CCNA Kcna Kubernetes Fundamentals Questions

Option B is correct because in Kubernetes, the `resources.requests.cpu` field specifies the minimum amount of CPU guaranteed to a container. This value is used by the scheduler to ensure the node has enough allocatable CPU, and by the kubelet to enforce CPU shares via the Completely Fair Scheduler (CFS) in the Linux kernel.

A Service of type NodeType exposes the pods on a static port on each node's IP address, making the service accessible externally. This is a valid method for exposing a set of pods as a network service in Kubernetes.

Option C is correct because `kubectl apply -f file.yaml` uses a declarative approach to create or update Kubernetes resources. It sends the YAML configuration to the API server, which compares the desired state with the current state and applies the necessary changes, storing the last-applied configuration in an annotation for future updates.

The Kubernetes control plane manages the cluster's state and scheduling decisions. The kube-apiserver (C) is the front-end for the control plane, exposing the Kubernetes API, while etcd (D) is the distributed key-value store that holds all cluster data, including configuration and state. Both are essential control plane components.

NodePort and LoadBalancer are two Service types that expose applications externally.

A Job is designed to run a specified number of pods to successful completion, ideal for batch processing.

The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API for all cluster operations. The kube-scheduler is responsible for assigning newly created pods to nodes based on resource availability and policy constraints. Both are essential control plane components that manage cluster state and scheduling decisions.

The node is tainted, and the pod lacks the corresponding toleration. The scheduler cannot schedule the pod on that node.

Option C is correct because DNS resolution for a Service in the same namespace relies on CoreDNS, which is the cluster DNS provider in Kubernetes. If CoreDNS is not running or misconfigured, DNS queries for the Service name (e.g., 'my-service') will fail, even though the Service is reachable via its cluster IP. The user's ability to reach the Service by IP confirms that kube-proxy and networking are functional, isolating the issue to DNS resolution.

Option D is correct because a ClusterIP Service is the default Kubernetes Service type, which assigns a virtual IP address reachable only within the cluster. Traffic sent to this IP is load-balanced across the Pods selected by the Service's label selector, using iptables or IPVS rules. No external access is provided unless an Ingress or other mechanism is explicitly configured.

The 'replicas' field under 'spec' determines how many pod instances should be running.

The 'set image' command updates the container image for a Deployment, triggering a rolling update by default.

The maxSurge field controls how many extra pods can be created above the desired count during an update. maxUnavailable controls how many pods can be unavailable. To have 2 extra pods (maxSurge=2) and only 1 unavailable (maxUnavailable=1), the correct configuration is maxSurge=2, maxUnavailable=1.

Kubernetes provides self-healing and automated scaling.

Option B is correct because `envFrom` with a `configMapRef` injects all key-value pairs from the ConfigMap named 'app-config' as environment variables into the container. This is the standard Kubernetes method for bulk injection of ConfigMap data into environment variables, as opposed to selecting individual keys.

A Kubernetes Job is designed for finite, batch-oriented tasks that run to completion, such as processing a queue and then terminating. Unlike controllers that maintain a desired state (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit, making it the correct choice for a one-time batch job.

ConfigMaps and Secrets are Kubernetes API objects designed specifically to decouple configuration data and sensitive information from container images. ConfigMaps store non-sensitive key-value pairs (e.g., environment variables, command-line arguments, or configuration files), while Secrets store sensitive data (e.g., passwords, tokens, or SSH keys) in base64-encoded or encrypted form. Both can be mounted into pods as volumes or injected as environment variables, allowing image reuse across different environments without rebuilding.

Option A is correct because `kubectl get pod -o wide` extends the default output to include additional columns such as the pod's IP address, the node it is scheduled on, and the container statuses (e.g., READY state). This command queries the Kubernetes API server for the pod's current state and formats the response with extra details, making it the most direct way to view the pod's IP and node assignment in a single line.

The 'BackOff' event in Kubernetes indicates that the container has started but repeatedly crashes, causing the kubelet to increase the restart delay. Option D is correct because an application that crashes shortly after starting will trigger this restart loop, as the container exits with a non-zero exit code, leading to exponential backoff.

A valid Service YAML includes apiVersion: v1, kind: Service, metadata, and spec with selector and ports.

A Deployment manages a ReplicaSet to ensure the desired number of pod replicas are running, supports rolling updates, and is ideal for stateless applications.

A liveness probe indicates whether the container is running. If it fails, kubelet restarts the container according to the pod's restartPolicy.

The 'kubectl set image deployment/myapp mycontainer=myimage:v2' command updates the container image and triggers a rolling update defined by the deployment's strategy.

When a Pod remains in Pending state, it means the scheduler cannot find a node that satisfies the Pod's resource requirements (CPU, memory, or other constraints). Since two Pods are running successfully, the Deployment configuration (image, name, selector) is valid, and the issue is that the cluster lacks sufficient capacity to schedule the third replica. The scheduler continuously evaluates node resources and will leave the Pod pending until resources become available or the request is adjusted.

The kubelet is the primary node agent that runs on each node. It ensures that containers are running in a pod as described in the pod spec.

Option C is correct. A container runtime error typically causes the pod to stay in 'ContainerCreating' or crash, not 'Pending'. Pending usually indicates scheduling issues (insufficient resources, node selector/label mismatch) or storage issues (PVC not bound).

A nodeSelector is a simple pod spec field that matches node labels. The correct format is a map of key-value pairs under 'spec.nodeSelector'.

Option B is correct because a ConfigMap is a Kubernetes API object designed to store non-confidential configuration data in key-value pairs. Mounting a ConfigMap as a volume makes its data available as files in the pod's filesystem, allowing applications to read configuration without hardcoding it into the container image or pod spec. This approach decouples configuration from containerized applications, following the principle of immutable infrastructure.

A Pod is the smallest deployable unit in Kubernetes, representing a single instance of a running process in the cluster.

The kube-scheduler assigns pods to nodes based on resource requirements, policies, and constraints.

The 'kind' field is required because it tells Kubernetes which type of object to create (e.g., Pod, Deployment, Service). Without it, the API server cannot route the manifest to the correct resource handler. It must be a valid Kubernetes resource kind from the core API or a custom resource definition.

A Service provides a stable IP address and DNS name that routes traffic to a set of pods, regardless of pod IP changes.

Option C is correct because with maxUnavailable=25% and maxSurge=25%, the maximum number of unavailable Pods during a rolling update is calculated as the ceiling of 25% of the desired replicas (5), which is 2. This means up to 2 Pods can be unavailable at any time, ensuring the rollout can proceed while maintaining availability.

A Pod in 'Pending' state indicates that the scheduler has not yet assigned it to a node. The most common reason is insufficient resources (CPU or memory) on any available node, causing the scheduler to fail to find a suitable node that meets the Pod's resource requests. This is a core scheduling failure in Kubernetes.

ClusterIP services are reachable via DNS if CoreDNS is running. If the service name is not resolvable, CoreDNS might be misconfigured or not running.

Option A is correct because ConfigMaps can be exposed as files in a pod's filesystem using a volume mount. When you define a ConfigMap as a volume in the pod spec and mount it via volumeMounts, each key in the ConfigMap becomes a file in the specified mount path, with the key's value as the file content. This is a standard method for injecting configuration data into containers without modifying the container image.

ConfigMap is the correct Kubernetes resource for providing configuration data that does not change often and should not be baked into the container image. It decouples configuration artifacts from image content, allowing you to update configuration without rebuilding images, and supports injection via environment variables, command-line arguments, or volume mounts.

A Service of type ClusterIP exposes a set of pods as a network service within the cluster by assigning a stable virtual IP address and DNS name. Traffic to this IP is load-balanced across the pods matching the Service's label selector, enabling internal cluster communication without external exposure.

The kube-apiserver is the front-end of the Kubernetes control plane and exposes the Kubernetes API.

Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.

A Service is the correct Kubernetes object because it provides a stable virtual IP (ClusterIP) and DNS name that remains constant even as pods are created or destroyed. It automatically load-balances traffic across the set of pods matching its label selector using iptables or IPVS rules, ensuring reliable network endpoints for clients.

Option A is correct because a startup probe must succeed before the kubelet considers the container started. Until the startup probe succeeds, the readiness and liveness probes are not active, so the pod cannot be marked healthy or ready. This is defined in the Kubernetes API for startup probes, which delay the start of other probes until the application has initialized.

etcd is a distributed key-value store that stores all cluster data, including configuration, state, and metadata.

Namespaces provide logical isolation and are used to divide cluster resources among multiple users or teams. Some resources, like nodes and PersistentVolumes, are cluster-scoped and not namespaced.

A Service provides a stable endpoint (IP/DNS) and load balancing for a set of pods.

The default strategy for Deployments is RollingUpdate, which gradually replaces old Pods with new ones without downtime, and by default it keeps no old Pods running after the update completes.

ConfigMap is designed to store non-sensitive configuration data as key-value pairs or files.

With maxUnavailable=0, the controller ensures no pods are unavailable during the update, but it may create new pods before terminating old ones, potentially causing resource contention.

A Pod is the smallest and simplest Kubernetes object. It represents a single instance of a running process in the cluster.

Option C is correct because `kubectl set image deployment/nginx nginx=nginx:1.21 --record` updates the container image of the specified deployment and, with the `--record` flag, annotates the change in the rollout history (stored in the `kubernetes.io/change-cause` annotation). This allows you to later inspect the change with `kubectl rollout history deployment/nginx`.

Namespaces provide logical isolation and scope for resources within a cluster, allowing multiple virtual clusters backed by the same physical cluster.

The kubelet is the node agent that communicates with the control plane and manages containers on the node.

Pending typically means the Pod has been accepted but not yet scheduled, often due to insufficient resources or node availability.

CoreDNS is the cluster DNS service that provides DNS resolution for services and pods. If DNS is not working, CoreDNS pods should be checked.

Option A is correct because etcd is the primary data store for all Kubernetes cluster state, including the configuration and status of every Kubernetes object (Pods, Services, Deployments, etc.). It stores this information as key-value pairs, and the Kubernetes API server is the only component that reads from and writes to etcd directly. Without etcd, the cluster would have no persistent record of its desired or current state.

A ClusterIP service exposes the set of pods on a cluster-internal IP address, making it reachable only from within the cluster. This is the default service type in Kubernetes and is valid for internal communication between workloads. It does not provide external access, but it is a core method for exposing pods as a network service.

First create namespace, then deploy resources specifying that namespace, and verify.

The kubelet is the primary node agent that watches for pod specs and ensures the containers are healthy.

A liveness probe in Kubernetes is used to determine if a container is still running and healthy. If the probe fails, the kubelet kills the container and restarts it based on the pod's restart policy. This ensures that applications that have entered a deadlock or hung state are automatically recovered without manual intervention.

Namespaces provide a logical separation of resources within a cluster, allowing multiple teams or projects to coexist.

Option A is correct because 'kubectl set image deployment/myapp myapp=myapp:v2' directly updates the container image in the Deployment's pod template, which triggers a rolling update by default. The Deployment controller then creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime.

Deployment, Service, and ConfigMap are core Kubernetes resources. DockerImage and VirtualMachine are not native Kubernetes objects.

Kubelet and container runtime are essential components running on each worker node. Kube-proxy also runs on worker nodes but is often considered part of the node. The question asks for two, and the most fundamental are kubelet and container runtime.

Option C is correct because the `envFrom` field in the container spec allows you to inject all key-value pairs from a ConfigMap (or Secret) as environment variables into the container. This is the most direct and efficient way to expose ConfigMap data as environment variables without needing to specify each key individually.

A ReplicaSet is the Kubernetes controller that ensures a specified number of pod replicas are running at all times. It uses a label selector to match pods and maintains the desired replica count by creating or deleting pods as needed. ReplicaSet is the successor to ReplicationController and is primarily used by Deployments to manage pod scaling and self-healing.

A Service is the standard way to expose a pod's port. An Ingress can expose HTTP routes to a Service. containerPort in the pod spec is declarative but does not create exposure by itself; it documents the port. kubectl port-forward is for debugging, not permanent exposure.

The `spec.replicas` field in a Deployment spec defines the desired number of identical Pod replicas that should be running at any given time. This field directly controls the count of Pods across all nodes in the cluster, ensuring that exactly that many Pods are maintained by the ReplicaSet controller. Option A is correct because it is the only field that sets the target Pod count.

A Service provides a stable network endpoint (ClusterIP) that load-balances traffic across the Pod replicas, abstracting away Pod IP changes due to restarts or scaling. This allows other Pods within the cluster to reach the application reliably using the Service's DNS name, without needing to track individual Pod IPs.

Secrets are designed to store sensitive data such as passwords, tokens, or keys. They are base64 encoded and can be mounted or injected as environment variables.

Option D is correct because setting both `requests.memory` and `limits.memory` guarantees a minimum memory allocation (the request) while enforcing a hard cap (the limit). If the pod exceeds the memory limit, it is terminated (OOMKilled) and, if part of a Deployment or StatefulSet, the controller automatically restarts it. This satisfies the requirement for both guaranteed minimum and enforced maximum with automatic restart.

When a Pod remains in Pending state, it indicates that the scheduler cannot find a suitable node to place it. The most common cause is insufficient cluster resources (CPU or memory) to accommodate the additional Pods, as the scheduler checks node allocatable resources against Pod resource requests. With 2 out of 3 Pods pending, the cluster likely has enough resources for only one replica, leaving the others unscheduled.

The control plane includes kube-apiserver, etcd, kube-scheduler, and kube-controller-manager. kubelet and kube-proxy are worker node components.