Authentic Linux Foundation CKA Exam Dumps PDF - 2026 Updated
Get Prepared for Your CKA Exam With Actual 85 Questions
NEW QUESTION # 17
A recent deployment of a new version of your application caused a large number of pods to enter a 'CrashLoopBackOff state. You need to identify the root cause of the issue and resolve it.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Identify the Failing Pods:
- Use 'kubectl get pods -l app=' to list the pods in the Deployment.
- Identify the pods that are in the 'CrashLoopBackOff state.
2. Examine Pod Logs:
- Use 'kubectl logs -f to view the logs of the failing pods.
- Look for error messages, stack traces, or other clues that can point to the root cause of the crash.
- For example, errors related to:
- Missing dependencies or configuration: Check if the application is missing required configuration files or dependencies.
- Incorrect resource usage: Look for errors related to memory or CPU limitations.
- Network connectivity issues: Check for errors related to communication failures.
3. Check for Recent Changes:
- Review the changes made during the deployment:
- Analyze the updated deployment YAML file to identify any configuration changes that might have introduced the crash.
- Check for changes in container images, resource requests, or other settings.
4. Inspect Deployment Events:
- Use "kubectl describe pod ' to view the pod's events:
- Look for events related to the crash, such as "Back-off restarting failed container" or "Container restarting".
- The events might provide insights into the timing of the crashes and the potential reasons.
5. Verify Network Connectivity:
- Test network connectivity from within the failing pods:
- Use "kubectl exec -it -n bash' to enter a pod.
- Run 'ping or 'curl to test network connectivity to external resources.
6. Troubleshoot the Application Code:
- If the logs suggest a problem with the application code:
- Debug the application code: Analyze the code to find the source of the crashes.
- Consider rolling back the deployment to the previous version: Use 'kubectl rollout undo deployment ' to revert to the previous working version.
7. Address the Root Cause:
- Once you identify the root cause:
- Fix the underlying issue in the application code or deployment configuration.
- Apply the fixes: Update the deployment YAML file with the corrected configuration.
- Redeploy the application: Use "kubectl apply -f to redeploy the application with the fix.
NEW QUESTION # 18
Create 2 nginx image pods in which one of them is labelled with env=prod and another one labelled with env=dev and verify the same.
Answer:
Explanation:
See the solution below.
Explanation
kubectl run --generator=run-pod/v1 --image=nginx -- labels=env=prod nginx-prod --dry-run -o yaml > nginx-prodpod.yaml Now, edit nginx-prod-pod.yaml file and remove entries like "creationTimestamp: null"
"dnsPolicy: ClusterFirst"
vim nginx-prod-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: prod
name: nginx-prod
spec:
containers:
- image: nginx
name: nginx-prod
restartPolicy: Always
# kubectl create -f nginx-prod-pod.yaml
kubectl run --generator=run-pod/v1 --image=nginx --
labels=env=dev nginx-dev --dry-run -o yaml > nginx-dev-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: dev
name: nginx-dev
spec:
containers:
- image: nginx
name: nginx-dev
restartPolicy: Always
# kubectl create -f nginx-prod-dev.yaml
Verify :
kubectl get po --show-labels
kubectl get po -l env=prod
kubectl get po -l env=dev
NEW QUESTION # 19
You are setting up RBAC for a Kubernetes cluster with three namespaces: "development", "staging", and "production". You need to create a role binding that allows developers in the "development" namespace to create deployments, pods, and services, but only within their own namespace.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 Create a Role for Developers:
2. Create a Role Binding for Developers:
3. Replace 'developer-user' with the actual username of a developer. 4. Repeat steps 1-3 for other namespaces ("staging" and "production") with appropriate resource permissions and user names. 5. Verify the RBAC configuration: - Check that the roles and rolebindings are created successfully using 'kubectl get roles' and 'kubectl get rolebindings'. - Test the permissions by creating a pod, deployment, or service as a developer user in their respective namespaces. 6. If you encounter issues, review the configuration carefully, making sure the namespaces, roles, role bindings, and user names are correct.
NEW QUESTION # 20
Create a configmap called cfgvolume with values var1=val1,
var2=val2 and create an nginx pod with volume nginx-volume which
reads data from this configmap cfgvolume and put it on the path
/etc/cfg
- A. // first create a configmap cfgvolume
kubectl create cm cfgvolume --from-literal=var1=val1 --fromliteral=var2=val2
// verify the configmap
kubectl describe cm cfgvolume
// create the config map
kubectl create -f nginx-volume.yml
vim nginx-configmap-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
run: nginx
name: nginx
spec:
volumes:
- name: nginx-volume
configMap:
name: cfgvolume
containers:
- image: nginx
name: nginx
volumeMounts:
- name: nginx-volume
mountPath: /etc/cfg
restartPolicy: Always
k kubectl apply -f nginx-configmap-pod.yaml
/ // Verify
// exec into the pod
kubectl exec -it nginx -- /bin/sh
// check the path
cd /etc/cfg - B. // first create a configmap cfgvolume
kubectl create cm cfgvolume --from-literal=var1=val1 --fromliteral=var2=val2
// verify the configmap
kubectl describe cm cfgvolume
// create the config map
kubectl create -f nginx-volume.yml
vim nginx-configmap-pod.yaml
apiVersion: v1
kind: Pod
- name: nginx-volume
configMap:
name: cfgvolume
containers:
- image: nginx
name: nginx
volumeMounts:
- name: nginx-volume
mountPath: /etc/cfg
restartPolicy: Always
k kubectl apply -f nginx-configmap-pod.yaml
/ // Verify
// exec into the pod
kubectl exec -it nginx -- /bin/sh
// check the path
cd /etc/cfg
Answer: A
NEW QUESTION # 21
Delete the above pod and create again from the same yaml file
and verifies there is no "test-file.txt" in the path /data/redis
(Since non-persistent storage "emptyDir" is used).
Answer:
Explanation:
kubectl delete pod test-redis kubectl create -f test-redis.yaml kubectl exec -it test-redis /bin/sh cat /data/redis/file.txt // file doesn't exist
NEW QUESTION # 22
Get all the pods with label "env"
Answer:
Explanation:
kubectl get pods -L env
NEW QUESTION # 23
Create a deployment as follows:
* Name: nginx-app
* Using container nginx with version 1.11.10-alpine
* The deployment should contain 3 replicas
Next, deploy the application with new version 1.11.13-alpine, by performing a rolling update.
Finally, rollback that update to the previous version 1.11.10-alpine.
Answer:
Explanation:
NEW QUESTION # 24
Create a deployment named "myapp" that having 2 replicas with
nginx image and expose deployment as service named "myservice"
- A. // Create a YAML Template
kubectl create deploy myapp --image=nginx --dry-run -o yaml >
myapp.yaml
//Update replicas=2 in myapp.yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: myapp
name: myapp
spec:
replicas: 2
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- image: nginx
name: nginx
// Create deployment
kubectl create -f myapp.yaml
// Creating YAML template for service
kubectl expose deployment myapp --type=ClusterIP --port=80 --
target-port=80 --name=myservice --dry-run -o yaml >
myservice.yaml
YAML File:
apiVersion: v1
kind: Service
metadata:
labels:
app: myapp
name: myservice
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
app: myapp
type: ClusterIP
kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S)
AGE
kubernetes ClusterIP 10.2.0.1 <none> 443/TCP
158d
myservice ClusterIP 10.2.96.175 <none> 80/TCP
40s - B. // Create a YAML Template
kubectl create deploy myapp --image=nginx --dry-run -o yaml >
myapp.yaml
//Update replicas=2 in myapp.yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: myapp
name: myapp
spec:
replicas: 2
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- image: nginx
name: nginx
// Create deployment
kubectl create -f myapp.yaml
// Creating YAML template for service
kubectl expose deployment myapp --type=ClusterIP --port=60 --
target-port=60 --name=myservice --dry-run -o yaml >
myservice.yaml
YAML File:
apiVersion: v1
kind: Service
metadata:
labels:
app: myapp
name: myservice
spec:
ports:
- port: 60
protocol: TCP
targetPort: 80
selector:
app: myapp
type: ClusterIP
kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S)
AGE
kubernetes ClusterIP 10.2.0.1 <none> 443/TCP
158d
myservice ClusterIP 10.2.96.175 <none> 80/TCP
40s
Answer: A
NEW QUESTION # 25
Print pod name and start time to "/opt/pod-status" file
Answer:
Explanation:
kubect1 get pods -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'
NEW QUESTION # 26
Check to see how many worker nodes are ready (not including nodes tainted NoSchedule) and write the number to /opt/KUCC00104/kucc00104.txt.
Answer:
Explanation:
See the solution below.
Explanation
solution
F:\Work\Data Entry Work\Data Entry\20200827\CKA\15 B.JPG
F:\Work\Data Entry Work\Data Entry\20200827\CKA\15 C.JPG
NEW QUESTION # 27
Make the node schedulable by uncordon the node
Answer:
Explanation:
kubectl uncordon node-1 //verify kubectl get no
NEW QUESTION # 28
Remove taint added to node "worker-2"
Answer:
Explanation:
kubectl taint nodes worker-2 key:NoSchedule- // Verify You will see a message "node/worker-2 untainted" kubectl get nodes -o customcolumns=NAME:.metadata.name,TAINTS:.spec.taints --no-headers
NEW QUESTION # 29
You have a Deployment for a web application named 'web-app-deployment' that uses an image named 'web-app:vl .0'. You want to implement a rolling update to upgrade the deployment to a new version, 'web-app:v2.0', but only allow a maximum of 2 pods to be unavailable at any time during the update. How would you achieve this using Kubernetes?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Update the Deployment YAML:
- Open the Deployment YAML file for 'web-app-deployment' (e.g., 'web-app-deployment.yaml').
- Modify the 'image' field within the 'spec.template.spec.containers' section to the new image: 'web-app:v2.0'.
- Adjust the 'strategy.rollingUpdate' section to control the rolling update process:
- Set 'maxUnavailable: 2' to allow a maximum of 2 pods to be unavailable at any time.
- Keep 'maxSurge: 0' if you don't want additional pods to be created during the update.
2. Apply the Updated Deployment: - IJse 'kubectl apply -f web-app-deployment.yaml' to apply the updated Deployment YAML. 3. Monitor the Rolling Update: - Use 'kubectl get pods -l app=web-app' to monitor the update process. You will see that Kubernetes will gradually terminate old pods running 'web-app:vl .0' and create new pods with 'web-app:v2.0'. - You can also use "kubectl describe deployment web-app-deployment' to observe the progress of the rolling update. 4. Verify Successful Update: - Once the update is complete, confirm that all pods are running the new image 'web-app:v2.0'. You can check the output of 'kubectl get pods -l app=web-app' or 'kubectl describe deployment web-app-deployment'.
NEW QUESTION # 30
You have a Kubernetes cluster with a multi-tenant setup where different teams manage their own applications. You need to enforce a policy where only developers from the "engineering" team can create deployments for applications within the "dev" namespace. How would you implement this using RBAC?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
Step 1: Create a Role for the "engineering" team
Step 2: Create a RoleBinding to assign the role to the "engineering" team
- The Role defines the permissions for the "engineering" team, allowing them to create deployments in the "dev" namespace. - The RoleBinding associates the "engineering-role" with the user "[email protected]" (representing a developer from the "engineering" team). Step 3: Validate the setup - A developer from the "engineering" team should be able to create deployments in the "dev" namespace. - Other users or teams without the appropriate permissions should be prevented from creating deployments in the "dev" namespace.
NEW QUESTION # 31
You are tasked with setting up fine-grained access control for a Kubernetes cluster running a microservices application. You need to ensure that developers can only access the resources related to their specific microservices while preventing them from accessing or modifying other services' resources. Define RBAC roles and permissions to achieve this, including details of the resources, verbs, and namespaces involved. Consider the following:
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Specify the YAML configurations for roles, role bindings, and service accounts to enable the required access control, ensuring developers only have access to their respective microservice's resources within their assigned namespaces. Solution (Step by Step) : 1. Define Roles:
2. Create Service Accounts: apiVersion: vl kind: ServiceAccount metadata: name: order-service-sa namespace: order-service-ns -- apiVersion: vl kind: ServiceAccount metadata: name: payment-service-sa namespace: payment-service-ns -- apiVersion: vl kind: ServiceAccount metadata: name: inventory-service-sa namespace: inventory-service-ns 3. Bind Roles to Service Accounts: -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: order-service-dev-binding namespace: order-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: order-service-dev subjects: - kind: ServiceAccount name: order-service-sa namespace: order-service-ns -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: payment-service-dev-binding namespace: payment-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: payment-service-dev subjects: - kind: ServiceAccount name: payment-service-sa namespace: payment-service-ns -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: inventory-service-dev-binding namespace: inventory-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: inventory-service-dev subjects: - kind: ServiceAccount name: inventory-service-sa namespace: inventory-service-ns 4. Assign Service Accounts to Users: This step requires external authentication mechanisms like OIDC or LDAP. Assuming you have these mechanisms set up, you can associate the service accounts with specific users ('[email protected]' , '[email protected]', and '[email protected]') using the configured authentication provider. Roles: Define the specific permissions for each microservice developer within their respective namespaces. The roles allow developers to access resources like Pods, Deployments, Services, ConfigMaps, and Secrets related to their assigned microservice. Service Accounts: Service accounts are created in each namespace for each microservice, representing the identity of the developer group. Role Bindings: Role bindings connect the defined roles with the service accounts, granting the associated permissions. User Association: This step connects the service accounts with individual developers through external authentication mechanisms, enabling them to utilize the assigned permissions. By following these steps, you ensure that developers can only access and manage resources associated with their respective microservices within their assigned namespaces. This fine-grained access control policy effectively restricts access and prevents developers from interfering with other microservices or resources. ,
NEW QUESTION # 32
Score: 7%
Task
Reconfigure the existing deployment front-end and add a port specification named http exposing port 80/tcp of the existing container nginx.
Create a new service named front-end-svc exposing the container port http.
Configure the new service to also expose the individual Pods via a NodePort on the nodes on which they are scheduled.
Answer:
Explanation:
See the solution below.
Explanation
Solution:
kubectl get deploy front-end
kubectl edit deploy front-end -o yaml
#port specification named http
#service.yaml
apiVersion: v1
kind: Service
metadata:
name: front-end-svc
labels:
app: nginx
spec:
ports:
- port: 80
protocol: tcp
name: http
selector:
app: nginx
type: NodePort
# kubectl create -f service.yaml
# kubectl get svc
# port specification named http
kubectl expose deployment front-end --name=front-end-svc --port=80 --tarport=80 --type=NodePort
NEW QUESTION # 33
Create a busybox pod and add "sleep 3600" command
Answer:
Explanation:
kubectl run busybox --image=busybox --restart=Never -- /bin/sh -c
"sleep 3600"
NEW QUESTION # 34
Create a file called "config.txt" with two values key1=value1
and key2=value2. Then create a configmap named "keyvalcfgmap" andread data from the file "config.txt" and verify that configmap is created correctly
- A. cat >> config.txt << EOF
key1=value1
key2=value2
EOF
kubectl create cm keyvalcfgmap --from-file=config.txt
//Verify
kubectl get cm keyvalcfgmap -o yaml - B. cat >> config.txt << EOF
key1=value1
key2=value2
EOF
cat config.txt
// Create configmap from "config.txt" file
kubectl create cm keyvalcfgmap --from-file=config.txt
//Verify
kubectl get cm keyvalcfgmap -o yaml
Answer: B
NEW QUESTION # 35
Get list of PVs and order by size and write to file "/opt/pvstorage.txt"
Answer:
Explanation:
kubectl get pv --sort-by=.spec.capacity.storage > /opt/pv storage.txt
NEW QUESTION # 36
You have a Deployment named 'my-app' running a web application with three replicas. The application is exposed using a 'LoadBalancer' service. You want to create a 'ClusterlP' service for internal communication within the Kubernetes cluster and route traffic from the 'LoadBalancer' service to the 'ClusterlP' service.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Create the ClusterlP service:
- Define a 'ClusterlP' service that points to the my-app' Deployment.
2. Create the LoadBalancer service: - Define a 'LoadBalancer service that routes traffic to the my-app-internar service.
3. Apply the Service YAMLs: - Apply the YAML files for both services using 'kubectl apply -f my-app-internal.yamP and 'kubectl apply -f my- app-external.yamr. 4. Verify the Services: - Check the status of both services using 'kubectl get services'. You should see the 'my-app-internal' service with a 'ClusterlP' and the my-app-external' service with an external IP address. 5. Test the Routing: - Access the application through the external IP address of the 'my-app-external' service. The traffic should be routed to the 'my-app-internal' service and then to the my-app' Deployment. Note: Replace with the actual namespace where your Deployment and Services are located.
NEW QUESTION # 37
Schedule a pod as follows:
* Name: nginx-kusc00101
* Image: nginx
* Node selector: disk=ssd
Answer:
Explanation:
See the solution below.
Explanation
solution
NEW QUESTION # 38
......
Accurate & Verified New CKA Answers As Experienced in the Actual Test!: https://examkiller.itexamreview.com/CKA-valid-exam-braindumps.html
