Kubernetes and Cloud Native Associate KCNA (KCNA) — Questions 976–997

NetworkPolicy is the correct resource because it is a Kubernetes-native object that defines how groups of pods are allowed to communicate with each other and other network endpoints. By specifying a pod selector matching 'app: frontend' and an ingress rule allowing TCP port 8080, you can restrict inbound traffic to only those pods with that label in the same namespace.

A Deployment manages ReplicaSets, which in turn manage Pods. This is the core abstraction: the Deployment controller creates and updates ReplicaSets to achieve the desired state, and each ReplicaSet ensures a specified number of Pod replicas are running. This layered architecture enables features like rolling updates and rollbacks without the Deployment directly interacting with individual Pods.

The sidecar proxy (often Envoy) intercepts all traffic and collects metrics, traces, and logs, and also enforces traffic management rules.

Microservices are one of the key architectural principles of cloud native applications.

The 12-factor app methodology states that configuration should be stored in environment variables to separate config from code.

etcd is a distributed key-value store that persists the entire cluster configuration and state.

Option D is correct. etcd is a distributed key-value store that holds the cluster state and configuration. kube-apiserver exposes the API, kube-scheduler assigns pods to nodes, and kube-controller-manager runs controllers.

The kube-controller-manager runs controller processes that regulate the state of the cluster. The ReplicaSet controller, which runs inside the kube-controller-manager, is responsible for ensuring that the desired number of pod replicas are running at all times, creating or deleting pods as necessary to match the specified replica count.

Event-driven execution and auto-scaling to zero are key serverless characteristics.

With a RollingUpdate strategy, the Deployment controller replaces old Pods with new ones incrementally to ensure zero downtime. By default, it creates new Pods before terminating old ones (maxSurge=25%, maxUnavailable=25%), so one new Pod is created first, then one old Pod is terminated, repeating until all 4 Pods run the new image.

The SLO is based on latency, which is typically measured using a histogram to track request durations.

PersistentVolumeClaims (PVCs) request storage from PersistentVolumes (PVs), which are cluster resources that provide durable storage independent of pod lifecycle.

Fluent Bit is a lightweight log processor and forwarder, ideal for Kubernetes nodes.

Option D is correct because `kubectl set image deployment/my-deployment my-container=myapp:v2 --record` directly updates the container image of a specified container within a Deployment and triggers a rolling update by default. The `--record` flag annotates the change for audit history, which is useful for tracking rollouts. This command is the standard imperative approach for updating container images in Kubernetes Deployments.

The CNCF is a vendor-neutral foundation that hosts and fosters cloud native projects like Kubernetes, Prometheus, and Envoy, promoting cloud native technologies and practices.

kube-proxy on each node implements the Service by setting up iptables or IPVS rules to distribute traffic to the endpoints.

Option C is correct because Kubernetes Secrets are designed specifically to store sensitive data like database passwords. Mounting the Secret as a volume ensures the secret data is available to the pod as files, without being exposed in environment variables (which can be leaked via logs or `kubectl describe`) or embedded in the container image. This approach follows security best practices for handling sensitive information in cloud-native applications.

Node controller and Replication controller are part of the controller-manager. The scheduler is a separate component. kubelet is a node agent, not a controller.

The container's entrypoint or command may be misconfigured, causing the container to exit immediately.

Option C (LoadBalancer) is correct because it provisions an external load balancer (e.g., AWS ELB, GCP TCP LB) that assigns a public IP address to the Service, making it accessible from outside the cluster. Option E (NodePort) is correct because it exposes the Service on a static port (30000–32767) on every Node's IP, allowing external traffic to reach the Service via `<NodeIP>:<NodePort>`. Both are valid Service types in Kubernetes for external exposure.