Kubernetes & Container Orchestration (CKA Fundamentals) Flashcards

Question 1

Kubernetes Pod Lifecycle Phases

Accepted Answer

A Pod progresses through 5 primary phases:
- `Pending`: Accepted by the cluster, but images are downloading or scheduling is in progress.
- `Running`: Bound to a node and all containers are created; at least one is actively running.
- `Succeeded`: All containers terminated successfully with exit code 0.
- `Failed`: All containers have terminated, and at least one failed (non-zero exit code).
- `Unknown`: State cannot be determined by the control plane.

Question 2

Imperative Deployment Creation (`kubectl`)

Accepted Answer

To quickly create a Deployment named `nginx-deploy` imperatively:
```bash
kubelet create deployment nginx-deploy --image=nginx:1.21 --replicas=3
```

Question 3

Dry-Run YAML Generation Pattern

Accepted Answer

Generate resource YAML manifests without applying them to the cluster:
```bash
kubelet run my-pod --image=nginx --dry-run=client -o yaml > pod.yaml
```
Works with deployments, services, roles, and other API resources.

Question 4

Kubernetes Cluster Networking Model Rules

Accepted Answer

The basic network model mandates three fundamental rules:
1. All Pods can communicate with all other Pods across nodes without Network Address Translation (NAT).
2. All agents on a node (e.g., `kubelet`) can communicate with all Pods on that node.
3. Every Pod gets its own unique, fully routable IP address within the cluster network.

Question 5

Service Types: ClusterIP vs NodePort vs LoadBalancer

Accepted Answer

- `ClusterIP`: (Default) Exposes the Service on an internal cluster-only IP address.
- `NodePort`: Exposes the Service on each Node's IP at a static port (range 30000–32767).
- `LoadBalancer`: Provisions an external cloud load balancer (e.g., AWS ELB, GCP LB) and assigns a public IP to route to `NodePort` endpoints.

Question 6

Persistent Volume (PV) vs Persistent Volume Claim (PVC)

Accepted Answer

- `PersistentVolume (PV)`: A storage resource provisioned by an administrator or dynamically via StorageClasses.
- `PersistentVolumeClaim (PVC)`: A request for storage by a user or workload specifying size, access modes, and optional StorageClass.

Question 7

Persistent Volume Access Modes

Accepted Answer

- `ReadWriteOnce` (`RWO`): Mounted as read-write by a single node.
- `ReadOnlyMany` (`ROX`): Mounted as read-only by many nodes.
- `ReadWriteMany` (`RWX`): Mounted as read-write by many nodes.
- `ReadWriteOncePod` (`RWOP`): Mounted as read-write by a single Pod across the entire cluster.

Question 8

RBAC: Role vs ClusterRole

Accepted Answer

- `Role`: Defines API permissions (verbs like `get`, `list`, `create`) scoped strictly within a specific **namespace**.
- `ClusterRole`: Defines permissions across the entire cluster, or for non-namespaced resources (e.g., `Nodes`, `PersistentVolumes`, `/healthz`).

Question 9

RBAC: RoleBinding vs ClusterRoleBinding

Accepted Answer

- `RoleBinding`: Grants defined permissions to subjects (Users, Groups, ServiceAccounts) within a specific **namespace**.
- `ClusterRoleBinding`: Grants permissions cluster-wide across all namespaces to subjects.

Question 10

Ingress Resource vs Ingress Controller

Accepted Answer

- **Ingress Resource**: API object containing HTTP/HTTPS routing rules, paths, hostnames, and TLS secret references.
- **Ingress Controller**: The underlying daemon (e.g., NGINX, Traefik) that monitors Ingress resources and manages incoming proxy traffic.

Question 11

StatefulSet vs Deployment

Accepted Answer

- `Deployment`: Manages stateless pods; Pods have random names, interchangeable identities, and no order during startup or shutdown.
- `StatefulSet`: Manages stateful applications; Pods receive unique, stable network identifiers (`app-0`, `app-1`), persistent storage bindings via `volumeClaimTemplates`, and ordered deployment/scaling.

Question 12

Headless Service

Accepted Answer

A Service explicitly defined with `clusterIP: None` in its specification. It skips proxying and load balancing, allowing DNS queries for the service domain to directly resolve to individual Pod IP addresses. Frequently used with `StatefulSets`.

Question 13

Container Health Probes (Liveness, Readiness, Startup)

Accepted Answer

- `Liveness Probe`: Determines if a container needs to be restarted due to deadlock or failure.
- `Readiness Probe`: Determines if a container is ready to accept traffic. If failed, the Pod IP is removed from Service endpoints.
- `Startup Probe`: Disables liveness and readiness checks until the application finishes slow startup routines.

Question 14

Essential Pod Debugging Commands (`kubectl`)

Accepted Answer

1. Inspect status and events: `kubectl describe pod ` 2. Stream container logs: `kubectl logs -f -c ` 3. Open interactive shell: `kubectl exec -it -- /bin/sh`

Question 15

Static Pods

Accepted Answer

Pods managed directly by the `kubelet` daemon on a specific node, without control plane supervision via `kube-apiserver`. Manifests are stored locally, typically in `/etc/kubernetes/manifests/`. Control plane components (e.g., `kube-apiserver`, `etcd`) are commonly deployed as Static Pods.

Question 16

Control Plane: Kubelet vs Kube-Proxy

Accepted Answer

- `kubelet`: Primary node agent running on every node that communicates with `kube-apiserver` and manages container runtimes to maintain target container state.
- `kube-proxy`: Network agent running on each node that maintains network rules (`iptables` or `IPVS`) to handle traffic routing for Services.

Question 17

ETCD Snapshot Backup Syntax

Accepted Answer

Save a snapshot of the cluster state using `etcdctl` v3 API: ```bash ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \ --cacert= --cert= --key= \ snapshot save /tmp/etcd-backup.db ```

Question 18

Top-Level Fields of a Kubernetes Manifest Specification

Accepted Answer

Every valid Kubernetes YAML manifest requires four root fields:
- `apiVersion`: API group and version (e.g., `v1`, `apps/v1`).
- `kind`: Resource type (e.g., `Pod`, `Service`, `Deployment`).
- `metadata`: Identifying information (`name`, `namespace`, `labels`).
- `spec`: Desired operational state specification.

Question 19

DaemonSet

Accepted Answer

A workload object that ensures a single copy of a specified Pod runs on all (or selected) Nodes in the cluster. Automatically adds Pods to newly provisioned nodes. Common use cases include log collectors (`Fluentd`) and monitoring agents (`Prometheus Node Exporter`).

Question 20

Taints and Tolerations

Accepted Answer

- **Taint**: Applied to a **Node** to repel Pods that do not match the key-value-effect configuration.
- **Toleration**: Applied to a **Pod** in its `spec` to allow (but not force) scheduling onto nodes with matching taints.

Kubernetes & Container Orchestration (CKA Fundamentals)

Cards in this deck

Related Flashcard Sets

TypeScript - Advanced Type Systems, Generics & Design Patterns

Harvard ECON1011 - Intermediate Microeconomics: Game Theory & Market Structures

MIT 18.03 - Differential Equations: Ordinary Differential Equations, Laplace & Fourier

CPA Exam FAR - Financial Accounting & Reporting: US GAAP & Revenue Recognition