Get Latest [Jun-2026] Conduct effective penetration tests using ActualTorrent CKAD
Penetration testers simulate CKAD exam PDF
The CKAD certification exam is a performance-based exam that tests the practical skills of candidates in developing and deploying applications on Kubernetes clusters. CKAD exam consists of a set of performance-based tasks that simulate real-world scenarios. The tasks include deploying and configuring applications, creating and managing Kubernetes objects, and troubleshooting common issues. CKAD exam is proctored, and candidates are given a time limit of two hours to complete all the tasks.
NEW QUESTION # 67
You have a stateful application that requires persistent storage. You need to create a PersistentV01umeClaim (PVC) that Will be used by a Deployment to store application dat a. The PVC should have the following specifications:
- Access Modes: ReadWriteOnce
- Storage Class: 'fast-storage
- Storage Size: IOGi
Provide the YAML code for creating this PVC.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. create the PVC YAML file:
2. Apply the PVC YAML using kubectl: bash kubectl apply -f my-pvc.yaml 3. Verify the PVC creatiom bash kubectl get pvc You should see the PVC ' my-pvc' listed with the specified access mode, storage class, and size.,
NEW QUESTION # 68
Context
Context
A container within the poller pod is hard-coded to connect the nginxsvc service on port 90 . As this port changes to 5050 an additional container needs to be added to the poller pod which adapts the container to connect to this new port. This should be realized as an ambassador container within the pod.
Task
* Update the nginxsvc service to serve on port 5050.
* Add an HAproxy container named haproxy bound to port 90 to the poller pod and deploy the enhanced pod. Use the image haproxy and inject the configuration located at /opt/KDMC00101/haproxy.cfg, with a ConfigMap named haproxy-config, mounted into the container so that haproxy.cfg is available at /usr/local/etc/haproxy/haproxy.cfg. Ensure that you update the args of the poller container to connect to localhost instead of nginxsvc so that the connection is correctly proxied to the new service endpoint. You must not modify the port of the endpoint in poller's args . The spec file used to create the initial poller pod is available in /opt/KDMC00101/poller.yaml
Answer:
Explanation:
Solution:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
selector:
matchLabels:
run: my-nginx
replicas: 2
template:
metadata:
labels:
run: my-nginx
spec:
containers:
- name: my-nginx
image: nginx
ports:
- containerPort: 90
This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:
kubectl apply -f ./run-my-nginx.yaml
kubectl get pods -l run=my-nginx -o wide
NAME READY STATUS RESTARTS AGE IP NODE
my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd Check your pods' IPs:
kubectl get pods -l run=my-nginx -o yaml | grep podIP
podIP: 10.244.3.4
podIP: 10.244.2.5
NEW QUESTION # 69 
Task:
1- Update the Propertunel scaling configuration of the Deployment web1 in the ckad00015 namespace setting maxSurge to 2 and maxUnavailable to 59
2- Update the web1 Deployment to use version tag 1.13.7 for the Ifconf/nginx container image.
3- Perform a rollback of the web1 Deployment to its previous version
Answer:
Explanation:
See the solution below.
Explanation
Solution:
Text Description automatically generated
NEW QUESTION # 70 
Task
A Deployment named backend-deployment in namespace staging runs a web application on port 8081.
Answer:
Explanation:
See the solution below.
Explanation:
Solution:
NEW QUESTION # 71
You're building a containerized application that needs access to a database running outside of the Kubernetes cluster You need to implement a service account With specific permissions to access tne external database using an API key.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Service Account:
- Create a service account YAML file named 'database-service-account.yamr with the following contents:
2. Create a Secret for the API Key: - Create a secret YAML file named 'database-api-key.yaml with the following contents:
3. Create a Role and Role8inding: - Create a Role YAML file named 'database-role.yaml with the following contents:
4. Create a ROIeBinding YAML: - Create a RoleBinding YAML file named 'database-rolebinding.yamr with the following contents:
5. Apply the YAML Files: - Apply the created YAML files using 'kubectl apply -f database-service-account.yamr , 'kubectl apply -f database-api-key.yamr, ' kubectl apply -f database-role.yamr , and 'kubectl apply -f database-rolebinding.yamr 6. Update your Deployment: - Update your application deployment to use the 'database-service-account and mount the secret containing the API key.
7. Access the External Database: - Your application container should now be able to access the external database using the API key provided in the secret.
NEW QUESTION # 72
You're running a MYSQL database pod in a Kubernetes cluster. You need to ensure that the pod is always running on a specific node, regardless of node failures or maintenance events. This node has specific hardware or software requirements that the MySQL database requires. How do you achieve this?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Node Affinity: Define a node affinity rule for your MySQL pod that specifically targets the desired node. You'll use 'nodeselector' or 'nodeAffinity' in your pod definition.
2. Apply the Pod Definition: Apply the YAML configuration to your Kubernetes cluster using ' kubectl apply -f mysql-pod-yamr 3. Verify Pod Placement: Use 'kubectl get pods -l app=mysqr to verify that the pod is running on the intended node (i.e., "your-specific-node-name"). 4. Handle Node Failure: While this ensures the pod starts on the desired node, if that node fails, the pod will not be automatically rescheduled. To address this, consider using: - Node Selectors: You can combine 'nodeselector' with 'nodeAffinity' to prioritize your specific node. This ensures that the pod tries to schedule on your preferred node first- - Taint and Tolerations: You can taint the specific node with a unique key and then add a toleration to your MySQL pod to tolerate that taint. This allows the pod to be scheduled on tnat node and only that node. 5. Deployment for Scalability: It you need to run multiple MySQL pods, you can leverage a Deployment to manage their lifecycle. Ensure the deployment's 'spec-template' incorporates the node affinity rules. This ensures tnat new pods are always scheduled on the designated node. Remember: Carefully consider the implications of hard-binding pods to specific nodes. While it ensures consistency, it also reduces flexibility and can impact your overall cluster health and availability.,
NEW QUESTION # 73 
Context
Your application's namespace requires a specific service account to be used.
Task
Update the app-a deployment in the production namespace to run as the restrictedservice service account. The service account has already been created.
Answer:
Explanation:
See the solution below.
Explanation:
Solution:
NEW QUESTION # 74
You are building a web application that uses a set of environment variables for configuration. These variables are stored in a ConfigMap named 'app-config' . How would you ensure that the web application pods always use the latest version of the ConfigMap even when the ConfigMap is updated?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create the ConfigMap: Define the ConfigMap with your desired environment variables.
2. Update the Deployment: Modify your Deployment YAML file to: - Use a 'volumeMount' to mount the ConfigMap into the container. - Specify a 'volume' using a 'configMap' source, referencing tne 'app-config' ConfigMap. - Set 'imagePullPolicy: Always' to ensure the pod always pulls the latest container image.
3. Apply the changes: Use 'kubectl apply -f deployment-yamp to update the Deployment 4. Llpdate the ConfigMap: Whenever you need to update the configuration, modify the Sapp-config' ConfigMap using 'kubectl apply -f configmap-yamr 5. Verify changes: Observe the pods for the 'web-app' Deployment. They should automatically restart and pick up the new environment variables from the updated ConfigMap. By setting 'imagePullPolicy: AlwayS , your pods will always pull the latest container image- This ensures that the pod's container always uses the latest code. Additionally, the 'volumeMount' and 'volume detinitions mount tne Sapp-config' ConfigMap into the containers 'letc/config' directory, making the environment variables accessible within the container When you update the ConfigMap, the pod will detect the change and automatically restart, loading the new configuration from the updated ConfigMap. ,
NEW QUESTION # 75
You are running a Deployment for a database service with 3 replicas. You want to ensure that only one pod is updated at a time, but you need to guarantee that the database service remains available throughout tne update process. How would you configure the Deployment to achieve this?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Update the Deployment YAMLI
- Update the 'replicas' to 3.
- Define 'maxiJnavailable: 1 ' and 'maxSurge: O' in the 'strategy-rollingupdate' section to control the rolling update process.
- Use a 'readiness probe' within your container definition to ensure that the pod is considered ready only when tne database is successfully started and connected.
- Configure a 'strategy-type' to 'RollingUpdate' to trigger a rolling update when the deployment is updated.
2. Create the Deployment: - Apply the updated YAML file using 'kubectl apply -f database-deployment-yamp 3. Verify the Deployment - Check the status of the deployment using 'kubectl get deployments database-deployment to confirm the rollout and updated replica count. 4. Trigger the Automatic Update: - Pusn a new image to the Docker Hub repository. 5. Monitor the Deployment - Use 'kubectl get pods -l to monitor the pod updates during the rolling update process. You will observe that only one pod is terminated at a time. The readiness probe will ensure that a new pod is only considered ready when it's successfully connected to the database. 6. Check for Successful Update: - Once the deployment is complete, use 'kubectl describe deployment database-deployment to see that the 'updatedReplicas' field matches the 'replicas' field, indicating a successful update.,
NEW QUESTION # 76
You are tasked witn building a container image for a Node.js application that needs to interact with a MongoDB database. Describe now you would configure your Dockerfile to include MongoDB and how you would set up your Node.js application to connect to the database within the container.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Utilize a Multi-Stage Dockerfile: Employ a multi-stage Dockerfile to separate the build and runtime environments, optimizing the final image size.
2. Install MongoDB in the Base Image: - Use a suitable MongoDB base image, such as 'mongo:latest', in the runtime stage. 3. Install Node.js Dependencies: - IJse a Nodejs base image, such as 'node:16-alpine', in the build stage. - Install Node.js dependencies using 'yarn install'. 4. Connect to MongoDB from the Node.js Application: - In your Node.js application, use a MongoDB driver (e.g., 'mongodb') to establish a connection to the MongoDB instance.
5. Build and Run the Container: - Build the image using 'docker build . -t my-node-mongo-apps - Run the container using 'docker run -it -p 2701727017 my-node-mongo-app' - The '-p 27017:27017' mapping exposes the MongoDB port to your host machine, allowing you to connect to the database from your local machine. 6. Access MongoDB. - You can use a MongoDB client tool (e.g., Mongo Shell, Robo 3T) or other applications to connect to the MongoDB instance running inside the container.,
NEW QUESTION # 77
You are working on a Kubernetes application that requires ephemeral storage. The application data needs to be stored within the pod's container and should be deleted when the pod is deleted. How can you achieve this using ephemeral storage in Kubernetes?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Deployment with an EmptyDir Volume:
- Define an 'EmptyDirs volume in tne Deployment YAML.
- Specify the volume mount path Within the container.
- Example:
2. Create the Deployment: - Apply the Deployment YAML using 'kubectl apply -f my-app-deployment-yamr 3. Verify the Deployment - Check the status of the Deployment using ' kubectl get deployments my-app' - Verify that the Pod is running and using the EmptyDir volume. 4. Test Ephemeral Storage Behavior: - Write data to the Aldata' directory within the container - Delete the pod. - Create a new pod from the same Deployment. - The data written to tne "data' directory will no longer be present in the new pod, as the volume is ephemeral and is deleted when the pod is deleted.
NEW QUESTION # 78 
Set Configuration Context:
[student@node-1] $ | kubectl
Config use-context k8s
Task
You have rolled out a new pod to your infrastructure and now you need to allow it to communicate with the web and storage pods but nothing else. Given the running pod kdsn00201 -newpod edit it to use a network policy that will allow it to send and receive traffic only to and from the web and storage pods.
Answer:
Explanation:
See the solution below.
Explanation:
To allow a pod to send and receive traffic only to and from specific pods, you can use network policies in Kubernetes.
First, you will need to create a network policy that defines the allowed traffic. You can create a network policy yaml file with the following rules:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: newpod-network-policy
namespace: default
spec:
podSelector:
matchLabels:
app: kdsn00201-newpod
ingress:
- from:
- podSelector:
matchLabels:
app: web
- podSelector:
matchLabels:
app: storage
This policy will only allow incoming traffic to the pod with the label app=kdsn00201-newpod from pods with the label app=web or app=storage. If you have different labels on your web and storage pods please update the matchLabels accordingly.
Once you have created the network policy, you can apply it to the cluster by running the following command:
kubectl apply -f <network-policy-file>.yaml
This will apply the network policy to the cluster, and the newpod will only be able to send and receive traffic to and from the web and storage pods.
Please note that, NetworkPolicy resource is not available by default, you need to enable the NetworkPolicy feature on your Kubernetes cluster. This feature is enabled by default on some clusters and must be explicitly enabled on others. You can check if NetworkPolicy is available by running the command kubectl api-versions
| grep networking
Also, you need to ensure that the pods that you want to allow traffic to and from are running on the same namespace.
NEW QUESTION # 79
You are building a new web application that utilizes a microservice architecture- One of the microservices, 'recommendation-service', is responsible for providing personalized product recommendations to users.
This service uses a machine learning model for generating recommendations based on user purchase history and browsing behavior. The model is trained offline and its weights are stored in a 'model-store' service.
Design a mufti-container Pod for the 'recommendation-service' that incorporates the following considerations:
- The Pod should include a primary container for the 'recommendation-service' application.
- The Pod should include a secondary container that runs the 'model-store' service to provide access to the trained model weights.
- Both containers should share a common volume to ensure that the model weights are available to the 'recommendation-service' container-
- The recommendation-service' snould be able to access the model weignts from the 'model-store' container witnout relying on a network call to another service-
- The recommendation-service' container should be configured to periodically update the model weights from the 'model-store' container when a new version of the model is available.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create the Deployment YAML:
- Define a Deployment with the name 'recommendation-service'
- Set the replicas to for redundancy and scalability.
- Specify the labels Sapp: recommendation-service' for selecting the Pods in the Deployment.
- Create a 'template' section to define the Pod specificatiom
2. Deploy the Resources: - Apply the Deployment using 'kubectl apply -f deployment-yamp 3. Verify the Deployment: - Check the status of the Deployment using 'kubectl get deployments recommendation-service and ensure that three Pods are running. 4. Contigure the 'recommendation-service' - Modify the 'recommendation-service application to load the model weights from the specified path ClmodeVIatest-modeI_weightS). - Implement a mechanism within the 'recommendation-service to periodically check tor updated model weights in the shared volume. 5. Configure the 'model-store service: - Ensure that the model-store service is properly configured to store and retrieve the model weights. - Implement a mechanism in the 'model-store' service to notify the 'recommendation-service when a new model version is available. This notification can be achieved using a shared volume or a separate messaging system. 6. Test the Application: - Send requests to the 'recommendation-service' to generate recommendations. - Monitor the 'model-store' service and the shared volume to verify that the model weights are being updated correctly and the recommendation- service' is using the latest model version. Important Considerations: - Ensure that the 'recommendation-service' application is properly configured to access and load the model weights from the shared volume. - Implement a robust model management strategy, including versioning and rollback mechanisms, to ensure that the recommendation-service always uses the appropriate model. - Consider using a dedicated model store service that provides a dedicated API for retrieving and updating model weights. This can simplify the communication between the 'recommendation-service' and the model store. - Monitor the performance and resource usage of both services to ensure optimal performance.,
NEW QUESTION # 80 
Context
A user has reported an aopticauon is unteachable due to a failing livenessProbe .
Task
Perform the following tasks:
* Find the broken pod and store its name and namespace to /opt/KDOB00401/broken.txt in the format:
The output file has already been created
* Store the associated error events to a file /opt/KDOB00401/error.txt, The output file has already been created. You will need to use the -o wide output specifier with your command
* Fix the issue.
Answer:
Explanation:
See the solution below.
Explanation
Solution:
Create the Pod:
kubectl create
-f http://k8s.io/docs/tasks/configure-pod-container/
exec-liveness.yaml
Within 30 seconds, view the Pod events:
kubectl describe pod liveness-exec
The output indicates that no liveness probes have failed yet:
FirstSeen LastSeen Count From SubobjectPath Type Reason Message
--------- -------- ----- ---- ------------- -------- ------ -------
24s 24s 1 {default-scheduler } Normal Scheduled Successfully assigned liveness-exec to worker0
23s 23s 1 {kubelet worker0} spec.containers{liveness} Normal Pulling pulling image
"gcr.io/google_containers/busybox"
23s 23s 1 {kubelet worker0} spec.containers{liveness} Normal Pulled Successfully pulled image
"gcr.io/google_containers/busybox"
23s 23s 1 {kubelet worker0} spec.containers{liveness} Normal Created Created container with docker id
86849c15382e; Security:[seccomp=unconfined]
23s 23s 1 {kubelet worker0} spec.containers{liveness} Normal Started Started container with docker id
86849c15382e
After 35 seconds, view the Pod events again:
kubectl describe pod liveness-exec
At the bottom of the output, there are messages indicating that the liveness probes have failed, and the containers have been killed and recreated.
FirstSeen LastSeen Count From SubobjectPath Type Reason Message
--------- -------- ----- ---- -------------
37s 37s 1 {default-scheduler } Normal Scheduled Successfully assigned liveness-exec to worker0
36s 36s 1 {kubelet worker0} spec.containers{liveness} Normal Pulling pulling image
"gcr.io/google_containers/busybox"
36s 36s 1 {kubelet worker0} spec.containers{liveness} Normal Pulled Successfully pulled image
"gcr.io/google_containers/busybox"
36s 36s 1 {kubelet worker0} spec.containers{liveness} Normal Created Created container with docker id
86849c15382e; Security:[seccomp=unconfined]
36s 36s 1 {kubelet worker0} spec.containers{liveness} Normal Started Started container with docker id
86849c15382e
2s 2s 1 {kubelet worker0} spec.containers{liveness} Warning Unhealthy Liveness probe failed: cat: can't open
'/tmp/healthy': No such file or directory
Wait another 30 seconds, and verify that the Container has been restarted:
kubectl get pod liveness-exec
The output shows that RESTARTS has been incremented:
NAME READY STATUS RESTARTS AGE
liveness-exec 1/1 Running 1 m
NEW QUESTION # 81
You have a Node.js application that runs in a Kubernetes cluster. The application requires access to a MySQL database hosted externally on a different server. Due to security concerns, you cannot directly expose the database to the application pod. Describe how you can implement a network policy to enable secure communication between the application pod and the MySQL database.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Network Policy:
- Create a Network Policy that allows traffic only from the application pods to the MySQL database server-
- Define the podSelector' to specify the application pods that should be allowed to connect to the database.
- Use 'ingress' rules to define the allowed incoming traffic from the application pods.
- Specify the 'from' field to identify the source pods using labels or namespaces-
- Set the 'to' field to specify the target IP address or range of the MySQL database server
2. Deploy the Network Policy: - Apply the Network Policy to your Kubernetes cluster using 'kubectl apply -f mysql-access.yamr 3. Configure the Application: - Configure your Node.js application to connect to the MySQL database using the IP address or hostname of the database server. - Ensure that the Node.js application has appropriate security credentials to access the database. 4. Test the Application: - Run your application and verify that it can connect to the MySQL database successfully. Note: This example provides a basic implementation. You might need to adjust the configuration based on your specific security requirements and network setup. You can further enhance the network policy by using specific ports, protocols, and other security measures as needed.,
NEW QUESTION # 82 
Given a container that writes a log file in format A and a container that converts log files from format A to format B, create a deployment that runs both containers such that the log files from the first container are converted by the second container, emitting logs in format B.
Task:
* Create a deployment named deployment-xyz in the default namespace, that:
*Includes a primary
lfccncf/busybox:1 container, named logger-dev
*includes a sidecar Ifccncf/fluentd:v0.12 container, named adapter-zen
*Mounts a shared volume /tmp/log on both containers, which does not persist when the pod is deleted
*Instructs the logger-dev
container to run the command
which should output logs to /tmp/log/input.log in plain text format, with example values:
* The adapter-zen sidecar container should read /tmp/log/input.log and output the data to /tmp/log/output.* in Fluentd JSON format. Note that no knowledge of Fluentd is required to complete this task: all you will need to achieve this is to create the ConfigMap from the spec file provided at /opt/KDMC00102/fluentd-configma p.yaml , and mount that ConfigMap to /fluentd/etc in the adapter-zen sidecar container See the solution below.
Answer:
Explanation:
Solution:
NEW QUESTION # 83
You have a Deployment named 'web-app-deployments that runs a web application in a containerized environment. The application is designed for high availability and scalability, but you need to ensure that no more than two pods are ever terminated simultaneously during a rolling update process. This is to minimize the impact on service availability during the update. How would you implement this rolling update strategy using Deployment resources?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
I). Update the Deployment YAML:
- Modify the 'strategy.roIIinglJpdate' section of the Deployment YAML to configure the rolling update behavior.
- Set 'maxunavailable: 1 ' to allow only one pod to be unavailable at a time during the update.
- Set 'maxSurge: 1 ' to permit only one additional pod to be created beyond the desired replica count during the update.
2. Apply the Updated Deployment: - Use ' kubectl apply -f web-app-deployment-yamr to update the Deployment. 3. Monitor the Rolling Update: - Observe the pod updates using 'kubectl get pods -I app=web-app' - You will see that during the rolling update, only one pod is terminated, while one new pod is created, ensuring that no more than two pods are ever terminated at the same time. 4. Verify the Update: - Once the rolling update is complete, check the 'updatedReplicaS field in the Deployment description Ckubectl describe deployment web-app- deployment) to verify that it matches the 'replicas' field.
NEW QUESTION # 84
Task:
Update the Deployment app-1 in the frontend namespace to use the existing ServiceAccount app.
Answer:
Explanation:
See the solution below.
Explanation:
Solution:
NEW QUESTION # 85
You have a web application tnat requires a dedicated sidecar container to manage logging and monitoring. The sidecar container should be deployed alongside every pod of the application. You need to ensure that the sidecar container is always available alongside the application pods, even if the main application container ex;mences failures. Which Kubernetes resource is most suitable for this scenario and wny?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Choose DaemonSet The most suitable Kubernetes resource for this scenario is a DaemonSet.
2. Daemonset Functionality: Daemonsets ensure that a pod is running on every node in your cluster. This is ideal tor sidecar containers because they need to be present alongside tne main application pod on each node.
3. Daemonset Benefits:
- Guaranteed Availability: Daemonsets guarantee that the sidecar container is always available on the same node as the main application pod, even if the application pod is restarted or fails.
- Pod Management: DaemonSets manage the lifecycle of the sidecar container, ensuring its availability and resource allocation.
- Node-Level Deployment: Daemonsets deploy pods on all nodes, ensuring consistent functionality across the cluster
4. Implementation Example:
This DaemonSet definition specifies a pod with two containers: the 'logging-sidecar' and 'your-application'. The Slogging-sidecar' is your sidecar container, and 'your-application' represents your main application. - Important: The Daemonset will ensure that a pod with these containers is deployed on every node of your Kubernetes cluster 5. Deployment and Monitoring: - Deployment: Use 'kubectl apply -f logging-sidecar.yamr to deploy the DaemonSet. - Monitoring: Observe the pods created by the Daemonset using 'kubectl get pods'. You should see a pod with the 'logging-sidecar and 'your- application' containers running on each node- 6. Conclusion: - Using a DaemonSet to manage your sidecar container ensures its consistent availability alongside the main application pods, guaranteeing logging and monitoring capabilities even in case of pod failures-,
NEW QUESTION # 86
You have a ConfigMap named 'my-app-config' that stores environment variables for your application. You want to dynamically update tne values in the ConfigMap without restarting the pods. How would you achieve this using a Kubernetes Patch?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Get the Existing ConfigMap Data:
bash
kubectl get configmap my-app-config -o yaml > my-app-config.yaml
2. Modify the YAML File:
- Open 'my-app-config.yaml and update the values in the 'data' section as required- For example, if you want to change the value of 'DATABASE_HOST to Sdb.new.example.coms:
3. Patch the ConfigMap: bash kubectl patch configmap my-app-config -p "S(cat my-app-config_yaml)" 4. Verify the Changes: bash kubectl get configmap my-app-config -o yaml 5. Observe the Updated Values: - The pods will automatically pick up the updated values without the need for restarting. - You can confirm this by checking the environment variables within the pod using 'kubectl exec -it - bash -c 'env" This method allows for dynamic updates to the ConfigMap without restarting the pods, making it a convenient way to manage environment variables in your Kubernetes applications.
NEW QUESTION # 87
You are developing a new microservice that requires access to a database deployed in a different namespace. You want to configure a ServiceAccount and RoleBinding to provide the necessary permissions for the microservice to connect to the database.
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a ServiceAccount:
- Create a ServiceAccount in the namespace where our microservice is deployed:
2. Create a Role: - Create a Role in the namespace where the database is deployed, granting access to the database resources:
3. Create a ROIeBinding: - Create a RoleBinding in the database namespace to bind the Role to the ServiceAccount:
4. Apply the Configuration: - Apply the created ServiceAccount, Role, and Roledinding using 'kubectl apply -r commands: bash kubectl apply -f my-microservice-sa_yaml kubectl apply -f my-database-access-role-yaml kubectl apply -f my-database-access-rolebinding.yaml 5. Configure the Microservice: - Mount the ServiceAccount token as a secret within the microservice's pod:
6. Verify Permissions: - Access the database from the microservice pod to verify that the required permissions are granted.
NEW QUESTION # 88
Context
You are asked to set resource requests and limits for a running workload to ensure fair resource management.
"Do not delete the existing Deployment . Failure to do so will result in a reduced score." Next, ensure that the total amount of resources in the namespace matches the maximum resources the Pods from the nginx-resources Deployment can request.
Failure to do so will result in the updated Deployment failing to roll out successfully.
Answer:
Explanation:
See the Explanation below for complete solution.
Explanation:
Below are the exact steps/commands you can run.
1) Locate the Deployment and its namespace
kubectl get deploy -A | grep nginx-resources
You should see output like:
<namespace> nginx-resources ...
Set a variable (replace <NS> with what you see):
NS=<NS>
Confirm replicas:
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'
2) Check if there is a ResourceQuota in that namespace
kubectl -n $NS get resourcequota
kubectl -n $NS describe resourcequota
If there is a quota, note these fields (common ones):
* requests.cpu
* requests.memory
* limits.cpu
* limits.memory
3) Decide requests/limits for the Deployment (example values)
If the question (in your environment) provides specific values, use those.
If it doesn't, a typical safe pair is:
* requests: cpu: 100m, memory: 128Mi
* limits: cpu: 200m, memory: 256Mi
I'll proceed with these example values. If your lab specifies different numbers, just swap them in.
4) Update the existing Deployment (DO NOT DELETE)
Option A (fastest): kubectl set resources
Assuming the container name is the first container (we'll detect it):
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}' If it prints a single container name, set it like this:
kubectl -n $NS set resources deploy nginx-resources \
--requests=cpu=100m,memory=128Mi \
--limits=cpu=200m,memory=256Mi
Verify the Deployment now has resources
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'
5) Compute the total resources requested by the Deployment
Get replicas:
REPLICAS=$(kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}') echo $REPLICAS
6) Ensure the namespace quota matches (or exceeds) those totals
This is the part the question warns about: if the quota is too low, the Deployment update will fail to roll out.
6.1 If a ResourceQuota already exists
Patch it to allow at least the totals you calculated.
First, identify quota name:
RQ=$(kubectl -n $NS get resourcequota -o jsonpath='{.items[0].metadata.name}') echo $RQ Then patch (example: replicas=2 # requests.cpu=200m, requests.memory=256Mi):
kubectl -n $NS patch resourcequota $RQ --type='merge' -p '{
"spec": {
"hard": {
"requests.cpu": "200m",
"requests.memory": "256Mi",
"limits.cpu": "400m",
"limits.memory": "512Mi"
}
}
}'
Adjust those numbers to your replicas × request, and replicas × limit (if your quota also enforces limits).
6.2 If there is NO ResourceQuota
Create one that matches the Deployment max request totals.
Example for replicas=2 with our sample requests/limits:
cat <<EOF | kubectl apply -n $NS -f -
apiVersion: v1
kind: ResourceQuota
metadata:
name: nginx-resources-quota
spec:
hard:
requests.cpu: "200m"
requests.memory: "256Mi"
limits.cpu: "400m"
limits.memory: "512Mi"
EOF
7) Verify rollout succeeds
kubectl -n $NS rollout status deploy nginx-resources
kubectl -n $NS get pods
Verify the running pods actually have the requests/limits:
kubectl -n $NS get pod -l app=nginx-resources -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.spec.
containers[0].resources}{"\n"}{end}'
(If the label selector app=nginx-resources doesn't exist, just pick a pod name from kubectl get pods and run:) kubectl -n $NS describe pod <pod-name> | sed -n '/Limits:/,/Requests:/p' Common reasons this fails (and the fix)
* Rollout stuck / pods pending with "exceeded quota"Check:
* kubectl -n $NS describe pod <pending-pod>
* kubectl -n $NS describe resourcequota
Fix: increase ResourceQuota hard values to match required totals.
* You set requests higher than quota allowsFix: either reduce requests or raise quota.
kubectl get deploy -A | grep nginx-resources
kubectl -n <NS> get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}{.spec.template.spec.
containers[0].name}{"\n"}'
kubectl -n <NS> describe resourcequota
NEW QUESTION # 89
......
Tested Material Used To CKAD Test Engine: https://www.actualtorrent.com/CKAD-questions-answers.html
Steps Necessary To Pass The CKAD Exam: https://drive.google.com/open?id=1ZX0mcUlD7fd6kSATsfT9MFRoGMw9CmFX