CKA Certified Kubernetes Administrator (CKA) Program Question and Answers

Task Summary

Create an HPA named apache-server in the autoscale namespace.

Target an existing deployment also named apache-server.

CPU target: 50%

Pod range: min 1, max 4

Downscale stabilization window: 30 seconds

Step-by-Step Answer

🔑 Step 1: Connect to the correct host

This is critical, as shown in the warning image.

ssh cka000050

🔔 Skipping this may result in zero for this question!

📦 Step 2: Verify the deployment exists

kubectl get deployment apache-server -n autoscale

Make sure it’s there before creating the HPA. If it’s missing, the HPA won't bind correctly.

⚙️ Step 3: Create the HPA

We will use the kubectl autoscale command for a quick setup, then patch it to add the stabilization window (since kubectl autoscale doesn't include it).

kubectl autoscale deployment apache-server \

--namespace autoscale \

--cpu-percent=50 \

--min=1 \

--max=4

🔧 Step 4: Add the downscale stabilization window

You’ll need to patch the HPA to include the stabilization window of 30s.

Create a patch file called hpa-patch.yaml:

spec:

behavior:

scaleDown:

stabilizationWindowSeconds: 30

Apply the patch:

bash

CopyEdit

kubectl patch hpa apache-server \

-n autoscale \

--patch "$(cat hpa-patch.yaml)"

✅ Step 5: Confirm your work

bash

CopyEdit

kubectl describe hpa apache-server -n autoscale

Look for:

Min/Max Pods: 1/4

Target CPU utilization: 50%

Stabilization window: should appear under Behavior > ScaleDown

ssh cka000050

kubectl get deployment apache-server -n autoscale

kubectl autoscale deployment apache-server \

--namespace autoscale \

--cpu-percent=50 \

--min=1 \

--max=4

# Patch to add stabilization window

cat < hpa-patch.yaml

spec:

behavior:

scaleDown:

stabilizationWindowSeconds: 30

EOF

kubectl patch hpa apache-server -n autoscale --patch "$(cat hpa-patch.yaml)"

// create a pod

kubectl run nginx --image=nginx --restart=Never --port=80

// List the pod with different verbosity

kubectl get po nginx --v=7

kubectl get po nginx --v=8

kubectl get po nginx --v=9

kubectl get po -o=custom-columns="POD_NAME:.metadata.name,

POD_STATUS:.status.containerStatuses[].state"

Kubect1 get po -o wide

Using JsonPath

kubect1 get pods -o=jsonpath='{range

items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\14 B.JPG

Task Summary

You need to:

SSH into cka000046

Create a StorageClass named local-path using the provisioner rancher.io/local-path

Set the volume binding mode to WaitForFirstConsumer

Make this StorageClass the default

Step-by-Step Solution

1️⃣ SSH into the correct host

ssh cka000046

⚠️ Required. Skipping this = zero score

2️⃣ Create a StorageClass YAML file

Create a file named local-path-sc.yaml:

cat < local-path-sc.yaml

apiVersion: storage.k8s.io/v1

kind: StorageClass

metadata:

name: local-path

annotations:

storageclass.kubernetes.io/is-default-class: "true"

provisioner: rancher.io/local-path

volumeBindingMode: WaitForFirstConsumer

EOF

✅ This:

Sets WaitForFirstConsumer (as required)

Marks the class as default using the correct annotation

3️⃣ Apply the StorageClass

kubectl apply -f local-path-sc.yaml

4️⃣ Verify it’s the default StorageClass

kubectl get storageclass

You should see local-path with a (default) marker:

NAME PROVISIONER RECLAIMPOLICY VOLUMEBINDINGMODE ALLOWVOLUMEEXPANSION AGE

local-path rancher.io/local-path Delete WaitForFirstConsumer false 10s

Final Command Summary

ssh cka000046

cat < local-path-sc.yaml

apiVersion: storage.k8s.io/v1

kind: StorageClass

metadata:

name: local-path

annotations:

storageclass.kubernetes.io/is-default-class: "true"

provisioner: rancher.io/local-path

volumeBindingMode: WaitForFirstConsumer

EOF

kubectl apply -f local-path-sc.yaml

kubectl get storageclass

solution

You must use the kubeadm configuration file located at /etc/kubeadm.conf when initializing

your cluster.

You may use any CNI plugin to complete this task, but if you don't have your favourite CNI plugin's manifest URL at hand, Calico is one popular option: https://docs.projectcalico.org/v3.14/manifests/calico.yaml

Docker is already installed on both nodes and apt has been configured so that you can install the required tools.

Solution:

Graphical user interface, text, application Description automatically generated

Text Description automatically generated

Solution:

vi ingress.yaml

#

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: ping

namespace: ing-internal

spec:

rules:

- http:

paths:

- path: /hi

pathType: Prefix

backend:

service:

name: hi

port:

number: 5678

#

kubectl create -f ingress.yaml

kubectl run nginx --image=nginx --restart=Never --labels=env=test --namespace=engineering --dry-run -o yaml > nginx-pod.yaml

kubectl run nginx --image=nginx --restart=Never --labels=env=test --namespace=engineering --dry-run -o yaml | kubectl create -n engineering -f –

YAML File:

apiVersion: v1

kind: Pod

metadata:

name: nginx

namespace: engineering

labels:

env: test

spec:

containers:

- name: nginx

image: nginx

imagePullPolicy: IfNotPresent

restartPolicy: Never

kubectl create -f nginx-pod.yaml

kubectl get pods -o=jsonpath="{.items[*]['metadata.name',

'metadata.namespace']}"

kubectl get po nginx -o

jsonpath='{.spec.containers[].image}{"\n"}'

Task Summary

Connect to host cka000056

Review existing frontend and backend Deployments

Choose one correct NetworkPolicy from the ~/netpol directory

The policy must:

Allow traffic only from the frontend Deployment to the backend Deployment

Avoid being overly permissive

Apply the correct NetworkPolicy without modifying any sample files

Step-by-Step Instructions

Step 1: SSH into the correct node

ssh cka000056

Step 2: Inspect the frontend Deployment

Check the labels used in the frontend Deployment:

kubectl get deployment -n frontend -o yaml

Look under metadata.labels or spec.template.metadata.labels. Note the app or similar label (e.g., app: frontend).

Step 3: Inspect the backend Deployment

kubectl get deployment -n backend -o yaml

Again, find the labels assigned to the pods (e.g., app: backend).

Step 4: List and review the provided NetworkPolicies

List the available files:

ls ~/netpol

Check the contents of each policy file:

cat ~/netpol/.yaml

Look for a policy that:

Has kind: NetworkPolicy

Applies to the backend namespace

Uses a podSelector that matches the backend pods

Includes an ingress.from rule that references the frontend namespace using a namespaceSelector (and optionally a podSelector)

Does not allow traffic from all namespaces or all pods

Here’s what to look for in a good match:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: allow-frontend-to-backend

namespace: backend

spec:

podSelector:

matchLabels:

app: backend

ingress:

- from:

- namespaceSelector:

matchLabels:

name: frontend

Even better if the policy includes:

- namespaceSelector:

matchLabels:

name: frontend

podSelector:

matchLabels:

app: frontend

This limits access to pods in the frontend namespace with a specific label.

Step 5: Apply the correct NetworkPolicy

Once you’ve identified the best match, apply it:

kubectl apply -f ~/netpol/.yaml

Apply only one file. Do not alter or delete any existing sample.

ssh cka000056

kubectl get deployment -n frontend -o yaml

kubectl get deployment -n backend -o yaml

ls ~/netpol

cat ~/netpol/*.yaml # Review carefully

kubectl apply -f ~/netpol/.yaml

Command Summary

ssh cka000056

kubectl get deployment -n frontend -o yaml

kubectl get deployment -n backend -o yaml

ls ~/netpol

cat ~/netpol/*.yaml # Review carefully

kubectl apply -f ~/netpol/.yaml

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\2 C.JPG

Task Overview

You're restoring a MariaDB deployment in the mariadb namespace with persistent data.

✅ Tasks:

SSH into cka000047

Create a PVC named mariadb:

Namespace: mariadb

Access mode: ReadWriteOnce

Storage: 250Mi

Use the existing retained PV (there’s only one)

Edit ~/mariadb-deployment.yaml to use the PVC

Apply the deployment

Verify MariaDB is running and stable

Step-by-Step Solution

1️⃣ SSH into the correct host

ssh cka000047

⚠️ Required — skipping = zero score

2️⃣ Inspect the existing PersistentVolume

kubectl get pv

✅ Identify the only existing PV, e.g.:

NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS

mariadb-pv 250Mi RWO Retain Available manual

Ensure the status is Available, and it is not already bound to a claim.

3️⃣ Create the PVC to bind the retained PV

Create a file mariadb-pvc.yaml:

cat < mariadb-pvc.yaml

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: mariadb

namespace: mariadb

spec:

accessModes:

- ReadWriteOnce

resources:

requests:

storage: 250Mi

volumeName: mariadb-pv # Match the PV name exactly

EOF

Apply the PVC:

kubectl apply -f mariadb-pvc.yaml

✅ This binds the PVC to the retained PV.

4️⃣ Edit the MariaDB Deployment YAML

Open the file:

nano ~/mariadb-deployment.yaml

Look under the spec.template.spec.containers.volumeMounts and spec.template.spec.volumes sections and update them like so:

Add this under the container:

yaml

CopyEdit

volumeMounts:

- name: mariadb-storage

mountPath: /var/lib/mysql

And under the pod spec:

volumes:

- name: mariadb-storage

persistentVolumeClaim:

claimName: mariadb

✅ These lines mount the PVC at the MariaDB data directory.

5️⃣ Apply the updated Deployment

kubectl apply -f ~/mariadb-deployment.yaml

6️⃣ Verify the Deployment is running and stable

kubectl get pods -n mariadb

kubectl describe pod -n mariadb

✅ Ensure the pod is in Running state and volume is mounted.

🧾 Final Command Summary

ssh cka000047

kubectl get pv # Find the retained PV

# Create PVC

cat < mariadb-pvc.yaml

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: mariadb

namespace: mariadb

spec:

accessModes:

- ReadWriteOnce

resources:

requests:

storage: 250Mi

volumeName: mariadb-pv

EOF

kubectl apply -f mariadb-pvc.yaml

# Edit Deployment

nano ~/mariadb-deployment.yaml

# Add volumeMount and volume to use the PVC as described

kubectl apply -f ~/mariadb-deployment.yaml

kubectl get pods -n mariadb

Solution:

#vi pv.yaml

apiVersion: v1

kind: PersistentVolume

metadata:

name: app-config

spec:

capacity:

storage: 1Gi

accessModes:

- ReadOnlyMany

hostPath:

path: /srv/app-config

#

kubectl create -f pv.yaml

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 D.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 E.JPG

kubect1 get pods --sort-by=.metadata.name

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\13 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\13 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\13 D.JPG

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\8 B.JPG

SOLUTION:

[student@node-1] > ssh ek8s

kubectl cordon ek8s-node-1

kubectl drain ek8s-node-1 --delete-local-data --ignore-daemonsets --force