最新的Linux Foundation Certified Kubernetes Administrator (CKA) Program - CKA免費考試真題
問題1
Task
Create a new Ingress resource as follows:
. Name: echo
. Namespace : sound-repeater
. Exposing Service echoserver-service on
http://example.org/echo
using Service port 8080
The availability of Service
echoserver-service can be checked
i
using the following command, which should return 200 :
[candidate@cka000024] $ curl -o /de v/null -s -w "%{http_code}\n"
http://example.org/echo
正確答案:
Task Summary
Create an Ingress named echo in the sound-repeater namespace that:
* Routes requests to /echo on host example.org
* Forwards traffic to service echoserver-service
* Uses service port 8080
* Verification should return HTTP 200 using curl
# Step-by-Step Answer
1## SSH into the correct node
As shown in the image:
bash
CopyEdit
ssh cka000024
## Skipping this will result in a ZERO score!
2## Verify the namespace and service
Ensure the sound-repeater namespace and echoserver-service exist:
kubectl get svc -n sound-repeater
Look for:
echoserver-service ClusterIP ... 8080/TCP
3## Create the Ingress manifest
Create a YAML file: echo-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: echo
namespace: sound-repeater
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
rules:
- host: example.org
http:
paths:
- path: /echo
pathType: Prefix
backend:
service:
name: echoserver-service
port:
number: 8080
4## Apply the Ingress resource
kubectl apply -f echo-ingress.yaml
5## Test with curl as instructed
Use the exact verification command:
curl -o /dev/null -s -w "%{http_code}\n"
http://example.org/echo
# You should see:
200
# Final Answer Summary
ssh cka000024
kubectl get svc -n sound-repeater
# Create the Ingress YAML
cat <<EOF > echo-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: echo
namespace: sound-repeater
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
rules:
- host: example.org
http:
paths:
- path: /echo
pathType: Prefix
backend:
service:
name: echoserver-service
port:
number: 8080
EOF
kubectl apply -f echo-ingress.yaml
curl -o /dev/null -s -w "%{http_code}\n"
http://example.org/echo
Create an Ingress named echo in the sound-repeater namespace that:
* Routes requests to /echo on host example.org
* Forwards traffic to service echoserver-service
* Uses service port 8080
* Verification should return HTTP 200 using curl
# Step-by-Step Answer
1## SSH into the correct node
As shown in the image:
bash
CopyEdit
ssh cka000024
## Skipping this will result in a ZERO score!
2## Verify the namespace and service
Ensure the sound-repeater namespace and echoserver-service exist:
kubectl get svc -n sound-repeater
Look for:
echoserver-service ClusterIP ... 8080/TCP
3## Create the Ingress manifest
Create a YAML file: echo-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: echo
namespace: sound-repeater
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
rules:
- host: example.org
http:
paths:
- path: /echo
pathType: Prefix
backend:
service:
name: echoserver-service
port:
number: 8080
4## Apply the Ingress resource
kubectl apply -f echo-ingress.yaml
5## Test with curl as instructed
Use the exact verification command:
curl -o /dev/null -s -w "%{http_code}\n"
http://example.org/echo
# You should see:
200
# Final Answer Summary
ssh cka000024
kubectl get svc -n sound-repeater
# Create the Ingress YAML
cat <<EOF > echo-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: echo
namespace: sound-repeater
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
rules:
- host: example.org
http:
paths:
- path: /echo
pathType: Prefix
backend:
service:
name: echoserver-service
port:
number: 8080
EOF
kubectl apply -f echo-ingress.yaml
curl -o /dev/null -s -w "%{http_code}\n"
http://example.org/echo
問題2
Create a busybox pod that runs the command "env" and save the output to "envpod" file See the solution below.
正確答案:
kubectl run busybox --image=busybox --restart=Never --rm -it -- env > envpod.yaml
問題3
You must connect to the correct host.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000056
Task
Review and apply the appropriate NetworkPolicy from the provided YAML samples.
Ensure that the chosen NetworkPolicy is not overly permissive, but allows communication between the frontend and backend Deployments, which run in the frontend and backend namespaces respectively.
First, analyze the frontend and backend Deployments to determine the specific requirements for the NetworkPolicy that needs to be applied.
Next, examine the NetworkPolicy YAML samples located in the ~/netpol folder.
Failure to comply may result in a reduced score.
Do not delete or modify the provided samples. Only apply one of them.
Finally, apply the NetworkPolicy that enables communication between the frontend and backend Deployments, without being overly permissive.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000056
Task
Review and apply the appropriate NetworkPolicy from the provided YAML samples.
Ensure that the chosen NetworkPolicy is not overly permissive, but allows communication between the frontend and backend Deployments, which run in the frontend and backend namespaces respectively.
First, analyze the frontend and backend Deployments to determine the specific requirements for the NetworkPolicy that needs to be applied.
Next, examine the NetworkPolicy YAML samples located in the ~/netpol folder.
Failure to comply may result in a reduced score.
Do not delete or modify the provided samples. Only apply one of them.
Finally, apply the NetworkPolicy that enables communication between the frontend and backend Deployments, without being overly permissive.
正確答案:
Task Summary
* Connect to host cka000056
* Review existing frontend and backend Deployments
* Choose one correct NetworkPolicy from the ~/netpol directory
* The policy must:
* Allow traffic only from the frontend Deployment to the backend Deployment
* Avoid being overly permissive
* Apply the correct NetworkPolicy without modifying any sample files
Step-by-Step Instructions
Step 1: SSH into the correct node
ssh cka000056
Step 2: Inspect the frontend Deployment
Check the labels used in the frontend Deployment:
kubectl get deployment -n frontend -o yaml
Look under metadata.labels or spec.template.metadata.labels. Note the app or similar label (e.g., app:
frontend).
Step 3: Inspect the backend Deployment
kubectl get deployment -n backend -o yaml
Again, find the labels assigned to the pods (e.g., app: backend).
Step 4: List and review the provided NetworkPolicies
List the available files:
ls ~/netpol
Check the contents of each policy file:
cat ~/netpol/<file-name>.yaml
Look for a policy that:
* Has kind: NetworkPolicy
* Applies to the backend namespace
* Uses a podSelector that matches the backend pods
* Includes an ingress.from rule that references the frontend namespace using a namespaceSelector (and optionally a podSelector)
* Does not allow traffic from all namespaces or all pods
Here's what to look for in a good match:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-backend
namespace: backend
spec:
podSelector:
matchLabels:
app: backend
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
Even better if the policy includes:
- namespaceSelector:
matchLabels:
name: frontend
podSelector:
matchLabels:
app: frontend
This limits access to pods in the frontend namespace with a specific label.
Step 5: Apply the correct NetworkPolicy
Once you've identified the best match, apply it:
kubectl apply -f ~/netpol/<chosen-file>.yaml
Apply only one file. Do not alter or delete any existing sample.
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml
Command Summary
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml
* Connect to host cka000056
* Review existing frontend and backend Deployments
* Choose one correct NetworkPolicy from the ~/netpol directory
* The policy must:
* Allow traffic only from the frontend Deployment to the backend Deployment
* Avoid being overly permissive
* Apply the correct NetworkPolicy without modifying any sample files
Step-by-Step Instructions
Step 1: SSH into the correct node
ssh cka000056
Step 2: Inspect the frontend Deployment
Check the labels used in the frontend Deployment:
kubectl get deployment -n frontend -o yaml
Look under metadata.labels or spec.template.metadata.labels. Note the app or similar label (e.g., app:
frontend).
Step 3: Inspect the backend Deployment
kubectl get deployment -n backend -o yaml
Again, find the labels assigned to the pods (e.g., app: backend).
Step 4: List and review the provided NetworkPolicies
List the available files:
ls ~/netpol
Check the contents of each policy file:
cat ~/netpol/<file-name>.yaml
Look for a policy that:
* Has kind: NetworkPolicy
* Applies to the backend namespace
* Uses a podSelector that matches the backend pods
* Includes an ingress.from rule that references the frontend namespace using a namespaceSelector (and optionally a podSelector)
* Does not allow traffic from all namespaces or all pods
Here's what to look for in a good match:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-backend
namespace: backend
spec:
podSelector:
matchLabels:
app: backend
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
Even better if the policy includes:
- namespaceSelector:
matchLabels:
name: frontend
podSelector:
matchLabels:
app: frontend
This limits access to pods in the frontend namespace with a specific label.
Step 5: Apply the correct NetworkPolicy
Once you've identified the best match, apply it:
kubectl apply -f ~/netpol/<chosen-file>.yaml
Apply only one file. Do not alter or delete any existing sample.
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml
Command Summary
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml
問題4
List "nginx-dev" and "nginx-prod" pod and delete those pods
正確答案:
kubect1 get pods -o wide
kubectl delete po "nginx-dev"
kubectl delete po "nginx-prod"
kubectl delete po "nginx-dev"
kubectl delete po "nginx-prod"
問題5
You must connect to the correct host.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000049
Task
Perform the following tasks:
Create a new PriorityClass named high-priority for user-workloads with a value that is one less than the highest existing user-defined priority class value.
Patch the existing Deployment busybox-logger running in the priority namespace to use the high-priority priority class.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000049
Task
Perform the following tasks:
Create a new PriorityClass named high-priority for user-workloads with a value that is one less than the highest existing user-defined priority class value.
Patch the existing Deployment busybox-logger running in the priority namespace to use the high-priority priority class.
正確答案:
Task Summary
* SSH into the correct node: cka000049
* Find the highest existing user-defined PriorityClass
* Create a new PriorityClass high-priority with a value one less
* Patch Deployment busybox-logger (in namespace priority) to use this new PriorityClass Step-by-Step Solution
1## SSH into the correct node
bash
CopyEdit
ssh cka000049
## Skipping this = zero score
2## Find the highest existing user-defined PriorityClass
Run:
bash
CopyEdit
kubectl get priorityclasses.scheduling.k8s.io
Example output:
vbnet
CopyEdit
NAME VALUE GLOBALDEFAULT AGE
default-low 1000 false 10d
mid-tier 2000 false 7d
critical-pods 1000000 true 30d
Exclude system-defined classes like system-* and the default global one (e.g., critical-pods).
Let's assume the highest user-defined value is 2000.
So your new class should be:
* Value = 1999
3## Create the high-priority PriorityClass
Create a file called high-priority.yaml:
cat <<EOF > high-priority.yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: high-priority
value: 1999
globalDefault: false
description: "High priority class for user workloads"
EOF
Apply it:
kubectl apply -f high-priority.yaml
4## Patch the busybox-logger deployment
Now patch the existing Deployment in the priority namespace:
kubectl patch deployment busybox-logger -n priority \
--type='merge' \
-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'
5## Verify your work
Confirm the patch was applied:
kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}'
# You should see:
high-priority
Also, confirm the class exists:
kubectl get priorityclass high-priority
Final Command Summary
ssh cka000049
kubectl get priorityclass
# Create the new PriorityClass
cat <<EOF > high-priority.yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: high-priority
value: 1999
globalDefault: false
description: "High priority class for user workloads"
EOF
kubectl apply -f high-priority.yaml
# Patch the deployment
kubectl patch deployment busybox-logger -n priority \
--type='merge' \
-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'
# Verify
kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}' kubectl get priorityclass high-priority
* SSH into the correct node: cka000049
* Find the highest existing user-defined PriorityClass
* Create a new PriorityClass high-priority with a value one less
* Patch Deployment busybox-logger (in namespace priority) to use this new PriorityClass Step-by-Step Solution
1## SSH into the correct node
bash
CopyEdit
ssh cka000049
## Skipping this = zero score
2## Find the highest existing user-defined PriorityClass
Run:
bash
CopyEdit
kubectl get priorityclasses.scheduling.k8s.io
Example output:
vbnet
CopyEdit
NAME VALUE GLOBALDEFAULT AGE
default-low 1000 false 10d
mid-tier 2000 false 7d
critical-pods 1000000 true 30d
Exclude system-defined classes like system-* and the default global one (e.g., critical-pods).
Let's assume the highest user-defined value is 2000.
So your new class should be:
* Value = 1999
3## Create the high-priority PriorityClass
Create a file called high-priority.yaml:
cat <<EOF > high-priority.yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: high-priority
value: 1999
globalDefault: false
description: "High priority class for user workloads"
EOF
Apply it:
kubectl apply -f high-priority.yaml
4## Patch the busybox-logger deployment
Now patch the existing Deployment in the priority namespace:
kubectl patch deployment busybox-logger -n priority \
--type='merge' \
-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'
5## Verify your work
Confirm the patch was applied:
kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}'
# You should see:
high-priority
Also, confirm the class exists:
kubectl get priorityclass high-priority
Final Command Summary
ssh cka000049
kubectl get priorityclass
# Create the new PriorityClass
cat <<EOF > high-priority.yaml
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: high-priority
value: 1999
globalDefault: false
description: "High priority class for user workloads"
EOF
kubectl apply -f high-priority.yaml
# Patch the deployment
kubectl patch deployment busybox-logger -n priority \
--type='merge' \
-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'
# Verify
kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}' kubectl get priorityclass high-priority
問題6
You must connect to the correct host.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000059
Context
A kubeadm provisioned cluster was migrated to a new machine. It needs configuration changes to run successfully.
Task
Fix a single-node cluster that got broken during machine migration.
First, identify the broken cluster components and investigate what breaks them.
The decommissioned cluster used an external etcd server.
Next, fix the configuration of all broken cluster
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000059
Context
A kubeadm provisioned cluster was migrated to a new machine. It needs configuration changes to run successfully.
Task
Fix a single-node cluster that got broken during machine migration.
First, identify the broken cluster components and investigate what breaks them.
The decommissioned cluster used an external etcd server.
Next, fix the configuration of all broken cluster
正確答案:
Task Summary
* SSH into node: cka000059
* Cluster was migrated to a new machine
* It uses an external etcd server
* Identify and fix misconfigured components
* Bring the cluster back to a healthy state
Step-by-Step Solution
Step 1: SSH into the correct host
ssh cka000059
Step 2: Check the cluster status
Run:
kubectl get nodes
If it fails, the kubelet or kube-apiserver is likely broken.
Check kubelet status:
sudo systemctl status kubelet
Also, check pod statuses in the control plane:
sudo crictl ps -a | grep kube
or:
docker ps -a | grep kube
Look especially for failures in kube-apiserver or kube-controller-manager.
Step 3: Inspect the kube-apiserver manifest
Since this is a kubeadm-based cluster, manifests are in:
ls /etc/kubernetes/manifests
Open kube-apiserver.yaml:
bash
CopyEdit
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
Look for the --etcd-servers= flag. If the external etcd endpoint has changed (likely, due to migration), this needs to be fixed.
Example of incorrect configuration:
--etcd-servers=https://192.168.1.100:2379
If the IP has changed, update it to the correct IP or hostname of the external etcd server.
Also ensure the correct client certificate and key paths are still valid:
--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
If the files are missing or the path is wrong due to migration, correct those as well.
Step 4: Save and exit, and let static pod restart
Static pod changes will be picked up automatically by the kubelet (watch for /etc/kubernetes/manifests changes).
Check again:
docker ps | grep kube-apiserver
# or
crictl ps | grep kube-apiserver
Step 5: Confirm API is healthy
Once kube-apiserver is up, try:
kubectl get componentstatuses
kubectl get nodes
If these commands work and return valid statuses, the control plane is functional again.
Step 6: Check controller-manager and scheduler (optional)
If still broken, check the other static pods in /etc/kubernetes/manifests/ and correct paths if necessary.
Also verify that /etc/kubernetes/kubelet.conf and /etc/kubernetes/admin.conf are present and valid.
Command Summary
ssh cka000059
# Check system and kubelet
sudo systemctl status kubelet
docker ps -a | grep kube # or crictl ps -a | grep kube
# Check manifests
ls /etc/kubernetes/manifests
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
# Fix --etcd-servers and certificate paths if needed
# Watch pods restart and confirm:
kubectl get nodes
kubectl get componentstatuses
* SSH into node: cka000059
* Cluster was migrated to a new machine
* It uses an external etcd server
* Identify and fix misconfigured components
* Bring the cluster back to a healthy state
Step-by-Step Solution
Step 1: SSH into the correct host
ssh cka000059
Step 2: Check the cluster status
Run:
kubectl get nodes
If it fails, the kubelet or kube-apiserver is likely broken.
Check kubelet status:
sudo systemctl status kubelet
Also, check pod statuses in the control plane:
sudo crictl ps -a | grep kube
or:
docker ps -a | grep kube
Look especially for failures in kube-apiserver or kube-controller-manager.
Step 3: Inspect the kube-apiserver manifest
Since this is a kubeadm-based cluster, manifests are in:
ls /etc/kubernetes/manifests
Open kube-apiserver.yaml:
bash
CopyEdit
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
Look for the --etcd-servers= flag. If the external etcd endpoint has changed (likely, due to migration), this needs to be fixed.
Example of incorrect configuration:
--etcd-servers=https://192.168.1.100:2379
If the IP has changed, update it to the correct IP or hostname of the external etcd server.
Also ensure the correct client certificate and key paths are still valid:
--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
If the files are missing or the path is wrong due to migration, correct those as well.
Step 4: Save and exit, and let static pod restart
Static pod changes will be picked up automatically by the kubelet (watch for /etc/kubernetes/manifests changes).
Check again:
docker ps | grep kube-apiserver
# or
crictl ps | grep kube-apiserver
Step 5: Confirm API is healthy
Once kube-apiserver is up, try:
kubectl get componentstatuses
kubectl get nodes
If these commands work and return valid statuses, the control plane is functional again.
Step 6: Check controller-manager and scheduler (optional)
If still broken, check the other static pods in /etc/kubernetes/manifests/ and correct paths if necessary.
Also verify that /etc/kubernetes/kubelet.conf and /etc/kubernetes/admin.conf are present and valid.
Command Summary
ssh cka000059
# Check system and kubelet
sudo systemctl status kubelet
docker ps -a | grep kube # or crictl ps -a | grep kube
# Check manifests
ls /etc/kubernetes/manifests
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
# Fix --etcd-servers and certificate paths if needed
# Watch pods restart and confirm:
kubectl get nodes
kubectl get componentstatuses
問題7
List all the pods showing name and namespace with a json path expression See the solution below.
正確答案:
kubectl get pods -o=jsonpath="{.items[*]['metadata.name',
'metadata.namespace']}"
'metadata.namespace']}"
問題8
Create 2 nginx image pods in which one of them is labelled with env=prod and another one labelled with env=dev and verify the same.
正確答案:
kubectl run --generator=run-pod/v1 --image=nginx -- labels=env=prod nginx-prod --dry-run -o yaml > nginx- prodpod.yaml Now, edit nginx-prod-pod.yaml file and remove entries like "creationTimestamp: null"
"dnsPolicy: ClusterFirst"
vim nginx-prod-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: prod
name: nginx-prod
spec:
containers:
- image: nginx
name: nginx-prod
restartPolicy: Always
# kubectl create -f nginx-prod-pod.yaml
kubectl run --generator=run-pod/v1 --image=nginx --
labels=env=dev nginx-dev --dry-run -o yaml > nginx-dev-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: dev
name: nginx-dev
spec:
containers:
- image: nginx
name: nginx-dev
restartPolicy: Always
# kubectl create -f nginx-prod-dev.yaml
Verify :
kubectl get po --show-labels
kubectl get po -l env=prod
kubectl get po -l env=dev
"dnsPolicy: ClusterFirst"
vim nginx-prod-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: prod
name: nginx-prod
spec:
containers:
- image: nginx
name: nginx-prod
restartPolicy: Always
# kubectl create -f nginx-prod-pod.yaml
kubectl run --generator=run-pod/v1 --image=nginx --
labels=env=dev nginx-dev --dry-run -o yaml > nginx-dev-pod.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
env: dev
name: nginx-dev
spec:
containers:
- image: nginx
name: nginx-dev
restartPolicy: Always
# kubectl create -f nginx-prod-dev.yaml
Verify :
kubectl get po --show-labels
kubectl get po -l env=prod
kubectl get po -l env=dev
問題9
Create a pod as follows:
* Name: mongo
* Using Image: mongo
* In a new Kubernetes namespace named: my-website
* Name: mongo
* Using Image: mongo
* In a new Kubernetes namespace named: my-website
正確答案:
