Kubernetes and Cloud Native Associate KCNA (KCNA) — Questions 226–300

Helm manages Kubernetes application releases as packaged charts. The `helm rollback` command allows you to revert to a previous revision of a release, which is a core benefit for safe application delivery and disaster recovery. This capability is built into Helm's release management system, which tracks each deployment as a revision with a unique version number.

The scheduler cannot place the pod because no node has enough available CPU to meet the pod's request.

A Service of type ClusterIP exposes a stable virtual IP (the cluster IP) and port within the cluster. Pods reach the Service by sending traffic to this cluster IP and port, which is then load-balanced by kube-proxy (using iptables, IPVS, or eBPF rules) to one of the backing pod endpoints. This is the default and most fundamental Service type in Kubernetes.

When a Pod remains in Pending state, it means the scheduler cannot find a node that satisfies the Pod's resource requirements (CPU, memory, or other constraints). Since two Pods are running successfully, the Deployment configuration (image, name, selector) is valid, and the issue is that the cluster lacks sufficient capacity to schedule the third replica. The scheduler continuously evaluates node resources and will leave the Pod pending until resources become available or the request is adjusted.

The kubelet is the primary node agent that runs on each node. It ensures that containers are running in a pod as described in the pod spec.

Option C is correct. A container runtime error typically causes the pod to stay in 'ContainerCreating' or crash, not 'Pending'. Pending usually indicates scheduling issues (insufficient resources, node selector/label mismatch) or storage issues (PVC not bound).

A nodeSelector is a simple pod spec field that matches node labels. The correct format is a map of key-value pairs under 'spec.nodeSelector'.

Option B is correct because a ConfigMap is a Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Mounting a ConfigMap as a volume makes its data available as files in the pod's filesystem, allowing applications to read configuration without hardcoding it into the container image or pod spec. This approach decouples configuration from containerized applications, following the principle of immutable infrastructure.

A Pod is the smallest deployable unit in Kubernetes, representing a single instance of a running process in the cluster.

Prometheus is a metric system that collects and stores numeric time-series data.

Kustomize uses overlays to customize Kubernetes manifests without templating. It does not use values files or require a package manager.

ClusterIP is the default Kubernetes Service type that exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, which is exactly what is required for internal-only communication between pods. No external traffic can reach a ClusterIP service unless an ingress controller or proxy is explicitly configured.

The kube-scheduler assigns pods to nodes based on resource requirements, policies, and constraints.

SLO of 99.9% means up to 0.1% errors are allowed. 0.1% of 10,000,000 is 10,000 requests.

The 'kind' field is required because it tells Kubernetes which type of object to create (e.g., Pod, Deployment, Service). Without it, the API server cannot route the manifest to the correct resource handler. It must be a valid Kubernetes resource kind from the core API or a custom resource definition.

A Service provides a stable IP address and DNS name that routes traffic to a set of pods, regardless of pod IP changes.

Option C is correct because with maxUnavailable=25% and maxSurge=25%, the maximum number of unavailable Pods during a rolling update is calculated as the ceiling of 25% of the desired replicas (5), which is 2. This means up to 2 Pods can be unavailable at any time, ensuring the rollout can proceed while maintaining availability.

ArgoCD assesses health based on Kubernetes resource status and can take actions when health degrades.

OCI images are composed of layers (read-only) and are built from a Dockerfile. They are lightweight and portable across different runtimes. They do not include a guest OS (unlike VMs), and they are not tied to a specific runtime.

Flux's Source Controller fetches artifacts (e.g., Git repositories, Helm repos) but does not apply changes. The Kustomize Controller is the primary controller that reconciles the desired state from those sources to the cluster.

The OpenTelemetry specification defines the API, SDK, and data model. These are the core components.

When the control-plane node becomes unreachable, the kube-controller-manager cannot communicate with the kubelet on the worker node, so it stops performing scheduling and reconciliation. However, the kubelet on the worker node continues to run existing pods based on the last known desired state stored locally, and the pods themselves are managed by the container runtime (e.g., containerd) independently of the control-plane. Therefore, pods continue running normally, but no new pods can be scheduled because the scheduler, which runs on the control-plane, is unavailable.

A Pod in 'Pending' state indicates that the scheduler has not yet assigned it to a node. The most common reason is insufficient resources (CPU or memory) on any available node, causing the scheduler to fail to find a suitable node that meets the Pod's resource requests. This is a core scheduling failure in Kubernetes.

Container orchestration platforms like Kubernetes provide automated scaling, self-healing, and declarative management.

ClusterIP services are reachable via DNS if CoreDNS is running. If the service name is not resolvable, CoreDNS might be misconfigured or not running.

Option D is correct because structured logging (e.g., JSON format) enables efficient indexing and querying of logs, while sampling debug logs and retaining error logs fully reduces storage costs without losing critical error patterns. This approach balances observability needs with cost optimization, a key principle in cloud-native environments.

Option A is correct because ConfigMaps can be exposed as files in a pod's filesystem using a volume mount. When you define a ConfigMap as a volume in the pod spec and mount it via volumeMounts, each key in the ConfigMap becomes a file in the specified mount path, with the key's value as the file content. This is a standard method for injecting configuration data into containers without modifying the container image.

ConfigMap is the correct Kubernetes resource for providing configuration data that does not change often and should not be baked into the container image. It decouples configuration artifacts from image content, allowing you to update configuration without rebuilding images, and supports injection via environment variables, command-line arguments, or volume mounts.

Alertmanager configuration includes 'route' for routing alerts and 'receivers' for notification channels. 'prometheus_rules' is part of Prometheus configuration, not Alertmanager. 'alert' and 'group_by' are not top-level Alertmanager config keys.

A Service of type ClusterIP exposes a set of pods as a network service within the cluster by assigning a stable virtual IP address and DNS name. Traffic to this IP is load-balanced across the pods matching the Service's label selector, enabling internal cluster communication without external exposure.

The kube-apiserver is the front-end of the Kubernetes control plane and exposes the Kubernetes API.

Container orchestration platforms like Kubernetes provide high availability through replication, self-healing by restarting failed containers, and declarative management via desired state configuration. Network isolation is typically provided by network policies but is not a core orchestration benefit.

Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

ArgoCD synchronizes the cluster state with the desired state defined in a Git repository.

A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and DNS name that remains constant even as pods are created or destroyed. It automatically load-balances traffic across the set of pods matching its label selector using iptables or IPVS rules, ensuring reliable network endpoints for clients.

Containers are lightweight because they share the host OS kernel, avoiding the overhead of a separate guest OS per instance. Unlike VMs, which require a hypervisor and a full OS for each virtual machine, containers run as isolated processes on the same kernel, enabling faster startup times and higher density. This shared-kernel model is the primary benefit, as it reduces resource consumption and improves efficiency in orchestrated environments like Kubernetes.

Containers share the host OS kernel and run as isolated processes, while VMs include a full guest OS and run on hypervisor-managed virtual hardware.

Option A is correct because a startup probe must succeed before the kubelet considers the container started. Until the startup probe succeeds, the readiness and liveness probes are not active, so the pod cannot be marked healthy or ready. This is defined in the Kubernetes API for startup probes, which delay the start of other probes until the application has initialized.

The HorizontalPodAutoscaler (HPA) automatically scales the number of pod replicas in a deployment based on observed CPU/memory utilization or custom metrics. This directly addresses the need to handle a sudden traffic spike without manual intervention by adding more pod instances to distribute the load.

The 12-factor app methodology recommends storing configuration in environment variables to keep it separate from code and vary per deploy.

Service mesh provides traffic management (routing), observability (metrics, tracing), and security (mTLS, policies).

Prepare the file, create ConfigMap, verify, describe, and use it in a Pod.

Option C is correct because Kubernetes includes built-in service discovery and load balancing. Services in Kubernetes get a stable virtual IP and DNS name, and kube-proxy implements load balancing across pods using iptables or IPVS rules, distributing traffic without manual configuration.

Fluent Bit is a lightweight log processor and forwarder, designed for resource-constrained environments like Kubernetes nodes.

etcd is a distributed key-value store that stores all cluster data, including configuration, state, and metadata.

ArgoCD is a declarative GitOps tool built specifically for Kubernetes.

Namespaces provide logical isolation and are used to divide cluster resources among multiple users or teams. Some resources, like nodes and PersistentVolumes, are cluster-scoped and not namespaced.

A Service provides a stable endpoint (IP/DNS) and load balancing for a set of pods.

Container orchestration platforms like Kubernetes provide self-healing capabilities by automatically restarting failed containers, rescheduling them on healthy nodes, and replacing or terminating containers that fail health checks. This ensures that the desired state of the application is maintained without manual intervention, which is a core benefit of orchestration.

Container orchestration provides high availability via replicas, scaling (both manual and autoscaling), and self-healing (restarting failed containers). Bare metal performance is not a direct benefit of orchestration; it is a characteristic of containers themselves. Manual deployment is the opposite of orchestration.

Option A is correct because container orchestration platforms like Kubernetes implement automated failover by monitoring container health via liveness probes and rescheduling pods on healthy nodes when a node fails. This ensures that applications remain available even when underlying infrastructure components fail, which is a core benefit of orchestration.

An API gateway acts as a single entry point for client requests, handling routing, authentication, rate limiting, and other cross-cutting concerns.

Option C is correct because cloud-native architecture principles advocate for decentralized data management, where each microservice owns its private data store and exposes functionality via well-defined APIs. This ensures loose coupling, independent scalability, and resilience, as services can evolve without impacting others. The pattern aligns with the Database per Service pattern, a core tenet of microservices design.

The default strategy for Deployments is RollingUpdate, which gradually replaces old Pods with new ones without downtime, and by default it keeps no old Pods running after the update completes.

ConfigMap is designed to store non-sensitive configuration data as key-value pairs or files.

containerd is a CRI-compliant runtime that manages containers, while kubelet interacts with it via CRI.

With maxUnavailable=0, the controller ensures no pods are unavailable during the update, but it may create new pods before terminating old ones, potentially causing resource contention.

ArgoCD Image Updater is the official tool to automatically update image tags in Kubernetes manifests (including Helm values) and commit changes to Git, triggering ArgoCD to sync.

The Circuit Breaker pattern is correct because it prevents cascading failures by monitoring for failures and, once a threshold is exceeded (e.g., 5 consecutive timeouts), it opens the circuit and immediately fails fast without waiting for the downstream service. This allows the application to handle periodic timeouts gracefully by avoiding wasted resources and providing a fallback response, which is critical for cloud-native resilience in Kubernetes.

Grafana is the most popular visualization tool for Prometheus metrics, offering rich dashboards.

Prometheus is a graduated CNCF project, having reached the graduation maturity level in August 2018. The CNCF graduation criteria require projects to demonstrate adoption, governance maturity, and long-term stability, which Prometheus meets as a core monitoring and alerting toolkit widely used in cloud-native environments.

A Pod is the smallest and simplest Kubernetes object. It represents a single instance of a running process in the cluster.

Option C is correct because `kubectl set image deployment/nginx nginx=nginx:1.21 --record` updates the container image of the specified deployment and, with the `--record` flag, annotates the change in the rollout history (stored in the `kubernetes.io/change-cause` annotation). This allows you to later inspect the change with `kubectl rollout history deployment/nginx`.

Namespaces provide logical isolation and scope for resources within a cluster, allowing multiple virtual clusters backed by the same physical cluster.

The Database-per-service pattern is the correct answer because it ensures each microservice owns and manages its own database, enforcing loose coupling and data encapsulation. This aligns with the cloud-native principle of decentralized data management, where services communicate only via APIs and never access each other's databases directly. It prevents tight coupling at the data layer, which is critical for independent scaling, deployment, and resilience in a microservices architecture.