Linux Foundation CKA Certified Kubernetes Administrator (CKA) Program Exam Practice Test

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\6 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\6 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\6 D.JPG

kubectl get po -o=custom-columns="POD_NAME:.metadata.name,

POD_STATUS:.status.containerStatuses[].state"

kubect1 get pods -o=jsonpath='{range

items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

Solution:

#yaml

apiVersion: v1

kind: Pod

metadata:

name: nginx-kusc00401

spec:

containers:

- name: nginx

image: nginx

imagePullPolicy: IfNotPresent

nodeSelector:

disk: spinning

#

kubectl create -f node-select.yaml

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\19 B.JPG

kubectl run busybox --image=busybox -it --rm --restart=Never --

/bin/sh -c 'echo hello world'

kubectl get po # You shouldn't see pod with the name "busybox"

Solution:

F:\Work\Data Entry Work\Data Entry\20200827\CKA\17 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\17 D.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\17 E.JPG

kubectl run nginx --image=nginx --restart=Never --port=80

kubectl create namespace development

kubectl run nginx --image=nginx --restart=Never -n development

Solution:

kubectl run kucc8 --image=nginx --dry-run -o yaml > kucc8.yaml

# vi kucc8.yaml

apiVersion: v1

kind: Pod

metadata:

creationTimestamp: null

name: kucc8

spec:

containers:

- image: nginx

name: nginx

- image: redis

name: redis

- image: memcached

name: memcached

- image: consul

name: consul

#

kubectl create -f kucc8.yaml

#12.07

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\15 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\15 C.JPG

Task Summary

Create an Ingress named echo in the sound-repeater namespace that:

Routes requests to /echo on host example.org

Forwards traffic to service echoserver-service

Uses service port 8080

Verification should return HTTP 200 using curl

✅ Step-by-Step Answer

1️⃣ SSH into the correct node

As shown in the image:

bash

CopyEdit

ssh cka000024

⚠️ Skipping this will result in a ZERO score!

2️⃣ Verify the namespace and service

Ensure the sound-repeater namespace and echoserver-service exist:

kubectl get svc -n sound-repeater

Look for:

echoserver-service ClusterIP ... 8080/TCP

3️⃣ Create the Ingress manifest

Create a YAML file: echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

4️⃣ Apply the Ingress resource

kubectl apply -f echo-ingress.yaml

5️⃣ Test with curl as instructed

Use the exact verification command:

curl -o /dev/null -s -w "%{http_code}\n"

✅ You should see:

200

✅ Final Answer Summary

ssh cka000024

kubectl get svc -n sound-repeater

# Create the Ingress YAML

cat < echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

EOF

kubectl apply -f echo-ingress.yaml

curl -o /dev/null -s -w "%{http_code}\n"

kubectl get po -o=custom-columns="POD_NAME:.metadata.name,

POD_STATUS:.status.containerStatuses[].state"

Task Summary

Connect to host cka000056

Review existing frontend and backend Deployments

Choose one correct NetworkPolicy from the ~/netpol directory

The policy must:

Allow traffic only from the frontend Deployment to the backend Deployment

Avoid being overly permissive

Apply the correct NetworkPolicy without modifying any sample files

Step-by-Step Instructions

Step 1: SSH into the correct node

ssh cka000056

Step 2: Inspect the frontend Deployment

Check the labels used in the frontend Deployment:

kubectl get deployment -n frontend -o yaml

Look under metadata.labels or spec.template.metadata.labels. Note the app or similar label (e.g., app: frontend).

Step 3: Inspect the backend Deployment

kubectl get deployment -n backend -o yaml

Again, find the labels assigned to the pods (e.g., app: backend).

Step 4: List and review the provided NetworkPolicies

List the available files:

ls ~/netpol

Check the contents of each policy file:

cat ~/netpol/.yaml

Look for a policy that:

Has kind: NetworkPolicy

Applies to the backend namespace

Uses a podSelector that matches the backend pods

Includes an ingress.from rule that references the frontend namespace using a namespaceSelector (and optionally a podSelector)

Does not allow traffic from all namespaces or all pods

Here’s what to look for in a good match:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: allow-frontend-to-backend

namespace: backend

spec:

podSelector:

matchLabels:

app: backend

ingress:

- from:

- namespaceSelector:

matchLabels:

name: frontend

Even better if the policy includes:

- namespaceSelector:

matchLabels:

name: frontend

podSelector:

matchLabels:

app: frontend

This limits access to pods in the frontend namespace with a specific label.

Step 5: Apply the correct NetworkPolicy

Once you’ve identified the best match, apply it:

kubectl apply -f ~/netpol/.yaml

Apply only one file. Do not alter or delete any existing sample.

ssh cka000056

kubectl get deployment -n frontend -o yaml

kubectl get deployment -n backend -o yaml

ls ~/netpol

cat ~/netpol/*.yaml # Review carefully

kubectl apply -f ~/netpol/.yaml

Command Summary

ssh cka000056

kubectl get deployment -n frontend -o yaml

kubectl get deployment -n backend -o yaml

ls ~/netpol

cat ~/netpol/*.yaml # Review carefully

kubectl apply -f ~/netpol/.yaml

solution

Persistent Volume

A persistent volume is a piece of storage in a Kubernetes cluster. PersistentVolumes are a cluster-level resource like nodes, which don’t belong to any namespace. It is provisioned by the administrator and has a particular file size. This way, a developer deploying their app on Kubernetes need not know the underlying infrastructure. When the developer needs a certain amount of persistent storage for their application, the system administrator configures the cluster so that they consume the PersistentVolume provisioned in an easy way.

Creating Persistent Volume

kind: PersistentVolume

apiVersion: v1

metadata:

name:app-data

spec:

capacity: # defines the capacity of PV we are creating

storage: 2Gi #the amount of storage we are tying to claim

accessModes: # defines the rights of the volume we are creating

- ReadWriteMany

hostPath:

path: "/srv/app-data" # path to which we are creating the volume

Challenge

Create a Persistent Volume named app-data, with access mode ReadWriteMany, storage classname shared, 2Gi of storage capacity and the host path /srv/app-data.

2. Save the file and create the persistent volume.

Image for post

3. View the persistent volume.

Our persistent volume status is available meaning it is available and it has not been mounted yet. This status will change when we mount the persistentVolume to a persistentVolumeClaim.

PersistentVolumeClaim

In a real ecosystem, a system admin will create the PersistentVolume then a developer will create a PersistentVolumeClaim which will be referenced in a pod. A PersistentVolumeClaim is created by specifying the minimum size and the access mode they require from the persistentVolume.

Challenge

Create a Persistent Volume Claim that requests the Persistent Volume we had created above. The claim should request 2Gi. Ensure that the Persistent Volume Claim has the same storageClassName as the persistentVolume you had previously created.

kind: PersistentVolume

apiVersion: v1

metadata:

name:app-data

spec:

accessModes:

- ReadWriteMany

resources:

requests:

storage: 2Gi

storageClassName: shared

2. Save and create the pvc

njerry191@cloudshell:~ (extreme-clone-2654111)$ kubect1 create -f app-data.yaml

persistentvolumeclaim/app-data created

3. View the pvc

Image for post

4. Let’s see what has changed in the pv we had initially created.

Image for post

Our status has now changed from available to bound.

5. Create a new pod named myapp with image nginx that will be used to Mount the Persistent Volume Claim with the path /var/app/config.

Mounting a Claim

apiVersion: v1

kind: Pod

metadata:

creationTimestamp: null

name: app-data

spec:

volumes:

- name:congigpvc

persistenVolumeClaim:

claimName: app-data

containers:

- image: nginx

name: app

volumeMounts:

- mountPath: "/srv/app-data "

name: configpvc

kubectl get pods -o=jsonpath="{.items[*]['metadata.name',

'metadata.namespace']}"

Solution:

Task should be complete on node k8s -1 master, 2 worker for this connect use command

[student@node-1] > ssh k8s

kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets

kubectl create serviceaccount cicd-token --namespace=app-team1

kubectl create rolebinding deployment-clusterrole --clusterrole=deployment-clusterrole --serviceaccount=default:cicd-token --namespace=app-team1

kubect1 get po nginx-dev -o

jsonpath='{.spec.containers[].image}{"\n"}'

kubectl run nginx --image=nginx --restart=Never --env=var1=value1

# then

kubectl exec -it nginx -- env

# or

kubectl exec -it nginx -- sh -c 'echo $var1'

# or

kubectl describe po nginx | grep value1

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\18 C.JPG

Solution:

#

kubectl get pod big-corp-app -o yaml

#

apiVersion: v1

kind: Pod

metadata:

name: big-corp-app

spec:

containers:

- name: big-corp-app

image: busybox

args:

- /bin/sh

- -c

- >

i=0;

while true;

do

echo "$(date) INFO $i" >> /var/log/big-corp-app.log;

i=$((i+1));

sleep 1;

done

volumeMounts:

- name: logs

mountPath: /var/log

- name: count-log-1

image: busybox

args: [/bin/sh, -c, 'tail -n+1 -f /var/log/big-corp-app.log']

volumeMounts:

- name: logs

mountPath: /var/log

volumes:

- name: logs

emptyDir: {

}

#

kubectl logs big-corp-app -c count-log-1

Task Summary

SSH into cka000054

Install a CNI plugin that supports NetworkPolicies

Two CNI options provided:

Flannel v0.26.1 (❌ does NOT support NetworkPolicies)

Calico v3.28.2 ✅ (does support NetworkPolicies)

❗ Decision Point: Which CNI to choose?

✅ Choose Calico, because only Calico supports enforcing NetworkPolicies natively. Flannel does not.

✅ Step-by-Step Solution

1️⃣ SSH into the correct node

ssh cka000054

⚠️ Required. Skipping this results in zero score.

2️⃣ Install Calico CNI (v3.28.2)

Use the official manifest provided:

kubectl apply -f

This installs the Calico Operator, which then deploys the full Calico CNI stack.

3️⃣ Wait for Calico components to come up

Check the pods in tigera-operator and calico-system namespaces:

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

✅ You should see pods like:

calico-kube-controllers

calico-node

calico-typha

tigera-operator

Wait for all to be in Running state.

✅ (Optional) 4️⃣ Confirm CNI is enforcing NetworkPolicies

You can check:

kubectl get crds | grep networkpolicy

You should see:

networkpolicies.crd.projectcalico.org

This confirms Calico's CRDs are installed for policy enforcement.

Final Command Summary

ssh cka000054

kubectl apply -f

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

kubectl get crds | grep networkpolicy

Task Overview

You're restoring a MariaDB deployment in the mariadb namespace with persistent data.

✅ Tasks:

SSH into cka000047

Create a PVC named mariadb:

Namespace: mariadb

Access mode: ReadWriteOnce

Storage: 250Mi

Use the existing retained PV (there’s only one)

Edit ~/mariadb-deployment.yaml to use the PVC

Apply the deployment

Verify MariaDB is running and stable

Step-by-Step Solution

1️⃣ SSH into the correct host

ssh cka000047

⚠️ Required — skipping = zero score

2️⃣ Inspect the existing PersistentVolume

kubectl get pv

✅ Identify the only existing PV, e.g.:

NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS

mariadb-pv 250Mi RWO Retain Available manual

Ensure the status is Available, and it is not already bound to a claim.

3️⃣ Create the PVC to bind the retained PV

Create a file mariadb-pvc.yaml:

cat < mariadb-pvc.yaml

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: mariadb

namespace: mariadb

spec:

accessModes:

- ReadWriteOnce

resources:

requests:

storage: 250Mi

volumeName: mariadb-pv # Match the PV name exactly

EOF

Apply the PVC:

kubectl apply -f mariadb-pvc.yaml

✅ This binds the PVC to the retained PV.

4️⃣ Edit the MariaDB Deployment YAML

Open the file:

nano ~/mariadb-deployment.yaml

Look under the spec.template.spec.containers.volumeMounts and spec.template.spec.volumes sections and update them like so:

Add this under the container:

yaml

CopyEdit

volumeMounts:

- name: mariadb-storage

mountPath: /var/lib/mysql

And under the pod spec:

volumes:

- name: mariadb-storage

persistentVolumeClaim:

claimName: mariadb

✅ These lines mount the PVC at the MariaDB data directory.

5️⃣ Apply the updated Deployment

kubectl apply -f ~/mariadb-deployment.yaml

6️⃣ Verify the Deployment is running and stable

kubectl get pods -n mariadb

kubectl describe pod -n mariadb

✅ Ensure the pod is in Running state and volume is mounted.

???? Final Command Summary

ssh cka000047

kubectl get pv # Find the retained PV

# Create PVC

cat < mariadb-pvc.yaml

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: mariadb

namespace: mariadb

spec:

accessModes:

- ReadWriteOnce

resources:

requests:

storage: 250Mi

volumeName: mariadb-pv

EOF

kubectl apply -f mariadb-pvc.yaml

# Edit Deployment

nano ~/mariadb-deployment.yaml

# Add volumeMount and volume to use the PVC as described

kubectl apply -f ~/mariadb-deployment.yaml

kubectl get pods -n mariadb

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 D.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 E.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 F.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 G.JPG