CCNA Application Design and Build Questions

Setting `concurrencyPolicy: Forbid` explicitly tells Kubernetes to skip creating a new job if the previous job from the CronJob is still running. This prevents overlapping executions, which is exactly the requirement. The `Forbid` policy is the standard Kubernetes mechanism for ensuring at-most-once execution per scheduled interval.

CronJob is a Kubernetes resource that was promoted to a stable API version in Kubernetes 1.21. The correct API version for creating a CronJob is batch/v1, as it is the current stable version. The batch/v1beta1 version is deprecated and removed in Kubernetes 1.25, so batch/v1 is the correct choice for CKAD exam scenarios.

These are core Kubernetes resources with distinct roles. Pods are the smallest deployable units; Services provide networking abstractions; Deployments manage scaling and updates; ConfigMaps handle configuration data.

Pending often indicates resource constraints like insufficient CPU or memory.

The CMD instruction in a Dockerfile provides default command(s) for the executing container. When a user runs `docker run image [COMMAND]`, the provided COMMAND overrides the CMD value, making it the correct choice for a command that can be overridden by command-line arguments.

`kubectl debug` with the `--image` flag creates an ephemeral container in the specified pod for interactive debugging. The `-it` flag provides an interactive TTY, and `--target=web-container` attaches the ephemeral container to the same Linux namespace as the target container, allowing direct troubleshooting of the unresponsive pod without modifying its original containers.

When `concurrencyPolicy: Forbid` is set on a CronJob, the CronJob controller will skip creating a new Job if the previous Job from the last schedule is still running. The new Job is effectively skipped (not queued) until the next scheduled time, preventing overlapping executions. This ensures that only one instance of the Job runs at a time.

In a CronJob specification, `successfulJobsHistoryLimit` is a valid field that controls how many completed jobs are retained in the cluster's history. This field defaults to 3 and helps manage resource usage by automatically cleaning up old Job records after the limit is exceeded.

`spec.parallelism: 3` limits the maximum number of pods running concurrently, and `spec.completions: 10` ensures the Job runs 10 work items to completion. This combination processes all 10 items in parallel batches of 3, meeting the requirement of a one-time batch job with a maximum of 3 pods at a time.

The `--from=builder` flag in the COPY instruction allows you to copy files from a specific build stage (named 'builder') in a multi-stage Docker build. This syntax is essential for multi-stage builds, where the first stage compiles artifacts and the second stage copies only the necessary binaries, reducing final image size.

C is correct because when `concurrencyPolicy: Forbid` is set, the CronJob controller skips creating a new job if the previous job is still running at the next scheduled time. Since the first job takes 7 minutes and the schedule is every 5 minutes, the new job is skipped to prevent overlapping executions.

`kubectl debug` is the dedicated command for adding an ephemeral container to a running Pod for troubleshooting. The `--image=nicolaka/netshoot` flag specifies the network debugging image, and `-c debugger` names the ephemeral container. This allows the developer to attach to the Pod's network namespace without restarting or modifying the original container.

In a multi-stage Docker build, the COPY instruction with the --from flag allows you to copy files from a named previous stage (here 'builder') into the current stage ('final'). This is the correct syntax to selectively transfer build artifacts without carrying over intermediate layers or dependencies.

First, define the Deployment in YAML. Then apply it. After an update, modify the YAML and re-apply; kubectl performs rolling update automatically.

The COPY instruction with --from=stage-name copies files from a previous build stage.

B is correct because `concurrencyPolicy` is a valid field in a CronJob spec that controls how concurrent executions of the job are handled. It can be set to `Allow`, `Forbid`, or `Replace`, which determines whether a new job can start while a previous one is still running.

Init containers run to completion before app containers start, ensuring order.

`spec.parallelism` in a Kubernetes Job spec defines the desired number of Pods that should run concurrently. Setting `spec.parallelism: 3` tells the Job controller to run exactly 3 Pods in parallel, meeting the requirement of running 3 pods simultaneously.

Kubernetes supports exactly three restart policies for Pods: Always, OnFailure, and Never. 'UnlessStopped' is not a valid restart policy in the Kubernetes API; it is a fabricated option designed to test your knowledge of the allowed values for the `restartPolicy` field in a Pod spec.

StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Init containers are specialized containers that run to completion before any main application containers in the pod start. They must exit with a zero status (success) for the pod to proceed to the next init container or to start the main containers. This ensures prerequisite setup tasks are completed before the application runs.

When `backoffLimit: 0` is set in a Job spec and the pod fails immediately, the Job controller does not retry the pod because the backoff limit is zero. According to Kubernetes Job semantics, the Job is considered failed once the number of failures reaches the `backoffLimit` (0 in this case), so the Job transitions to a Failed state without any further pod creation or retries.

`kubectl debug` is specifically designed to add an ephemeral container to a running pod for troubleshooting purposes, even when the original container lacks a shell. The `--image=busybox` flag provides a lightweight image with common debugging tools, and `--stdin --tty` allocates an interactive terminal, allowing you to run commands like `/bin/sh` inside the ephemeral container without modifying the original pod's containers.

The .dockerignore file supports pattern matching using glob patterns, similar to .gitignore. This allows you to define patterns to exclude files and directories from the Docker build context, preventing them from being sent to the Docker daemon during a build.

Init containers in a Kubernetes Pod are executed sequentially in the exact order they are defined in the `initContainers` array. Each init container must exit successfully (return code 0) before the next one starts, ensuring a strict dependency chain for initialization tasks.

In Kubernetes v1.29, the correct apiVersion for a CronJob is batch/v1, as CronJob has been stable since v1.21. Option D is correct because batch/v1 is the stable API version for CronJob resources in this release.

Deployment first, then define NodePort Service, apply, retrieve port, then access externally.

It uses a multi-stage build: the first stage uses the official `golang:1.21` image to compile the Go binary, and the second stage copies only the compiled binary into a `scratch` (empty) image. This produces a minimal image containing only the binary and no build tools, reducing attack surface and image size.

The `EXPOSE` instruction in a Dockerfile informs Docker that the container listens on the specified network port at runtime. It is a metadata declaration that does not actually publish the port; it serves documentation and inter-container communication purposes via Docker networks.

The adapter pattern is used to adapt the interface of a container to match what another system expects. In this case, the sidecar container scrapes the web server's logs and exposes them as Prometheus metrics, effectively adapting the web server's log output into a format Prometheus can scrape. The other patterns: generic sidecar adds functionality without transforming output; ambassador proxies external connections; init containers run before main containers start.

The `schedule` field defines the cron expression that determines when the CronJob runs (e.g., `*/5 * * * *`). This is a mandatory field in a CronJob manifest as per the Kubernetes API specification, without which the controller cannot determine the execution timing.

'parallelism' is a valid field in the '.spec' of a Job manifest. It controls the maximum number of Pods that can run concurrently for the Job, allowing you to manage parallel execution. This field is part of the Job specification in the Kubernetes API, distinct from Deployments or other controllers.

Sidecar containers are auxiliary containers that enhance or extend the functionality of the main application container. Common use cases include log collection (e.g., Fluentd), service mesh proxies (e.g., Envoy), and data synchronization (e.g., rsync or a Git sync sidecar). These tasks support the primary workload without altering its code.

`.spec.parallelism=2` directly specifies the maximum number of Pods that can run concurrently for the Job. The `.spec.completions=5` value only sets the total number of successful completions required, not the parallelism. Therefore, at any given time, only 2 Pods will run simultaneously.

Init containers run to completion before any pod containers start, making them ideal for filesystem setup tasks like changing ownership (chown) or permissions (chmod) on a shared volume. This ensures the main container can access the volume without requiring privileged mode or extra security context settings.

`docker build -t myapp:v1 .` uses the `-t` flag to tag the image with the name `myapp` and tag `v1`, and the `.` specifies the build context as the current directory. This is the standard syntax for building and tagging a Docker image from a Dockerfile in the current directory.

Kubernetes Secrets store data as base64-encoded strings in YAML manifests. This encoding is not encryption; it simply converts binary or non-printable data into an ASCII string format for safe inclusion in YAML. The base64 encoding is a standard practice for representing arbitrary data in Kubernetes resource definitions.

The COPY instruction is used to copy files and directories from the build context into the Docker image filesystem. It is the preferred method for adding local files because it is explicit and does not perform any automatic extraction or URL fetching, making builds more predictable and secure.

Init containers are designed to run sequentially to completion before any of the pod's regular application containers start. This ensures that prerequisites, such as database schema migrations or configuration file generation, are completed before the main application begins execution.

Init containers must run successfully (exit 0) before the main containers start. If an init container fails, Kubernetes restarts it (if restartPolicy is Always or OnFailure) until it succeeds. The pod will remain in Init:Error state until the init container succeeds.

The .dockerignore file must be placed in the root of the build context (the directory specified as the build context in the `docker build` command). The Docker client reads this file to determine which files and directories to exclude from the build context before sending it to the Docker daemon. Without it in the correct location, the ignore rules are not applied.

The command `kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml` creates a Pod manifest because `--restart=Never` explicitly sets the restart policy to Never, which is a Pod-level field. The `kubectl run` command without `--restart=Never` defaults to creating a Deployment, but with `--restart=Never`, it generates a standalone Pod. The output uses `apiVersion: v1`, which is the correct and stable API version for Pods.

Kubernetes Jobs are part of the batch API group, and starting from Kubernetes v1.21, the batch/v1 API version is stable and the only supported version for Jobs. In v1.29, batch/v1beta1 has been removed, so batch/v1 is the correct and required apiVersion.

The error message '0/1 nodes are available: 1 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on the node. The scheduler cannot place the pod because no node has enough unallocated memory to satisfy the pod's memory request. This is a scheduling failure, not a runtime issue.

`.spec.successfulJobsHistoryLimit` is a valid field in a CronJob spec that controls how many completed jobs are retained for inspection. This field defaults to 3 and helps manage cluster resource usage by limiting the number of successful job records kept in the history.

Multi-stage builds allow copying only the compiled binary from the builder stage, leaving behind build tools and intermediate files, resulting in a smaller final image.

Common Kubernetes service types: ClusterIP (internal), NodePort (static port on nodes), LoadBalancer (cloud LB), ExternalName (DNS alias). Here, correct matches are A and C.

The Ambassador pattern is a valid multi-container pod pattern where a proxy container handles network communication on behalf of the main application container, abstracting external service connectivity. This pattern is commonly implemented with tools like Envoy or a custom sidecar proxy that manages TLS termination, service discovery, or circuit breaking, allowing the main container to connect to localhost while the ambassador handles remote connections.

The CMD instruction in a Dockerfile sets a default command that runs when a container starts. This default can be overridden by providing arguments directly to 'docker run' after the image name, making it the correct choice for a command that is intended to be easily replaced.

The `kubectl create -f pod.yaml` command is correct because it instructs Kubernetes to create a resource (in this case, a Pod) defined in the specified YAML file. This is a declarative command that submits the resource manifest to the API server, which validates and stores it in etcd, resulting in the resource being created in the cluster.

Multi-stage builds allow copying only the binary from the build stage to a minimal base image, drastically reducing final image size.

The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

`initContainers` run sequentially before the main application containers in a Pod, ensuring the sidecar log-rotation container completes its startup tasks before the web server container starts. This enforces a strict startup order, which is not achievable with regular containers that start concurrently.

The `docker tag` command explicitly creates a new tag referencing an existing image, allowing you to assign a new name and tag (e.g., `myrepo/myapp:1.0`) to an already built image (e.g., `myapp:1.0`). This is a standard way to prepare an image for pushing to a registry without rebuilding.