set2

Which architectural component ensures that the actual state of cluster resources converges towards the desired state defined in their specifications?

• kube-apiserver
• kube-scheduler
• Controllers (within kube-controller-manager)
• kubelet
• etcd

Answer explanation

Controllers implement reconciliation loops. They watch the desired state via the API server and interact with resources to make the current state match the desired state (e.g., ReplicaSet controller ensuring the right number of Pods exist).

A Pod specification includes two containers: one web server and one log shipper. How do these containers communicate efficiently over the network within the Pod?

• Via a Kubernetes Service
• Via the node's primary IP address
• Via localhost and shared network namespace
• Via an automatically created NetworkPolicy
• Via distinct Pod IP addresses assigned to each container

Answer explanation

Containers within the same Pod share the same network namespace, meaning they can communicate using localhost and standard inter-process communication mechanisms as if they were on the same machine.

What is the primary role of kubelet on a worker node?

• To schedule Pods onto the node
• To store the state of Pods running on the node
• To ensure containers described in PodSpecs assigned to its node are running
• To manage network routing rules for Services
• To authenticate API requests originating from the node

Answer explanation

The kubelet is the primary node agent. It receives PodSpecs from the API server and interacts with the container runtime (e.g., containerd) to start, stop, and manage the containers defined in those Pods, reporting their status back to the control plane.

Which Kubernetes resource provides a mechanism for grouping API objects and providing a scope for names?

• Label
• Annotation
• Namespace
• Deployment
• ServiceAccount

Answer explanation

Namespaces create logical partitions within a cluster, allowing teams or applications to operate independently. Resource names must be unique within a Namespace, but not necessarily across the entire cluster.

When interacting with the Kubernetes API server using kubectl, what is the typical format used for defining resource manifests?

• JSON
• XML
• YAML
• Protocol Buffers
• Plain Text

Answer explanation

While the API server can accept JSON, YAML is the overwhelmingly conventional and human-readable format used in configuration files (manifests) passed to kubectl for creating or updating resources.

What core Kubernetes concept allows Deployments to perform rolling updates with zero downtime?

• Managing StatefulSets
• Utilizing PersistentVolumes
• Incrementally replacing Pods managed by ReplicaSets
• Direct communication with the kube-scheduler
• Modifying NetworkPolicy rules dynamically

Answer explanation

Deployments manage ReplicaSets. During a rolling update, a Deployment creates a new ReplicaSet with the updated Pod template and gradually scales it up while scaling down the old ReplicaSet, ensuring service availability throughout the process.

Which component is responsible for making the ultimate decision about which node a newly created Pod should run on?

• kubelet
• kube-apiserver
• kube-scheduler
• kube-controller-manager
• The Pod's ServiceAccount

Answer explanation

The kube-scheduler watches for Pods without an assigned node and selects the most suitable node based on filtering (resource requests, affinity rules, etc.) and scoring algorithms.

How does Kubernetes typically handle the failure of a container within a Pod?

• By deleting the entire Pod immediately
• By restarting the failed container based on the Pod's restartPolicy
• By scheduling a new Pod on a different node
• By marking the Node as unschedulable
• By alerting the kube-scheduler to find a replacement container

Answer explanation

The kubelet monitors container health. If a container fails, the kubelet restarts it according to the Pod's restartPolicy (Always, OnFailure, Never). The Pod itself continues to exist on the same node.

What distinguishes a Kubernetes Secret from a ConfigMap?

• Secrets are namespaced, ConfigMaps are not
• ConfigMaps store configuration data, Secrets store sensitive data (base64 encoded)
• Secrets can only be mounted as environment variables, ConfigMaps as files
• ConfigMaps are automatically encrypted at rest, Secrets are not
• Secrets are immutable once created, ConfigMaps are mutable

Answer explanation

Both are used for configuration, but Secrets are intended for sensitive information (passwords, keys) and are stored base64 encoded (not truly encrypted by default in etcd, though). ConfigMaps are for non-sensitive configuration data. Both are namespaced and can be mounted in multiple ways.

Which of the following is NOT a standard component of the Kubernetes control plane?

• etcd
• kube-apiserver
• kube-scheduler
• containerd
• kube-controller-manager

Answer explanation

containerd is a container runtime; it typically runs on worker nodes (managed by the kubelet) to handle container execution, not as part of the central control plane.