Kubernetes and Cloud Native Associate KCNA (KCNA) — Questions 901–975

Option D is correct because GitOps is a pattern where the entire system's desired state is declared in a Git repository, and an automated controller (such as Argo CD or Flux) continuously reconciles the live cluster state with that declarative configuration. This ensures that Git is the single source of truth, and any drift from the declared state is automatically corrected without manual intervention.

kube-apiserver exposes the Kubernetes API and handles all API requests.

Option B is correct because a multi-cloud strategy distributes workloads across multiple cloud providers, so if one provider experiences an outage, applications can failover to another provider, improving overall resilience and disaster recovery. Option C is correct because using multiple cloud providers prevents dependency on a single vendor's proprietary services, avoiding vendor lock-in and giving you leverage for pricing and feature negotiations.

Pending means the pod has not been scheduled to a node, often due to insufficient resources or node constraints.

Option C is correct because distributed tracing with tools like Jaeger or Zipkin allows you to follow a single request as it traverses multiple microservices, identifying exactly which service or call introduces latency. This approach does not require code changes (if the service mesh or sidecar proxy handles instrumentation) and is specifically designed to pinpoint performance bottlenecks in distributed systems, unlike CPU/memory metrics or log analysis which cannot trace a request's end-to-end path.

'kubectl set image' updates the container image and triggers a rolling update, which is the default update strategy for Deployments.

Option A is correct because recording rules allow Prometheus to pre-aggregate high-cardinality metrics (e.g., HTTP request labels with user IDs) at a lower granularity, reducing the number of unique time series stored in memory. This directly addresses the OOM issue caused by cardinality explosion without discarding raw data entirely, preserving the ability to query aggregated metrics for alerting over the required 7-day window.

The kube-controller-manager runs controllers that watch the state of the cluster and make changes to drive the current state toward the desired state.

Option A is correct because the kube-scheduler is the default scheduler in Kubernetes that watches for newly created pods with no assigned node and selects an optimal node for them based on resource availability, constraints, policies, and affinity/anti-affinity rules. It uses a filtering phase to find feasible nodes and a scoring phase to rank them, ensuring efficient resource utilization.

The kubelet on each node communicates with the API server and ensures that the containers described in pod specs are healthy and running.

The key difference is that containers virtualize at the operating system level, sharing the host OS kernel via namespaces and cgroups, while each virtual machine runs a full, separate guest OS on top of a hypervisor. This architectural distinction means containers are more lightweight and start faster, but VMs provide stronger isolation because they do not share the host kernel.

Option A is correct because `kubectl set image deployment/<name> <container>=<new-image>` triggers a rolling update, which is the default update strategy for Deployments. This gradually replaces old pods with new ones, ensuring that the desired number of replicas is always available, thus achieving zero downtime.

ConfigMaps allow you to decouple configuration artifacts from image content.

The OpenTelemetry project includes the API, SDK, and Collector. The Agent (as a separate component) and Exporter are part of the SDK/Collector, not standalone components.

kubectl apply uses declarative object management; it creates the object if it doesn't exist, but also updates existing objects by applying the configuration. The -f flag can be a file or directory.

The Container Runtime Interface (CRI) is a plugin interface that enables the kubelet to use a variety of container runtimes without needing to recompile the Kubernetes components. It defines the API for creating, starting, stopping, and deleting containers, allowing the kubelet to communicate with runtimes like containerd, CRI-O, or Docker (via dockershim, now deprecated). Option D is correct because the CRI's primary purpose is to abstract the runtime implementation from the kubelet, enabling interoperability.

The kubelet is the node agent that ensures containers are running and healthy, and it reports node status to the control plane. kube-proxy handles network rules, and the scheduler assigns pods to nodes.

If endpoints are empty, the Service selector does not match any pods, or the pods are not ready.

Option A is correct because HTTP headers, such as the `traceparent` and `tracestate` headers defined in the W3C Trace Context specification, are the standard mechanism for propagating trace context across service boundaries in distributed tracing. When a service receives an incoming HTTP request, it extracts the trace ID and span ID from these headers to continue the same trace. This allows trace data to be correlated across multiple microservices as the request flows through the system.

Prometheus has four metric types: Counter, Gauge, Histogram, and Summary. Counter and Gauge are two of them.

A Deployment manages ReplicaSets and supports declarative rolling updates, making it ideal for stateless applications.

A Pod is the smallest deployable unit in Kubernetes and can contain one or more containers that share the same network namespace. Containers in a Pod share the same IP and port space.

Option C is correct because `kubectl describe pod web-pod` retrieves a detailed, multi-section view of the pod's current state, including events, conditions, container statuses, and resource usage. This command is specifically designed for deep inspection of a Kubernetes resource, unlike `kubectl get` which shows a summary, or `kubectl logs` which shows container output.

A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

NetworkPolicy is a Kubernetes resource that defines how groups of pods are allowed to communicate with each other and other network endpoints. It works by specifying ingress and egress rules using pod selectors, namespace selectors, and IP blocks, and is enforced by a network plugin (CNI) that supports it, such as Calico or Cilium.

Option C is correct. 'kubectl scale deployment web-app --replicas=5' is the correct command to change the number of replicas. Option A is for creating resources, Option B inspects resources, and Option D edits the resource, but the scale command is more direct.

Terraform is the correct tool because it is an open-source infrastructure as code (IaC) software tool by HashiCorp that uses declarative configuration files (HCL) to provision and manage resources across multiple cloud providers (AWS, Azure, GCP, etc.) via provider plugins. Unlike single-cloud tools, Terraform's provider architecture allows it to manage heterogeneous environments consistently, making it the standard multi-cloud IaC solution.

Using Kubernetes as a consistent abstraction layer allows applications to run across different cloud providers with minimal modifications since it uses a common API and container orchestration. Cloud-specific APIs would lock you in, and hybrid cloud typically refers to mixing public and private cloud, not necessarily multi-cloud.

A Service of type ClusterIP provides a stable virtual IP and DNS name (e.g., my-service.namespace.svc.cluster.local) that load-balances traffic across the backend Pods. This is the correct resource because the frontend only needs a stable DNS name for internal cluster communication, and ClusterIP is the default Service type that fulfills this requirement without exposing the backend externally.

Option B is correct because an invalid image pull secret in the pod template prevents the kubelet from authenticating with the container registry, causing the pod creation to fail. The ReplicaSet controller attempts to create pods, but the scheduler cannot pull the image, so the pods remain in a pending or ImagePullBackOff state, never reaching the desired count of 3.

Mean time to restore (MTTR) is one of the four key DORA metrics defined by the DevOps Research and Assessment (DORA) team. It measures the average time it takes to recover from a failure in a production environment, directly reflecting the resilience and incident response capability of a cloud-native system. In Kubernetes, this often involves automated rollback strategies, pod rescheduling, or canary deployments to minimize downtime.

The kubelet is the primary node agent that runs on each worker node. Its core responsibility is to ensure that containers are running and healthy as defined by the PodSpec, which it receives from the API server. It does this by interacting with the container runtime (e.g., containerd or CRI-O) to start, stop, and monitor containers.

CrashLoopBackOff means the container keeps crashing. The error indicates a port conflict, often because the application tries to bind to a port already in use inside the container or host.

Secrets are designed to store sensitive information such as passwords, API keys, and certificates. ConfigMaps are for non-sensitive configuration data.

Option A is correct because etcd is the primary datastore for Kubernetes, storing all cluster state including objects like Pods, ConfigMaps, and Secrets. This ensures that the Kubernetes API server has a consistent, authoritative source of truth for the entire cluster.

A liveness probe indicates if a container is running; if it fails, kubelet restarts the container. A readiness probe indicates if a container is ready to serve traffic; if it fails, the Pod is removed from Service endpoints.

Option C is correct because the default Service type in Kubernetes is ClusterIP, which exposes the Service on a cluster-internal IP address. This means the Service is only reachable from within the cluster, providing a stable internal endpoint for pod-to-pod communication without external exposure.

kube-proxy maintains network rules to enable communication to services from inside or outside the cluster.

The 'ImagePullBackOff' error indicates that Kubernetes is unable to pull the container image from the registry. The most common cause during a Helm upgrade is a misconfigured or incorrect image tag in the Helm chart's values or templates, which causes the kubelet to fail when attempting to pull the specified image. This is distinct from runtime issues like probe failures or resource constraints, which would manifest as different error states.

The metrics-server collects resource metrics from kubelets and exposes them via the Metrics API.

Kubernetes has a built-in DNS service (typically CoreDNS) that automatically creates DNS records for Services. When Service A resolves the name 'service-b' (or 'service-b.<namespace>.svc.cluster.local'), the DNS returns the cluster IP of Service B's Service object, which then load-balances traffic to the healthy Pods. This is the most Kubernetes-native approach because it leverages the platform's own service discovery mechanism without external dependencies.

Rebuilding the image with an updated base image that includes the security fix is the standard approach to address base image vulnerabilities.

A Secret is the correct Kubernetes resource for storing sensitive data like database passwords because it encodes the value in base64 and can be mounted as a volume or injected as an environment variable into a Pod. Unlike ConfigMaps, Secrets are designed for confidential information and support optional encryption at rest when enabled in the cluster. This ensures the password is not stored in plaintext in the Pod specification or version control.

Flux has a source-controller that manages artifact sources (e.g., Git repositories), a kustomize-controller that applies Kustomize overlays, and a helm-controller for Helm releases. The gitops-controller is not a specific Flux component (it's a generic term), and the notification-controller is not a core component (it's a separate controller for events).

Option C is correct because Kubernetes enforces uniqueness of resource names only within the same Namespace. This allows you to reuse names like 'my-app' across different Namespaces (e.g., dev and prod), enabling logical separation without naming conflicts.

By default, Kubernetes DNS resolves service names only within the same namespace. To reach a service in another namespace, the fully qualified domain name (FQDN) must be used.

A DaemonSet ensures that a copy of the pod runs on every node, and automatically runs on new nodes when they are added.

Knative Serving manages serverless workloads and supports automatic scaling to zero when no requests are incoming.

fsGroup sets the group ID for the volume (if any) and all files in the volume will be owned by that group. It does not affect the container's primary group.

The CNCF's mission is to make cloud-native computing ubiquitous by fostering and sustaining an ecosystem of open source projects. Options A and B are incorrect because CNCF does not provide commercial support or host proprietary solutions. Option D describes a specific project goal, not the foundation's overarching purpose.

Jaeger was originally developed by Uber for distributed tracing.

With self-healing enabled, ArgoCD will detect the drift and revert the change to match the desired state defined in Git.

These are fundamental networking options for exposing services.

Option A is correct because `nodeSelector` is a simple, built-in field in the Pod spec that matches the pod to nodes with specific labels. When you add a `nodeSelector` with a key-value pair, the scheduler only places the pod on nodes that have that exact label. This is the most straightforward way to constrain a pod to a subset of nodes.

ConfigMaps are namespace-scoped objects, meaning they exist within a specific Kubernetes namespace and can only be referenced by Pods in that same namespace. This is a fundamental property of most Kubernetes resources, ensuring isolation and organization of configuration data across different environments or teams within a cluster.

The OpenTelemetry Collector receives, processes, and exports telemetry data to various backends.

PodInitializing indicates that the Pod is still initializing, e.g., pulling images or running init containers. Logs are not available until the container starts.

The 'OOMKilled' status indicates the pod's container was terminated by the Linux kernel Out-of-Memory (OOM) killer because it exceeded its configured memory limit. Since the pod ran successfully for days, this suggests a gradual memory leak or increased workload demand. Increasing the memory limit in the pod's container resource specification allows the container to use more memory before being killed, directly addressing the root cause.

The kubelet is the primary node agent that runs on each worker node, responsible for ensuring containers are running in a Pod as specified by the PodSpec. It performs liveness and readiness probes, starts and stops containers, and reports node and pod status to the control plane. Implementing network rules for Services, such as iptables or IPVS rules, is the responsibility of the kube-proxy, not the kubelet.

Services target pods by selector; if the pod is not ready due to failing readiness probes, it won't receive traffic.

The kubelet is the primary node agent that runs on every worker node. It registers the node with the cluster, receives Pod specifications from the API server, and ensures that the containers described in those Pods are running and healthy. Without the kubelet, a node cannot participate in the cluster as a worker.

Containerization (Option D) is a core principle of cloud native architecture because it packages applications and their dependencies into isolated, lightweight containers, enabling consistent deployment across environments and efficient resource utilization. This aligns with the cloud native goal of portability and scalability, as containers can be orchestrated by platforms like Kubernetes to manage dynamic workloads.

The kube-scheduler watches for unscheduled pods and assigns them to nodes based on resource availability and constraints.

Option D is correct because an emptyDir volume provides a simple, ephemeral storage solution that persists across container restarts within the same Pod. When a container crashes and is restarted by the kubelet, the emptyDir volume's contents remain intact, allowing log files to survive container restarts without requiring external storage or complex configuration.

The OOMKilled exit code indicates the container was terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it attempted to use more memory than its configured limit of 512Mi. Kubernetes enforces memory limits using cgroups; when the container exceeds the limit, the kernel kills the process, resulting in the OOMKilled status.

The kube-apiserver is the front-end of the Kubernetes control plane and the sole entry point for all administrative operations. It exposes the Kubernetes REST API, validates and processes requests (including authentication, authorization, and admission control), and updates the corresponding objects in etcd. Without the API server, no kubectl command, automation, or internal component communication can occur.

Option A is correct because Kubernetes DNS resolves a Service's ClusterIP using the fully qualified domain name (FQDN) format `<service>.<namespace>.svc.cluster.local`. Since the Service 'my-service' is in the 'default' namespace, a pod in the same namespace can reach it via `my-service.default.svc.cluster.local`. The DNS query returns the ClusterIP of the Service, allowing pods to communicate with it reliably.