set 3

What is a primary motivation for adopting container orchestration beyond simply running containers with a runtime like containerd?

• To achieve higher density of containers on a single host.
• To automate deployment, scaling, healing, and networking of distributed applications.
• To simplify the process of building container images from source code.
• To provide a standardized container image format for portability.
• To enforce strict kernel isolation between containers.

Answer explanation

While runtimes manage container lifecycle on a single host, orchestration automates complex tasks across a cluster of hosts, such as declarative deployments, auto-scaling based on load, self-healing of failed instances, service discovery, and load balancing.

The Container Runtime Interface (CRI) in Kubernetes serves what key purpose?

• To define the standard for container image formats.
• To provide an API for kubelet to interact with different container runtimes.
• To manage network plugin configurations (CNI).
• To enforce security policies for container execution.
• To schedule containers onto nodes.

Answer explanation

CRI is a plugin interface enabling kubelet to use various container runtimes (like containerd, CRI-O) without recompiling Kubernetes. It standardizes communication for operations like starting/stopping Pods and containers.

In Kubernetes RBAC, what is the difference between a Role and a ClusterRole?

• Role grants permissions to users, ClusterRole to ServiceAccounts.
• Role is for read-only access, ClusterRole for write access.
• Role is namespaced, ClusterRole is cluster-wide.
• Role defines permissions, ClusterRole binds permissions to subjects.
• Role is for built-in components, ClusterRole for custom resources.

Answer explanation

Role objects define permissions within a specific namespace, while ClusterRole objects define permissions that apply cluster-wide (e.g., to access nodes, persistent volumes, or resources across all namespaces).

Which Kubernetes networking component is responsible for ensuring that traffic sent to a Service's IP address is correctly routed to one of its backing Pods?

• CNI plugin
• kube-dns / CoreDNS
• kube-proxy
• Ingress controller
• The API server's endpoint controller.

Answer explanation

kube-proxy runs on each node and maintains network rules (e.g., using iptables, IPVS) that implement Kubernetes Services. It watches the API server for Service and EndpointSlice changes and updates these rules accordingly.

What fundamental problem does a Service Mesh aim to solve for microservices that is not inherently addressed by basic Kubernetes Services?

• Providing stable IP addresses for Pods.
• Exposing services to external traffic via HTTP/S routing.
• Adding advanced observability, security (mTLS), and traffic control between services.
• Managing persistent storage for stateful applications.
• Automating the build and deployment of container images.

Answer explanation

While Kubernetes Services provide basic L4 load balancing and service discovery, a Service Mesh (like Istio, Linkerd) adds a dedicated infrastructure layer for L7 concerns like fine-grained traffic management (canary, retries), mutual TLS (mTLS) between services, and detailed telemetry (metrics, traces).

What is the role of a PersistentVolumeClaim (PVC) in Kubernetes storage?

• It defines a specific type of storage backend (e.g., SSD, HDD).
• It represents a piece of provisioned storage available in the cluster.
• It is a request for storage by a user/Pod, consuming a PersistentVolume.
• It directly attaches a node's local disk to a Pod.
• It manages the lifecycle of storage snapshots.

Answer explanation

A PVC is a request for storage by a user. It consumes an existing PersistentVolume (PV) or can dynamically provision one if a StorageClass is configured. Pods then mount the PVC as a volume.

How does container orchestration typically facilitate "self-healing" for applications?

• By automatically applying security patches to container images.
• By using AI to predict and prevent application failures.
• By monitoring application health and automatically restarting or replacing failed instances.
• By providing detailed debugging tools for developers to fix application bugs faster.
• By load balancing traffic away from nodes with high CPU usage.

Answer explanation

Orchestrators monitor the health of application instances (e.g., Pods). If an instance fails a health check or crashes, the orchestrator can automatically restart it or replace it with a new instance to maintain the desired state and availability.

Which of these is a direct responsibility of an OCI-compliant container runtime like containerd?

• Scheduling containers across a cluster of machines.
• Managing the lifecycle of containers on a single host (create, start, stop, delete).
• Defining the desired state of application deployments.
• Providing inter-service authentication using mTLS.
• Allocating persistent storage volumes from cloud providers.

Answer explanation

Container runtimes like containerd are responsible for managing the complete container lifecycle on a single node, including pulling images, creating, starting, stopping, and deleting containers as instructed by a higher-level component like the kubelet.

What is the primary purpose of a ServiceAccount in Kubernetes security?

• To provide an identity for human users to log into the cluster.
• To define permissions for accessing Kubernetes API resources.
• To provide a distinct identity for processes running inside Pods to interact with the API.
• To securely store API tokens and certificates for external services.
• To encrypt network traffic between Pods.

Answer explanation

ServiceAccounts are meant for processes within Pods, giving them an identity that can be authenticated by the API server and authorized via RBAC to perform specific actions. Human users typically use regular user accounts or external identity providers.

What role does the Container Network Interface (CNI) play in Kubernetes networking?

• It defines the API for how kube-proxy implements Services.
• It provides a specification for writing plugins to configure network interfaces for Pods.
• It manages DNS resolution for Services and Pods within the cluster.
• It enforces network policies to restrict traffic flow between Pods.
• It provides a secure tunnel for control plane communication.

Answer explanation

CNI is a specification and a set of libraries for writing plugins to configure network interfaces in Linux containers. In Kubernetes, CNI plugins are responsible for connecting Pods to the cluster network and assigning IP addresses.