Kubernetes & Container Orchestration (CKA Exam Prep) Flashcards

Question 1

What are the essential troubleshooting commands for debugging a failing Pod?

Accepted Answer

- **View state and events**: `kubectl describe pod ` - **Inspect stdout/stderr**: `kubectl logs -c --previous` - **Execute shell inside running container**: `kubectl exec -it -- /bin/sh`

Question 2

What is a Kubernetes Pod?

Accepted Answer

A Pod is the smallest deployable computing unit in Kubernetes. It represents a single instance of a running process in your cluster and can contain one or more co-located, co-managed containers that share storage resources, a single network IP, and port space.

Question 3

What is the standard YAML manifest structure for a Deployment?

Accepted Answer

A Deployment manages a set of identical Pods via a ReplicaSet.
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.21
        ports:
        - containerPort: 80
```

Question 4

How do you imperatively create a Deployment and generate its YAML without applying it?

Accepted Answer

Use `kubectl create` with the `--dry-run=client` and `-o yaml` flags:
`kubectl create deployment nginx-deploy --image=nginx:1.21 --replicas=3 --dry-run=client -o yaml > deployment.yaml`

Question 5

What are the key differences between ClusterIP, NodePort, and LoadBalancer Services?

Accepted Answer

- **ClusterIP**: Exposes the Service on an internal IP within the cluster (default). Accessible only inside the cluster.
- **NodePort**: Exposes the Service on each Node's IP at a static port (range: `30000-32767`). Accessible externally.
- **LoadBalancer**: Exposes the Service externally using a cloud provider's native load balancer, automatically routing traffic to underlying `NodePort` and `ClusterIP` targets.

Question 6

What is the YAML structure for a NodePort Service?

Accepted Answer

A Service routes network traffic to Pods matching its label selector.
```yaml
apiVersion: v1
kind: Service
metadata:
  name: my-nodeport-service
spec:
  type: NodePort
  selector:
    app: nginx
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30080
```

Question 7

How do you imperatively expose an existing Deployment as a Service?

Accepted Answer

Use the `kubectl expose` command:
`kubectl expose deployment nginx-deploy --name=nginx-service --type=NodePort --port=80 --target-port=80`

Question 8

What is an Ingress Controller and how does an Ingress resource work?

Accepted Answer

An **Ingress Controller** (e.g., NGINX, Traefik) is an edge proxy daemon that implements rules defined in **Ingress** resources. The Ingress resource provides HTTP/HTTPS routing rules to exposed services based on hostnames or URL paths without creating multiple external LoadBalancers.

Question 9

What is the relationship between PersistentVolumes (PV) and PersistentVolumeClaims (PVC)?

Accepted Answer

- **PersistentVolume (PV)**: A cluster-wide storage resource provisioned manually by an admin or dynamically via a `StorageClass`.
- **PersistentVolumeClaim (PVC)**: A request for storage by a user/Pod. Kubernetes binds a PVC to a matching PV based on storage size, access modes (`ReadWriteOnce`, `ReadOnlyMany`, `ReadWriteMany`), and storage class.

Question 10

What is the YAML manifest structure for a PersistentVolumeClaim (PVC)?

Accepted Answer

```yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi
```

Question 11

What are the core components of Kubernetes RBAC?

Accepted Answer

1. **Role / ClusterRole**: Defines allowed actions (`verbs`: get, list, create) on specific API resources (`pods`, `services`). `Role` is namespaced; `ClusterRole` is cluster-wide.
2. **RoleBinding / ClusterRoleBinding**: Grants the permissions defined in a Role or ClusterRole to subjects (`Users`, `Groups`, `ServiceAccounts`).

Question 12

How do you create a ServiceAccount and bind a ClusterRole to it imperatively?

Accepted Answer

1. Create ServiceAccount:
`kubectl create serviceaccount build-sa`
2. Create ClusterRoleBinding:
`kubectl create clusterrolebinding build-sa-binding --clusterrole=admin --serviceaccount=default:build-sa`

Question 13

How can you test if a specific ServiceAccount has permissions to run a command?

Accepted Answer

Use the `kubectl auth can-i` command with the `--as` flag:
`kubectl auth can-i create pods --as=system:serviceaccount:default:build-sa`

Question 14

What is a DaemonSet and what are its typical use cases?

Accepted Answer

A **DaemonSet** guarantees that all (or specified) Nodes run a single copy of a Pod. When new nodes are added to the cluster, Pods are automatically spawned on them. Common use cases include cluster log collection (`fluentd`), node monitoring agents (`prometheus-node-exporter`), and network plugins (`calico`).

Question 15

How does a StatefulSet differ from a standard Deployment?

Accepted Answer

Unlike Deployments (where Pods are interchangeable and stateless), a **StatefulSet** maintains a sticky identity for each Pod with unique, ordinal indices (e.g., `web-0`, `web-1`). It provides persistent storage identities, ordered deployment/scaling, and automated stable network IDs.

Question 16

How do you perform a rolling update and rollback of a Deployment via CLI?

Accepted Answer

- **Update image**:
`kubectl set image deployment/nginx-deploy nginx=nginx:1.22.0`
- **Check rollout status**:
`kubectl rollout status deployment/nginx-deploy`
- **Undo rollout (rollback)**:
`kubectl rollout undo deployment/nginx-deploy`

Question 17

What commands are required to drain a node safely for maintenance?

Accepted Answer

1. Cordon node (mark unschedulable):
`kubectl cordon node-1`
2. Evict running Pods:
`kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data`
3. After maintenance, uncordon:
`kubectl uncordon node-1`

Question 18

How do you create an etcd snapshot backup and check its status?

Accepted Answer

Use `etcdctl` with API version 3:
`ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /tmp/etcd-backup.db`

Question 19

What is the difference between Liveness Probes, Readiness Probes, and Startup Probes?

Accepted Answer

- **Liveness Probe**: Determines if the container needs to be restarted. If it fails, Kubelet kills the container and triggers its restart policy.
- **Readiness Probe**: Determines if the container is ready to service network requests. If it fails, the container's IP is removed from Endpoints.
- **Startup Probe**: Disables Liveness and Readiness probes until the application completes initialization.

Question 20

What is a NetworkPolicy and what traffic does it restrict by default?

Accepted Answer

A **NetworkPolicy** enforces network isolation rules at OSI layers 3 and 4 using label selectors. By default, Kubernetes networking is non-isolated (all Pods can talk to all Pods). Applying a NetworkPolicy isolates targeted Pods, blocking unlisted ingress/egress traffic.

Kubernetes & Container Orchestration (CKA Exam Prep)

Cards in this deck

Related Flashcard Sets

Kubernetes & Orchestration Essentials (CKA Prep)

HSK 1 - Basic Chinese Vocabulary, Pinyin & Character Recognition

Functional Programming - Immutability, Pure Functions & Higher-Order Functions

Neuroscience - Neuroanatomy & Brain Function