NEW
Font size
WorksheetsNetworking, Load Balancing, Storage and Configuration
Total questions: 44
Worksheet time: 22mins
What is the role of a Service in Kubernetes?
Schedules Pods on worker nodes.
Manages the Deployment Service for Pods.
Handles storing Secrets and Configuration.
Provides a single point of entry for accessing one or more Pods.
How do you associate a Service with Pod?
Use an Annotation
That is not supported
Use a Deployment
Use a Label
Services default to which type unless otherwise specified?
ClusterIP
ExternalName
NodePort
LoadBanacer
When deploying an app running on a Kubernetes cluster, what would you configure the "service type" as in order to expose the service on the same port of each selected node?
ClusterIP
NodePort
LoadBalancer
NodeIP
Which of these is feature of service objects?
The set of pods that a service objects connects to does not change.
Versioning and healing are provided by service objects.
The service objects and the pods that they govern are tightly coupled.
Service objects provide stable static addresses that can be used by external clients.
One of your Pods needs access to a Service that has an associated port that is a published and a cluster IP in in its place. The client Pod's environment variables aren't yet populated, however. Why?
You must create the Service before creating the client Pods.
You must create the Service 30 minutes after you create the client Pods.
You must replace the Domain Name System (DNS) Service Discovery method with the environment variable method.
You must replace the Domain Name System (DNS) Service Discovery method with the Dynamic Host Configuration Protocol (DHCP) method.
A cluster administrator creatred a StorageClass resource named gce-storage-disk, allowing an storage system to dynamically provision volumes. What actions must a developer take to bind PersistentVolumeClaims (PVC) to PersistentVolumes (PV) of the storage class gce-storage-disk.
Set the volume.beta.kubernetes.io/storage-class-name: gce-storage-disk annotation on PVC resources.
Set the volume.beta.kubernetes.io/storage-class-name: gce-storage-disk attribute on PVC resources.
Set the spec.storageClassName: gce-storage-disk attribute on PVC resources.
Set the spec.storageClass: gce-storage-disk attribute on PVC resources.
You would like your company's Kubernetes deployments to use dynamic secret values generated as a set of files. Since you manage several clusters, what is the most effective way to handle this?
Define the secrets as environment variables under the Pod's container.
Write an init script that downloads the secrets from the Kubernetes API at runtime.
Run as init container to download the secrets from the Kubernetes API and mount them as a volume to the Pod.
Attach secrets ffiles to Pods by declaring a volume that will mount each secret as a file in the Pod definition.
In which scenario can you define a Service with a Pod selector?
When you want to point your Service in a different Namespace or an another cluster.
When you are migrating a workload to Kubernetes. During the evaluation process, you run only a proportion of your backends in Kubernetes.
When you want to have an external database cluster in production, but in your test environment you use your own database.
When you want the controller for the Service selector continuously scanning for Pods to match its selector, and then update an Endpoints if necessary.
Assume you are managing secrets for a Kubernetes Cluster. You have been careful to follow all suggested guidelines and stored all your secrets in Kubernetes objects. How can a secret still become exposed?
The application reading the secret from the volume and accidentally logging it.
The secret begin encoded in SHA256 as this is a plain text system.
A user who can create pods can still edit the value of the secret.
Anyone with root access on a node has write-access to the secret object.
What is true about Ingress controllers?
They allow Kubernetes services to be accessible by other pods with the cluster.
They are started automatically within a cluster.
They automatically program a frontend load balancer to enable Ingress configuration.
They needds to be only one ingress controller within a cluster.
You have a Network File System (NFS) that can support multiple read/write clients. However one specific NFS PV has been exported onto the server as read-only. What can you do to account for this difference?
Set theallowVolumeExplansion field to true in the StorageClass object(s).
Specify the appropriate access mode for each PV.
Include the new necessary parameters required for the parameters field in the StorageClass object(s).
Do not specify an access mode in the configuration file.
Under which label do you define the name of a service?
metadata
kind
spec
selector
You previously created a Kubernetes environment with an application that uses a secret to connect to a database. When you run kubectl describe secrets db-user-pass, the following code is outputted. How can you decode the authentication data?
You can decode the authentication data using this command: kubectl get secrets db-user-pass
1. Navigate to /etc/kubernetes/secrets on the host machine.
2. Open the db-user-pass file and get the user/password base64 hashes.
3. Decode the user/password using echo <ENCODED_VALUE> | base64 -D.
1. Set the secret type to plain using kubectl set secrets/db-user-pass plain.
2. Obtain authentication data from the kubectl describe secrets/db-user-pass output.
1. Extract the secret data using kubectl get secrets db-user-pass -o yaml.
2. Get the user/password base64 hashes.
3. Decode the user/password using echo <ENCODED_VALUE> | base64 -D.
How does a 'NodePort' Service type work?
It creates an internet-accessible load balancer cloud resource that will be used as the underlying resource for serving requests a set of Pods.
It allocates a fixed port on a single node within the cluster. Kubernetes will schedule Pods for this Service on the defined node.
It allocates a cluster-internal fixed IP address to access Pods on.
It allocates a fixed port on each of the cluster nodes that can be accessed from outside the cluster.
You are implementing a Service in your cluster to manage access to group of Pods. Currently, you have 100 pods running in your cluster and only 10 will be used by your new service. How would you ensure that your service hots only those 10 pods?
Set the property spec.selector.pod-name (pod name)
Ensure that the resource have the same name, and Kubernetes will connect them automatically.
Set the property metadata.pod - (pod name)
Use a selector such as name or app.
You must deploy multiple Pods. What steps should you take to acquire dynamic PersistentVolumes provisioning for pods?
When creating the Pod definition file, set dynamic parameter to true.
Create a StorageClass that fits your needs as well as a PersistentVolumeClaim that uses the StrageClass defined. Then assign PersistentVolumeClaim to the Pod definition file.
Manually create mounts on the disks for each Pod and declare the mount on the Pod's definition.
Create a PersistentVolume and a PersitentVolumeClaim that will use the PersistentVolume. Assign the PersitentVolumeClaim to the Pod definition file.
For what reason is a headless service used within a StatefulSet.
For PodSpec
For network identity of pods
For specSelector
for volumeClaimTemplates
Which Service Discovery method allows for updating Service Discovery information independent of a Pod's lifecycle?
Environment variables.
PodSpec
DNS
DownloadAPI
What is the name of the container that sets up the networking namespace in a Pod?
Local container
Lifecycle container
Network container
Pause container
How is the CoreDNS configuration file exposed into the Cluster DNS Pod?
PersistentVolume
Rest API Call
ConfigMap
Secret
How do applications running in pods identify themselves to the Kubernetes API Server?
Service Accounts
Via your IAM Service
RBAC Accounts
Pod Accounts
Which Kubernetes API Objects allows you to store sensitive information in the cluster store?
EnvironmentVariables
Secrets
valueFrom
ConfigMaps
What happens if a Secret is unavailable when a Pod starts up?
The Pod will Terminate
The Pod will go Pending
The Pod will start with a default value.
The PodSpec will be rejected by the API Server as invalid.
Which Kubernetes API Object allows you to store more complex configurations and expose them as files in your Pod's file system?
Secrets
ConfigMaps
EnvironmentVariables
ConfigurationVariables
Which Kubernetes Storage API Object represents your actual storage?
PersistentVolume
StorageClass
Volume
PersistentVolumeClaim
What part of the storage lifecycle allows a Persistent Volume to be deleted?
Using
Deleting
Reclaim
Binding
An ingress object in Kubernetes is a collection of rules that define which of the following?
How external client can access the services running on your Kubernetes cluster.
How different nodes on the same Kubernetes cluster can communicate with each other.
How a pod will be used to encapsulate nodes from other nodes.
How Kubernetes clusters can communicate with the outside world.
What does RBAC stand for?
Role Based Accessibility Control
Role Based Access Control
Role Based Authentication Control
Role Based Authorization Control
Which of the following is NOT a mechanism for configuring an ingress controller?
Labels
Annotations
Command line arguments
What is a Persistent Volume?
Cloud-only storage option with a lifecycle independent from a Pod.
Cluster-wide storage unit provisioned by an administrator with a lifecycle independent from a Pod.
A claim for storage that can be used in conjunction with StorageClass.
Cluster-wide storage unit provisioned by an administrator with a lifecycle dependent on a Pod.
What is a Volume Used for in Kubernetes?
To handle managing cluster networking.
To track the size of Pods.
To hold data and state for Pods and containers.
To act as a unit of organization for Pods.
What is an emptyDir Volume?
A network-mounted volume used by a Pod.
A transient data volume associated with the lifetime of a Pod.
A cluster-wide volume used by all Pods.
A cloud-mounted volume used by a Pod.
Which Kubernetes API Object is used to represent an external storage volume within a Kubernetes cluster?
Storage Class (SC)
Persistent Volume Claim (PVC)
Volume
Persistent Volume (PV)
Which Kubernetes storage technology allows external volumes to be provisioned dynamically?
Kubernetes logical volume manager (KLVM)
Persistent Volume (PV)
Dynamic Disks
Storage Class (SC)
What is the name of the plug-in layer used by modern Kubernetes storage plug-ins?
Container Storage Interface (CSI)
Kubernetes Volume Interface (KVI)
Logical Volume Layer (LVL)
Logical Volume Manager (LVM)
Which Kubernetes API Object does a PodSpec need to reference in order to use a persistent volume?
Storage Class Ticket (SCT)
Storage Class Claim (SCC)
Persistent Volume Claim (PVC)
Persistent Volume Ticket (PVT)
Which accessModes does Kubernetes support for access to volumes?
Read-Write-Once (RWO), Read-Write-Many (RWX), Read-Only-Once (ROO), and Read-Only-Many (ROX)
Read-Only-Many (ROX) and Read-Write-Many (RWX)
Read-Write-Once (RWO), Read-Write-Many (RWX), and Read-Only-Many (ROX)
Read-Write-Once (RWO)
Why might it be necessary to deploy a default backend service?
Invalid client requests will otherwise be randomly routed to one of the available backend services.
To provide a coherent, customized experience for clients presenting invalid HTTP requests.
Without a default backend service, ingress definition fall to be configured with applied.
Which of the following in NOT A perceived limitation of using Service object to handle ingress traffic?
Any external TCP/UDP traffic can be proxied to a service's virtual IP address.
Routing of HTTP/S traffic based on hostname or path is not supported.
Client IP addresses are subject to source network address translation (SNAT).
If a service of type NodePort has its externalTrafficPolicy set to Local, what will happen to ingress traffic that arrives at a particular node that isn't running a service endpoint (pod)?
The packets will get routed to an appropriate endpoint, courtesy of Kubernetes flat network model.
The source IP address of packets arriving at the node will be changed (SNAT) to that of the node.
Packets will get dropped, as the policy prohibits routing traffic to an endpoint on another node.
Two separate deployments of the community version of the NGINX ingress controller are deployed to a Kubernetes cluster, one with a default ingress class, and one with an ingress class set to "internal". Given the following ingress definition, which ingress controller services the ingress?
Neither ingress controller due to class mismatches
The ingress controller with the ingress class set to "internal"
The ingress controller with the default ingress class.
What is the primary purpose for annotations in Ingress API definitions?
A method for deafferenting between different ingress controller capabilities.
The primary Kubernetes API mechanism for defining ingress configuration.
A means of circumventing the limitation in the Ingress API.
Why does a service of either type, NodePort or LoadBalancer, result in a clusterIP being allocated for the service?
For backwards compatibility - the kube-proxy in 'userspace' proxy mode requires it, but it is entirely optional when operating in 'iptables' or 'ipvs' mode.
So that external requests can be load balanced across the service's endpoints, via the clusterIP.
Without the clusterIP, a NodePort service with externalTrafficPolicy set to Local, will fail to route traffic to endpoints on other nodes.
