node for scheduling to succeed; if no node has enough unallocated memory, the pod remains Pending. This is a resource request, not a limit, that gates scheduling.

Option C is correct because setting `automountServiceAccountToken: false` in the pod spec prevents the automatic mounting of the service account token, while `serviceAccountName: my-sa` specifies the desired service account. This satisfies both requirements: using the custom service account and disabling token mounting.

The 'kubectl expose' command is used to create a Service from a resource. The correct syntax is 'kubectl expose deployment my-deploy --name=my-svc --port=80'.

Option C is correct. 'successfulJobsHistoryLimit' controls how many successful job runs are retained. Option A is for failed jobs. Option B and D are not valid fields.

Option B is correct because `.spec.successfulJobsHistoryLimit` is a valid field in a CronJob spec that controls how many completed jobs are retained for inspection. This field defaults to 3 and helps manage cluster resource usage by limiting the number of successful job records kept in the history.

Option B is correct because a Kubernetes Service provides a stable virtual IP and DNS name that remains constant even as the underlying pods are created, destroyed, or rescheduled. This decouples clients from the ephemeral nature of pod IPs, ensuring reliable connectivity to the pod group.

In Helm, to upgrade an existing release with new values, you use 'helm upgrade' with the release name and chart. You can pass new values via --set or --values.

Option A is correct because `envFrom` with a `configMapRef` injects all key-value pairs from the named ConfigMap as environment variables into the container. This is a concise way to consume multiple variables without specifying each key individually, as defined in the Kubernetes API for Pods.

The 'kubectl scale' command is used to set the desired number of replicas for a Deployment.

Option C is correct because `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=mypwd` creates a secret with key 'password' and value 'mypwd', which is the exact requirement.

Option C is correct: Init containers run to completion before any main container starts. The startupProbe begins after the main container starts, which is after the init container completes. So the startupProbe begins after 10 seconds (init) plus the initialDelaySeconds (5) = 15 seconds.

Option B is correct because the pod's securityContext settings override the USER directive in the container image. The runAsUser: 1000 sets the container process to run as user 1000, and fsGroup: 2000 sets the group ownership of any mounted volumes to group 2000. The runAsNonRoot: true ensures the container does not run as root, but since the securityContext explicitly sets a non-root user, the check passes and the pod runs successfully.

Multi-stage builds allow copying only the compiled binary from the builder stage, leaving behind build tools and intermediate files, resulting in a smaller final image.

The 'maxSurge' field specifies the maximum number of pods that can be created above the desired number during a rolling update.

A startup probe is designed for slow-starting containers. It runs only during startup and disables liveness and readiness probes until it succeeds.

A HorizontalPodAutoscaler automatically scales the number of pods in a Deployment, ReplicaSet, or StatefulSet based on observed CPU utilization (or other custom metrics).

The liveness probe starts after 10 seconds and will fail repeatedly because the application is not ready. After 3 failures (30 seconds total), the container is restarted, but it still needs ~120 seconds to start, causing a loop. A startup probe should be used to give the container time to start before liveness probes begin.

Option C is correct because the pod must have the service account token mounted to authenticate to the Kubernetes API server. By default, Kubernetes automatically mounts the service account token into pods via a projected volume at /var/run/secrets/kubernetes.io/serviceaccount/token. If the pod is configured with automountServiceAccountToken: false or the token is not mounted, the API client cannot authenticate, resulting in a 403 Forbidden error even if the RoleBinding grants the correct permissions.

Option C is correct because the `pod-security.kubernetes.io/enforce=restricted` label enforces the 'restricted' Pod Security Standard on the namespace, preventing any pod that violates the restricted policy from being created. This label directly activates Pod Security Admission (PSA) enforcement mode, which blocks non-compliant pods at admission time.

The short form 'backend' works for services in the same namespace. The full DNS name is 'backend.default.svc.cluster.local', but within same namespace, just 'backend' is sufficient.

A Readiness probe is the correct choice because it controls whether a pod is added to a Service's endpoints. Kubernetes will only mark a pod as Ready when the probe succeeds, and only Ready pods receive traffic from the Service. This ensures new pods are not added until the application is ready to serve traffic.

maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

The 'kubectl rollout undo' command rolls back a Deployment to the previous revision. By default, it reverts to the immediate prior revision (revision 1 less than current).

Option C is correct because `envFrom` with `configMapRef` is the Kubernetes-native way to expose all keys from a ConfigMap as environment variables in a pod. This injects each key-value pair from the ConfigMap 'app-config' as an environment variable, matching the requirement to expose all keys without manual enumeration.

For a StatefulSet to provide DNS-based pod discovery, its associated Service must be headless (clusterIP: None). A headless Service creates DNS A/AAAA records for each pod's hostname (e.g., backend-svc-0.backend-svc.default.svc.cluster.local), enabling direct pod-to-pod resolution. If the Service is not headless, DNS queries for individual pod hostnames will not resolve, breaking clustering discovery.

Option C is correct because it uses the `configMapKeyRef` field under `valueFrom` in the `env` array to inject a specific key from a ConfigMap as an environment variable. This is the standard Kubernetes syntax for referencing a single key from a ConfigMap, where `name` specifies the ConfigMap object and `key` specifies the key within that ConfigMap whose value will be assigned to the environment variable `APP_COLOR`.

Service types define how traffic reaches pods.

restartPolicy controls whether the main container is restarted; livenessProbe checks health and can restart the container; readinessProbe does not restart.

A shared volume, such as an emptyDir volume mounted into both containers, allows the sidecar to access the web server's log files.

To mount a ConfigMap as a volume in a Pod, the `configMap` field type must be specified in the `volumes` array of the Pod spec, and the corresponding `volumeMounts` entry references that volume by name. This tells Kubernetes to populate the volume with the key-value pairs from the ConfigMap, making them available as files in the container's filesystem.

Option D is correct because the `runAsUser` field in the pod's securityContext explicitly sets the user ID (UID) for all processes in the container. In this manifest, `runAsUser: 1000` overrides the default UID (usually 0, root) and ensures that the container's main process runs with UID 1000. The `runAsGroup` and `fsGroup` fields affect group IDs and file ownership, not the process UID.

NGINX is one of the most common Ingress controllers, along with others like Traefik, HAProxy, and Contour.

Option B is correct because `kubectl create secret generic` with `--from-literal` is the proper syntax for specifying literal key-value pairs directly in the command. Each literal must be prefixed with `--from-literal=key=value`, and multiple literals can be provided to create a Secret containing both the username and password keys.