CCNA Kcna Kubernetes Fundamentals Questions

Option B is correct. The kubelet is the primary node agent that communicates with the container runtime and ensures containers are running and healthy. kube-proxy manages network rules, the container runtime runs containers but is not directly responsible for enforcing the spec, and the scheduler assigns pods to nodes.

kubectl scale deployment my-deploy --replicas=5 is the direct command to change the replica count.

The error 'address already in use' on port 8080 indicates that when the container restarts, the previous process is still holding the port. This typically happens when the application does not handle SIGTERM properly and does not shut down within the terminationGracePeriodSeconds (default 30s), so the old process lingers while the new one tries to bind to the same port, causing a CrashLoopBackOff.

The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API. It validates and processes RESTful requests (using JSON/YAML over HTTP/HTTPS) that create, update, or delete cluster resources, and it is the only component that communicates directly with etcd. Without the API server, no control plane operations can be performed.

When a pod is stuck in Terminating state, the most likely cause is that the node where the pod was running is unreachable or the kubelet is not responding. The kubelet is responsible for executing the pod's termination lifecycle, including sending SIGTERM and, after the grace period, SIGKILL. If the kubelet cannot communicate with the API server (e.g., due to node failure, network partition, or kubelet crash), the pod's finalizer cannot be removed, leaving it stuck in Terminating.

Option A is correct because Namespaces in Kubernetes provide a mechanism for partitioning a single cluster into multiple virtual clusters, enabling resource quota management and access control for different users or teams. This allows administrators to divide cluster resources (like CPU, memory, and storage) among multiple users via ResourceQuotas and LimitRanges, without requiring separate physical clusters.

A Kubernetes Service provides a stable, virtual IP address and DNS name that acts as a consistent endpoint for accessing a set of pods, regardless of pod IP changes due to scaling, restarts, or scheduling. It decouples frontend clients from backend pods by using label selectors to route traffic, ensuring high availability and load balancing across the pod group.

kubelet is the primary node agent that ensures containers are running as expected in a pod.

A pod remains in 'Pending' state when it has been accepted by the API server but cannot be scheduled onto a node. The most common cause is that the scheduler cannot find a node that meets the pod's resource requests (CPU/memory) or constraints (node selectors, affinity rules, taints/tolerations). Until a suitable node is found, the pod stays in Pending, waiting for scheduling.

The 'kubectl logs' command is used to fetch logs from containers in a pod.

The Pod is the smallest and simplest unit in the Kubernetes object model that you can create and manage. It represents a single instance of a running process in the cluster and encapsulates one or more containers, shared storage, and a unique cluster IP. While containers are the runtime units, Kubernetes does not manage containers directly; it manages Pods, which are the atomic scheduling unit.

A Kubernetes Job is designed for batch processing workloads that run to completion and then terminate. Unlike controllers that maintain a desired number of running Pods (like Deployments or StatefulSets), a Job creates one or more Pods and ensures they successfully exit. Once the specified number of successful completions is reached, the Job stops, making it the ideal choice for a one-time data processing task.

Namespaces provide logical isolation and can be used to separate environments, but not all objects are namespaced (e.g., nodes).

The 'kubectl apply' command is used to apply a configuration to a resource by file or stdin. It also supports declarative management, tracking changes for updates.

Option D is correct because the rollout status shows that no new replicas have been created, which is a classic symptom of a container image pull failure. When the image tag specified in the pod template does not exist in the registry, the kubelet cannot pull the image, so the ReplicaSet controller cannot start new pods. This prevents the rollout from progressing past 0 out of 3 new replicas.

Option B is correct because the YAML defines resource limits and requests using standard Kubernetes units: '128Mi' for memory (mebibytes) and '500m' for CPU (millicores). These are valid and will be applied to the container, creating the Pod with the specified limits.

The -c flag specifies the container name when a pod has multiple containers.

Option D is correct because `kubectl exec` uses the `-c` flag (or `--container`) to specify a target container within a multi-container pod. The syntax `kubectl exec -it mypod -c sidecar -- /bin/sh` opens an interactive shell in the 'sidecar' container of the pod named 'mypod'. Without the `-c` flag, the command defaults to the first container in the pod's spec, which would be 'app'.

A Service provides a stable IP and DNS name, and load balances traffic across pods selected by labels.

Kubernetes is a container orchestration platform that automates deployment, scaling, and management of containerized applications.

StatefulSets provide stable, unique network identifiers (e.g., pod hostnames) that persist across reschedules because each pod gets a fixed ordinal index (e.g., pod-0, pod-1) and a corresponding DNS name (e.g., pod-0.statefulset.namespace.svc.cluster.local). This is essential for applications like databases (e.g., Cassandra, ZooKeeper) that rely on consistent peer discovery and identity, which Deployments cannot guarantee since they assign random pod names and IPs.

Namespaces provide a mechanism for isolating groups of resources within a single cluster, but they do not provide network isolation by default (that requires NetworkPolicies).

The Pod is the smallest deployable unit in Kubernetes because it represents a single instance of a running process in the cluster and encapsulates one or more containers with shared storage and network resources. While containers are the runtime units, Kubernetes schedules and manages Pods, not individual containers, making the Pod the atomic building block for deployment.

Option C is correct because setting `maxSurge=1` and `maxUnavailable=0` in a RollingUpdate strategy ensures that one additional pod is created above the desired replica count before any existing pod is terminated. This guarantees zero downtime by maintaining full capacity during the rollout, as new pods become ready before old ones are removed.

Kubernetes is a container orchestration platform used to automate the deployment, scaling, and management of containerized applications.

kubectl apply and kubectl create are used to create/update resources by declarative or imperative approach. Direct API calls also work. kubectl update does not exist.

'kubectl apply' uses a declarative approach to create or update resources defined in a file.

The PVC requests ReadWriteOnce, so PV2 (ReadOnlyMany) does not match. PV1 matches AccessModes and storageClassName is empty (implies no storage class), but PV1's capacity (3Gi) is less than the request (5Gi). No PV matches, so the PVC remains unbound.

kubectl logs <pod-name> fetches the standard output/error logs from the pod's containers.

'kubectl describe pod <pod-name>' provides detailed information about a pod, including events, state, and configuration.

If a pod has no memory limit, it can use as much memory as needed. When the node is under memory pressure, the kernel's OOM killer may target the pod, leading to OOMKilled.

Option B is correct because Kubernetes set-based selectors support operators like 'In', 'NotIn', 'Exists', and 'DoesNotExist', allowing more flexible matching than equality-based selectors. This is defined in the Kubernetes API specification for label selectors, enabling complex filtering of resources.

A Service of type ClusterIP (default) provides a stable endpoint and load balancing across pods matching its selector.

A Pod is the smallest and simplest unit that can be created and managed in Kubernetes.

Option A is correct because the Service's selector 'app: myapp' matches both pods 'app-v1' and 'app-v2', which both carry the label 'app: myapp'. The Service controller automatically creates endpoints for all pods matching the selector, regardless of their readiness state, unless a headless service or custom endpoint logic is involved. Initially, both pods are considered ready by default (unless a readiness probe fails), so the Service will have two endpoints.

The error 'unable to bind to port 8080' indicates that the container process cannot open port 8080 for listening. The most likely cause is that another process on the host node is already using port 8080, preventing the container from binding to it. This is a classic port conflict scenario, where the host's network namespace has a port already allocated, and the container (even with its own network namespace) may be using host networking or the port is mapped from the host.

A Pod is the smallest deployable unit in Kubernetes because it encapsulates one or more containers that share the same network namespace, storage volumes, and lifecycle. While containers are the runtime processes, Kubernetes schedules and manages Pods as atomic units, meaning you cannot deploy a container directly without a Pod wrapper.

These concepts control how pods are scheduled and allocated resources.

Node affinity is a set of rules used by the scheduler to determine which nodes a pod can be placed on. Labels on nodes can be used to indicate hardware characteristics like SSD storage.

The taint `node.kubernetes.io/unreachable` is automatically added by the node controller when a node becomes unreachable (e.g., network failure, kubelet stops heartbeating). The error shows all 4 nodes have this taint and the pod has no matching toleration, meaning the scheduler cannot place the pod. This directly indicates all nodes are unreachable or have been cordoned (which also adds the `node.kubernetes.io/unschedulable` taint, but here the specific taint is `unreachable`).

ConfigMap is the correct Kubernetes object for storing non-sensitive configuration data, such as key-value pairs or configuration files. It is designed to decouple configuration artifacts from container images, allowing Pods to consume this data as environment variables, command-line arguments, or mounted files in a volume. Unlike Secrets, ConfigMaps do not provide encryption or base64 encoding by default, making them suitable only for non-sensitive information.

'kubectl describe pod <pod-name>' shows events and conditions that explain why the pod is pending, such as resource shortages or node selector mismatches.

Pending means the scheduler cannot place the pod. Insufficient resources on nodes is a common cause. Option D is correct.

The Deployment creates a new ReplicaSet for the new version and scales it up while scaling down the old ReplicaSet. Pods are managed by ReplicaSets, not by the Deployment directly.

kubectl logs <pod-name> retrieves logs from the container. If the pod has multiple containers, you use -c to specify.

Option C is correct because when a Pod and a Service are in the same namespace, Kubernetes DNS resolves the Service using just the Service name (e.g., 'api'). The DNS search domain configured in the Pod's resolv.conf (e.g., <namespace>.svc.cluster.local) appends the namespace and cluster suffix automatically, so a short query like 'api' resolves correctly without needing the full FQDN.

Namespaces provide a scope for resource names and can be used to divide cluster resources between multiple users.

The liveness probe is configured to check the /healthz endpoint, but the default nginx container does not serve a /healthz endpoint. This causes the liveness probe to fail, and Kubernetes restarts the container according to the probe's failure threshold. Since the container keeps restarting, it never reaches the Ready state, even though the container starts and runs initially.

Namespaces provide logical isolation for resources. Option C is correct.

ConfigMaps, Secrets, and environment variables defined directly in the pod spec are all legitimate methods to inject configuration.

Resource constraints (insufficient CPU or memory) can prevent the scheduler from placing all pods. Other issues like image pull errors would result in different states.

A Deployment manages a ReplicaSet and provides declarative updates, rolling updates, and rollback capabilities, making it ideal for stateless applications.

Namespaces provide logical isolation and scoping for resource names. However, some resources like Nodes and PersistentVolumes are cluster-scoped and cannot be namespaced. Also, namespaces do not provide network isolation by default; NetworkPolicies do.

Option A is correct because Kubernetes NetworkPolicies are namespace-scoped resources that can restrict ingress and egress traffic between Pods in different Namespaces. By default, all Pods can communicate across Namespaces, but applying a NetworkPolicy with a podSelector and namespaceSelector allows you to enforce isolation. Option C is correct because Namespaces provide a logical boundary for resource names, preventing naming collisions when multiple teams or projects deploy objects with the same name within the same cluster.

The control plane includes kube-apiserver, etcd, kube-scheduler, and kube-controller-manager. kubelet and kube-proxy are node components.

A Pod is the smallest and simplest unit in the Kubernetes object model.

Option C is correct because Kubernetes DNS resolves services across namespaces using the format <service>.<namespace>.svc.cluster.local. Since the 'cache-svc' service is in the 'prod' namespace, the 'db' pod in the 'default' namespace must use 'cache-svc.prod.svc.cluster.local' to reach it. The default cluster domain is 'cluster.local', and the 'svc' subdomain is part of the standard DNS schema for services.

kubectl create configmap supports the --from-file flag to create a ConfigMap from a file. Option A uses an invalid flag; option B has incorrect flag; option D uses --from-env-file which is for loading environment variables from a file, but the question asks for a ConfigMap from a file generally.

etcd is a consistent and highly-available key-value store used as Kubernetes' backing store for all cluster data.

Kubernetes is a container orchestration platform designed to automate deployment, scaling, and management of containerized applications.

The error 'exec: "app": executable file not found in $PATH' indicates that the container image does not contain the binary or script specified in the pod's command field (e.g., `command: ["app"]`). This typically happens when the image is built without the expected executable, the command path is incorrect, or the image tag points to a different version. The container fails to start because the runtime cannot locate the entrypoint.

The kube-controller-manager is a core control plane component that runs controller processes, including the node controller, which monitors node health by checking the NodeStatus and NodeLease objects. If a node becomes unreachable (e.g., the node controller fails to receive a heartbeat within the --node-monitor-grace-period, default 40 seconds), it marks the node as Unhealthy and eventually taints it to trigger pod eviction. This makes option D correct because the node controller is a built-in controller within the kube-controller-manager.

The deployment controller uses a readiness probe to determine if a pod is ready. If the probe fails, the pod is not marked as available, even if it is running.

Option A is correct because kube-proxy is the component responsible for implementing the ClusterIP Service abstraction by managing iptables or IPVS rules on each node. If kube-proxy is not running, traffic destined for the Service's ClusterIP will not be forwarded to the backend pods, making the Service unreachable from within the cluster.

kubectl get pods -n team-a shows all pods in the namespace, regardless of status. The default output includes pods in any state. Option B ignores the namespace; option C shows pods from all namespaces; option D only shows pods with a specific label.

When you scale a Deployment, the Deployment controller updates the replica count on the existing ReplicaSet that matches the pod template. The ReplicaSet controller then observes the desired count and creates the additional pods to reach the new target. This ensures that the Deployment's rollout history and rollback capabilities remain intact.

The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes REST API. All administrative tasks, such as creating pods, scaling deployments, and querying cluster state, are performed by sending HTTP requests to this component. It validates and processes these requests before storing the resulting state in etcd.

ConfigMap is designed to hold non-sensitive configuration data that can be injected into containers as env vars or files.

DaemonSet ensures that a copy of a pod runs on each node (or a subset), which is ideal for daemons like log collectors.

The 'kubectl create deployment' command creates a Deployment, and '--expose' also creates a Service.

A is correct because a Kubernetes Service provides a stable virtual IP address and a DNS name (via CoreDNS) that remains constant even as the underlying Pods are created, destroyed, or scaled. This decouples clients from the ephemeral nature of Pod IPs, ensuring reliable connectivity.