Our team of highly skilled and experienced professionals is dedicated to delivering up-to-date and precise study materials in PDF format to our customers. We deeply value both your time and financial investment, and we have spared no effort to provide you with the highest quality work. We ensure that our students consistently achieve a score of more than 95% in the Linux-Foundation CKAD exam. You provide only authentic and reliable study material. Our team of professionals is always working very keenly to keep the material updated. Hence, they communicate to the students quickly if there is any change in the CKAD dumps file. The Linux-Foundation CKAD exam question answers and CKAD dumps we offer are as genuine as studying the actual exam content.
24/7 Friendly Approach:
You can reach out to our agents at any time for guidance; we are available 24/7. Our agent will provide you information you need; you can ask them any questions you have. We are here to provide you with a complete study material file you need to pass your CKAD exam with extraordinary marks.
Quality Exam Dumps for Linux-Foundation CKAD:
Pass4surexams provide trusted study material. If you want to meet a sweeping success in your exam you must sign up for the complete preparation at Pass4surexams and we will provide you with such genuine material that will help you succeed with distinction. Our experts work tirelessly for our customers, ensuring a seamless journey to passing the Linux-Foundation CKAD exam on the first attempt. We have already helped a lot of students to ace IT certification exams with our genuine CKAD Exam Question Answers. Don't wait and join us today to collect your favorite certification exam study material and get your dream job quickly.
90 Days Free Updates for Linux-Foundation CKAD Exam Question Answers and Dumps:
Enroll with confidence at Pass4surexams, and not only will you access our comprehensive Linux-Foundation CKAD exam question answers and dumps, but you will also benefit from a remarkable offer – 90 days of free updates. In the dynamic landscape of certification exams, our commitment to your success doesn't waver. If there are any changes or updates to the Linux-Foundation CKAD exam content during the 90-day period, rest assured that our team will promptly notify you and provide the latest study materials, ensuring you are thoroughly prepared for success in your exam."
Linux-Foundation CKAD Real Exam Questions:
Quality is the heart of our service that's why we offer our students real exam questions with 100% passing assurance in the first attempt. Our CKAD dumps PDF have been carved by the experienced experts exactly on the model of real exam question answers in which you are going to appear to get your certification.
Linux-Foundation CKAD Sample Questions
Question # 1
Context
You are asked to deploy an application developed for an older version of Kubernetes on a
cluster running a recent version of Kubernetes .
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00026 Task
Fix any API -deprecation issues in the manitest file
/home/candidate/credible-mite/web.yaml
so that the application can be deployed on cluster ckad00026.
The application was developed for Kubernetes v1.15.
The cluster ckad00026 runs Kubernetes 1.29+.
Deploy the application specified in the updated manifest file
/home/candidate/credible-mite/web.yaml in namespace garfish .
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00026Your job is to edit /home/candidate/credible-mite/web.yaml so it uses APIs supported onKubernetes 1.29+, then deploy it into namespace garfish.Because I can’t see your file from here, the most reliable exam approach is:run a server-side dry-run to reveal the exact deprecated/removed APIs andschema errorsedit the manifest to the modern API versions/fieldsre-run dry-run until it passesapply for real and verify rollout1) Go to the manifest and run a server-side dry-runcd /home/candidate/credible-mitels -lsed -n '1,200p' web.yamlMake sure the namespace exists:kubectl get ns garfish || kubectl create ns garfishNow run a server-side dry-run (this catches removed APIs on the cluster):kubectl apply -n garfish -f web.yaml --dry-run=serverWhatever errors you get here tell you exactly what to fix.2) Fix the common v1.15 v1.29 API deprecationsEdit the file:vi web.yamlBelow are the most common objects from older manifests and how to update them for1.29+.A) Deployments / DaemonSets / StatefulSetsOld (v1.15 often used):extensions/v1beta1 or apps/v1beta1 or apps/v1beta2New:apiVersion: apps/v1Also in apps/v1, .spec.selector is required and must match the pod template labels.Example conversion:apiVersion: apps/v1kind: Deploymentmetadata:name: webspec:replicas: 2selector:matchLabels:app: webtemplate:metadata:labels:app: webspec:containers:- name: webimage: nginxKey rule:spec.selector.matchLabels must exactly match spec.template.metadata.labels (at least forthe keys you select on).B) IngressOld:apiVersion: extensions/v1beta1 (or networking.k8s.io/v1beta1)New:apiVersion: networking.k8s.io/v1Required changes:spec.rules.http.paths[].pathType is required (usually Prefix)backend format changes from serviceName/servicePort toservice.name/service.port.number (or .name for named ports)Old backend:backend:serviceName: webservicePort: 80New backend:backend:service:name: webport:number: 80Full path example:apiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: webspec:rules:- host: example.localhttp:paths:- path: /pathType: Prefixbackend:service:name: webport:number: 80C) CronJobOld:apiVersion: batch/v1beta1New:apiVersion: batch/v1Most fields stay the same; just update apiVersion.D) PodDisruptionBudgetOld:policy/v1beta1New:policy/v1spec.selector/minAvailable/maxUnavailable remain, but apiVersion changes.E) RBACUsually already:rbac.authorization.k8s.io/v1 (this is fine)F) Removed APIs you must delete/replaceIf you see these in a v1.15-era manifest, they are removed in modern clusters:PodSecurityPolicy (policy/v1beta1) is removed. You cannot deploy it on 1.29+.Remove it from the manifest (or replace with whatever your environment uses, butfor CKAD tasks you usually delete PSP sections from the file).Some old admission/alpha resources also removed.If dry-run complains “no matches for kind … in version …”, that’s your cue.3) Re-run dry-run until it succeedsAfter you edit:kubectl apply -n garfish -f web.yaml --dry-run=serverKeep iterating until there are no errors.4) Deploy for realkubectl apply -n garfish -f /home/candidate/credible-mite/web.yaml5) Verify everything in namespace garfishList what was created:kubectl -n garfish get allkubectl -n garfish get ingress 2>/dev/null || trueIf there is a Deployment, verify rollout:kubectl -n garfish get deploykubectl -n garfish rollout status deploy --allCheck pods/events if something fails:kubectl -n garfish get pods -o widekubectl -n garfish describe pod <pod-name>kubectl -n garfish get events --sort-by=.lastTimestamp | tail -n 30
Question # 2
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00029
Task
Modify the existing Deployment named store-deployment, running in namespace
grubworm, so that its containers
run with user ID 10000 and
have the NET_BIND_SERVICE capability added
The store-deployment 's manifest file Click to copy
/home/candidate/daring-moccasin/store-deplovment.vaml
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00029You must modify the existing Deployment store-deployment in namespace grubworm sothat its containers:run as user ID 10000have Linux capability NET_BIND_SERVICE addedAnd you’re told to use the manifest file at:/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looksmisspelled; follow it exactly on the host)1) Inspect the current Deployment and locate the manifest filekubectl -n grubworm get deploy store-deploymentls -l /home/candidate/daring-moccasin/Open the manifest:sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"2) Edit the manifest to add SecurityContextEdit the file:vi "/home/candidate/daring-moccasin/store-deplovment.vaml"2.1 Set Pod-level runAsUser = 10000Under:spec.template.spec add:securityContext:runAsUser: 100002.2 Add NET_BIND_SERVICE capability at container-levelUnder the container spec (for each container in containers:), add:securityContext:capabilities:add: ["NET_BIND_SERVICE"]A complete example of what it should look like (mind indentation):apiVersion: apps/v1kind: Deploymentmetadata:name: store-deploymentnamespace: grubwormspec:template:spec:securityContext:runAsUser: 10000containers:- name: storeimage: someimagesecurityContext:capabilities:add: ["NET_BIND_SERVICE"]Important notes:runAsUser can be set at Pod level (applies to all containers) or per-container. Podlevel is cleanest if all containers should run as 10000.Capabilities must be set per-container (that’s where Kubernetes supports it).Save and exit.3) Apply the updated manifestkubectl apply -f "/home/candidate/daring-moccasin/store-deplovment.vaml"4) Ensure the Deployment rolls outkubectl -n grubworm rollout status deploy store-deployment5) Verify the settings are in effectCheck the rendered pod template:kubectl -n grubworm get deploy store-deployment -ojsonpath='{.spec.template.spec.securityContext}{"\n"}'kubectl -n grubworm get deploy store-deployment -ojsonpath='{.spec.template.spec.containers[0].securityContext}{"\n"}'Verify on a running pod:kubectl -n grubworm get podskubectl -n grubworm describe pod <pod-name> | sed -n '/Security Context:/,/Containers:/p'kubectl -n grubworm describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'If there are multiple containersRepeat the container-level securityContext.capabilities.add block for each container underspec.template.spec.containers.
Question # 3
Context
An existing web application must be exposed externally.
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00025
An application externally using the URL external.sterling-bengal.local . Any requests
starting with / must be routed to the application web-app.
To test the web application's external reachability, run
[candidate@ckad00025] $ curl http://external.sterling-bengal.local/ or open this URL in the remote desktop's browser.
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00025You need to expose the existing app “web-app” externally at:Host: external.sterling-bengal.localPath: / (and anything starting with /) route to web-appIn CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.1) Find where web-app Service lives (namespace + port)kubectl get svc -A | grep -w web-appYou’ll get something like:<NAMESPACE> web-app ClusterIP ... <PORT>/TCPSet the namespace:NS=<NAMESPACE>Check the service port(s):kubectl -n $NS get svc web-app -o yamlNote the service port number (commonly 80).Also verify it has endpoints (so it actually routes to pods):kubectl -n $NS get endpoints web-app -o wideIf endpoints are empty, the Service selector doesn’t match pods — tell me and I’ll give theexact fix. But usually it’s fine.2) Create the Ingress to route / to web-appCreate a manifest (use the service port you saw; I’ll assume 80 below):cat <<'EOF' > web-app-ingress.yamlapiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: web-app-ingressspec:rules:- host: external.sterling-bengal.localhttp:paths:- path: /pathType: Prefixbackend:service:name: web-appport:number: 80EOFApply it:kubectl -n $NS apply -f web-app-ingress.yamlVerify:kubectl -n $NS get ingress web-app-ingresskubectl -n $NS describe ingress web-app-ingressIf your Service port is not 80, change number: 80 to the correct value and re-apply.3) Test external reachability (as instructed)Run exactly:curl -i http://external.sterling-bengal.local/If curl still fails (quick checks)A) Is there an ingress controller running?kubectl get pods -A | egrep -i 'ingress|nginx'kubectl get svc -A | egrep -i 'ingress|nginx'B) Does Ingress show an address?kubectl -n $NS get ingress web-app-ingress -o wideC) Do we have endpoints?kubectl -n $NS get endpoints web-app -o wide
Question # 4
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00044
Task:
Update the existing Deployment busybox running in the namespace rapid-goat .
First, change the container name to musl.
Next, change the container image to busybox:musl .
Finally, ensure that the changes to the busybox Deployment, running in the
namespace rapid-goat, are rolled out.
Answer: See the Explanation below for complete solution. Explanation:0) SSH to the correct hostssh ckad00044(Optional sanity)kubectl config current-contextkubectl get ns | grep rapid-goat1) Inspect the Deployment and current container namekubectl -n rapid-goat get deploy busyboxkubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'kubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[*].image}{"\n"}'Note the current container name (likely something like busybox). We need to rename it tomusl.2) Edit the Deployment (best for renaming container)Renaming a container is easiest with edit:kubectl -n rapid-goat edit deploy busyboxIn the editor, find:spec:template:spec:containers:- name: <old-name>image: <old-image>Change it to:- name: muslimage: busybox:muslSave and exit.3) Ensure the rollout happens and completeskubectl -n rapid-goat rollout status deploy busybox4) Verify the new Pod template is correctCheck the Deployment template:kubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[0].name}{"\n"}{.spec.template.spec.containers[0].image}{"\n"}'Check running Pods and the image actually used:kubectl -n rapid-goat get pods -o widePOD=$(kubectl -n rapid-goat get pods -l app=busybox -ojsonpath='{.items[0].metadata.name}' 2>/dev/null || true)If you don’t have that label selector, just pick a pod name from kubectl get pods and:kubectl -n rapid-goat describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'
Question # 5
Context
You are asked to allow a Pod to communicate with two other Pods but nothing else.
You must connect to the correct host . Failure to do so may result
in a zero score.
! [candidate@base] $ ssh ckad000
18
charming-macaw namespace to use a NetworkPolicy allowing the Pod to send and receive
traffic only to and from the Pods front and db.
All required NetworkPolicies have already been created.
You must not create, modify or delete any NetworkPolicy while working on this task. You
may only use existing NetworkPolicies .
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00018You cannot create/modify/delete any NetworkPolicy.So the only way to make the existing policies “take effect” is to ensure the right Pods havethe labels/selectors those policies expect.The task: in namespace charming-macaw, configure things so the target Pod can send +receive traffic ONLY to/from Pods front and db.1) Inspect what NetworkPolicies already exist (don’t change them)kubectl -n charming-macaw get netpolkubectl -n charming-macaw get netpol -o wideDump them to see the selectors they use:kubectl -n charming-macaw get netpol -o yamlYou are looking for policies that:select the restricted pod via spec.podSelectorand allow ingress/egress only with selectors that match front and dboften there’s also a “default deny” policy.2) Identify the Pods and their current labelskubectl -n charming-macaw get pods -o widekubectl -n charming-macaw get pods --show-labelsSpecifically inspect labels for front and db:kubectl -n charming-macaw get pod front --show-labelskubectl -n charming-macaw get pod db --show-labels(If they’re Deployments instead of single Pods, do:)kubectl -n charming-macaw get deploy --show-labelskubectl -n charming-macaw get pods -l app=front --show-labelskubectl -n charming-macaw get pods -l app=db --show-labels3) Figure out which pod is “the Pod” to restrictUsually there’s a third pod (e.g., backend, api, app) besides front and db.List pods again and identify the “other” one:kubectl -n charming-macaw get podsLet’s assume the pod to restrict is called app (replace as needed):TARGET=<pod-to-restrict>4) Match the existing NetworkPolicy selectors by labeling pods (allowed)Because you can’t edit NetworkPolicies, you must make labels on Pods (or theircontrollers) match the policies’ selectors.4.1 Determine the label required on the TARGET podFrom the YAML, find the policy that selects the restricted pod, e.g.:spec:podSelector:matchLabels:role: restrictedExtract podSelector from each policy quickly:kubectl -n charming-macaw get netpol -o jsonpath='{range .items[*]}{.metadata.name}{" =>"}{.spec.podSelector}{"\n"}{end}'Pick the selector that is meant for the restricted pod, then apply it to the TARGET pod(example: role=restricted):kubectl -n charming-macaw label pod $TARGET role=restricted --overwriteBest practice (if the pod is managed by a Deployment): label the Deployment templateinstead, so it persists.Find the owner:kubectl -n charming-macaw get pod $TARGET -ojsonpath='{.metadata.ownerReferences[0].kind}{""}{.metadata.ownerReferences[0].name}{"\n"}'If it’s a ReplicaSet, find its Deployment:RS=$(kubectl -n charming-macaw get pod $TARGET -ojsonpath='{.metadata.ownerReferences[0].name}')kubectl -n charming-macaw get rs $RS -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.metadata.ownerReferences[0].name}{"\n"}'Then label the Deployment (example):kubectl -n charming-macaw label deploy <DEPLOYMENT_NAME> role=restricted --overwrite4.2 Ensure front and db match what the allow-rules referenceLook inside the allow policy ingress.from / egress.to. You might see something like:from:- podSelector:matchLabels:name: front- podSelector:matchLabels:name: dbSo you must ensure:front pod has name=frontdb pod has name=dbApply labels (examples—use what the policy expects):kubectl -n charming-macaw label pod front name=front --overwritekubectl -n charming-macaw label pod db name=db --overwriteAgain, if they’re Deployments, label the Deployment instead:kubectl -n charming-macaw label deploy front name=front --overwritekubectl -n charming-macaw label deploy db name=db --overwrite5) Verify the NetworkPolicies now “select” the right podsCheck which labels each pod has now:kubectl -n charming-macaw get pods --show-labelsConfirm the restricted pod matches the NetPol podSelector:kubectl -n charming-macaw get netpol <POLICY_NAME> -ojsonpath='{.spec.podSelector}{"\n"}'kubectl -n charming-macaw get pod $TARGET --show-labels6) Functional verification (quick network tests)Exec into the restricted pod and try to reach:front alloweddb allowedanything else blockedIf busybox has wget:kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://front 2>/dev/null ||true'kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://db 2>/dev/null ||true'Test something that should be blocked (example: kubernetes service DNS name):kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qOhttps://kubernetes.default.svc 2>/dev/null || echo "blocked"'Also test inbound (from front to target, and from db to target) if the target listens on a port;otherwise inbound testing may be limited.What you’re doing conceptuallyExisting NetPols are already correct.Your job is to make pod labels match the NetPol selectors so:
Question # 6
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00021
Task
Create a Cronjob named grep that executes a Pod running the following single container:
name: busybox
image: busybox:stable
command: ["grep", "-i", "nameserv
er", "/etc/resolv.conf"] Configure the CronJob to:
execute Once every 30 minutes
keep 96 completed Job
keep 192 failed Job
never restart podsterminate pods after 8 seconds
Manually create and execute once job
named grep-test from the grep Cronjob
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00021Below is the clean, CKAD-friendly way (YAML + apply + verify + manual job).1) Create the CronJob grepCreate a file (anywhere, e.g. in your home):cat <<'EOF' > grep-cronjob.yamlapiVersion: batch/v1kind: CronJobmetadata:name: grepspec:schedule: "*/30 * * * *"successfulJobsHistoryLimit: 96failedJobsHistoryLimit: 192jobTemplate:spec:activeDeadlineSeconds: 8template:spec:restartPolicy: Nevercontainers:- name: busyboximage: busybox:stablecommand: ["grep", "-i", "nameserver", "/etc/resolv.conf"]EOFApply it:kubectl apply -f grep-cronjob.yamlVerify:kubectl get cronjob grepkubectl describe cronjob grepConfirm the key fields quickly:kubectl get cronjob grep -ojsonpath='{.spec.schedule}{"\n"}{.spec.successfulJobsHistoryLimit}{"\n"}{.spec.failedJobsHistoryLimit}{"\n"}'kubectl get cronjob grep -ojsonpath='{.spec.jobTemplate.spec.activeDeadlineSeconds}{"\n"}{.spec.jobTemplate.spec.template.spec.restartPolicy}{"\n"}'2) Manually create and execute the one-off Job grep-test from the CronJobCreate the Job from the CronJob:kubectl create job --from=cronjob/grep grep-testWatch it:kubectl get jobs grep-testkubectl get pods -l job-name=grep-testGet logs (most important proof):POD=$(kubectl get pods -l job-name=grep-test -o jsonpath='{.items[0].metadata.name}')kubectl logs "$POD"You should see one or more nameserver ... lines from /etc/resolv.conf.
Question # 7
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00033
Task
A Dockerfile has been prepared at /home/candidate/build/Dockerfile.
Using the prepared Dockerfile, build a container image with the name macaque and tag
1.2. You may install and use the tool of your choice.
Multiple image builders and tools have been pre-installed in the base system,
including: docker, skopeo, buildah, img , and podman.
Please do not push the built image to a registry, run a container, or otherwise consume it.
Using the tool of your choice, export the built container image in OCI or Docker image
format and store it at /home/candidate/macaque-1.2.tar.
Answer: See the Explanation below for complete solution. Explanation:Understood — I’ll redo Question 13 without using any (or similar) icons.ssh ckad00033This task is only about building and exporting a container image.You must not push it, run it, or consume it in any way.You may use any image builder. Below are clean, correct solutions. Use one of them.Option A: Using Docker1) Go to the Dockerfile locationcd /home/candidate/buildls -l Dockerfile2) Build the imageImage name: macaqueTag: 1.2docker build -t macaque:1.2 .Verify:docker images | grep macaque3) Export the image to a tar fileDocker image format is acceptable.docker save macaque:1.2 -o /home/candidate/macaque-1.2.tarVerify the file exists:ls -lh /home/candidate/macaque-1.2.tarDo not load or run the image.Option B: Using Podman (rootless alternative)1) Build the imagecd /home/candidate/buildpodman build -t macaque:1.2 .Verify:podman images | grep macaque2) Export the imagepodman save macaque:1.2 -o /home/candidate/macaque-1.2.tarVerify:ls -lh /home/candidate/macaque-1.2.tarOption C: Using Buildah (OCI format)cd /home/candidate/buildbuildah bud -t macaque:1.2 .buildah push macaque:1.2 oci-archive:/home/candidate/macaque-1.2.tar
Question # 8
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00027
Task
A Deployment named app-deployment in namespace prod runs a web application port
0001 A Deployment named app-deployment in namespace prod runs a web application
on port 8081.
The Deployment 's manifest files can be found at
/home/candidate/spicy-pikachu/app-deployment.yaml
Modify the Deployment specifying a readiness probe using path /healthz .
Set initialDelaySeconds to 6 and periodSeconds to 3.
Answer: See the Explanation below for complete solution. Explanation:Do this on ckad00027 and edit the given manifest file (that’s what the task expects).0) Connect to correct hostssh ckad000271) Open the manifest and identify the container + portcd /home/candidate/spicy-pikachuls -lsed -n '1,200p' app-deployment.yamlConfirm the container port is 8081 in the YAML (usually under ports:).2) Edit the YAML to add a readinessProbeEdit the file:vi app-deployment.yamlInside the Deployment, locate:spec:template:spec:containers:- name: ...image: ...Add this under the container (same indentation level as image, ports, etc.):readinessProbe:httpGet:path: /healthzport: 8081initialDelaySeconds: 6periodSeconds: 3Notes:Use port: 8081 (because the app runs on 8081).Ensure indentation is correct (2 spaces per level commonly).Save and exit.3) Apply the updated manifestkubectl apply -f /home/candidate/spicy-pikachu/app-deployment.yaml4) Ensure the Deployment rolls out successfullykubectl -n prod rollout status deploy app-deployment5) Verify the readiness probe is setCheck the probe from the live object:kubectl -n prod get deploy app-deployment -ojsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'And confirm pods are becoming Ready:kubectl -n prod get pods -l app=app-deploymentIf the label selector differs, just:kubectl -n prod get podskubectl -n prod describe pod <pod-name> | sed -n '/Readiness:/,/Conditions:/p'That completes the task: readiness probe on /healthz, initialDelaySeconds: 6,periodSeconds: 3.
Question # 9
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00032
The Pod for the Deployment named nosql in the haddock namespace fails to start because
its Container runs out of resources.
Update the nosql Deployment so that the Container :
requests 128Mi of memory
limits the memory to half the maximum memory constraint set for the haddock
namespace
Answer: See the Explanation below for complete solution. Explanation:Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:memory request = 128Mi? memory limit = half of the namespace’s maximum memory constraintYou must do this on the correct host.0) Connect to the correct hostssh ckad000321) Confirm the failing Deployment / Podskubectl -n haddock get deploy nosqlkubectl -n haddock get pods -l app=nosql 2>/dev/null || kubectl -n haddock get podsIf pods are crashing, check why (you’ll likely see OOMKilled):kubectl -n haddock describe pod <pod-name>2) Find the maximum memory constraint set for the haddock namespaceIn CKAD labs, this is commonly enforced by a LimitRange (max memory per container).Sometimes it can also be a ResourceQuota.2A) Check LimitRange (most likely)kubectl -n haddock get limitrangekubectl -n haddock get limitrange -o yamlExtract the max memory value quickly:MAX_MEM=$(kubectl -n haddock get limitrange -ojsonpath='{.items[0].spec.limits[0].max.memory}')echo "Namespace max memory constraint: $MAX_MEM"2B) If no LimitRange exists, check ResourceQuotakubectl -n haddock get resourcequotakubectl -n haddock describe resourcequotaIf quota is used, you’re looking for something like limits.memory (but the question wording“maximum memory constraint” usually points to LimitRange max.memory).3) Compute “half of the max memory constraint”Run this small snippet to compute HALF in Mi (handles Mi and Gi):HALF_MEM=$(python3 - <<'PY'import os, req = os.environ.get("MAX_MEM","").strip()m = re.fullmatch(r"(\d+)(Mi|Gi)", q)if not m:raise SystemExit(f"Cannot parse MAX_MEM='{q}'. Expected like 512Mi or 1Gi.")val = int(m.group(1))unit = m.group(2)# convert to Mimi = val if unit == "Mi" else val * 1024half_mi = mi // 2print(f"{half_mi}Mi")PY)echo "Half of max: $HALF_MEM"Example: if MAX_MEM=512Mi HALF_MEM=256MiExample: if MAX_MEM=1Gi HALF_MEM=512Mi4) Update the nosql Deployment (DO NOT delete it)First, get the container name (Deployment may have a custom container name):kubectl -n haddock get deploy nosql -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'Now set resources (this updates the Deployment in-place):kubectl -n haddock set resources deploy nosql \--requests=memory=128Mi \--limits=memory=$HALF_MEM5) Ensure the update rolls out successfullykubectl -n haddock rollout status deploy nosql6) Verify the pod has the right requests/limitskubectl -n haddock get deploy nosql -ojsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'kubectl -n haddock get podsPick the new pod and confirm:kubectl -n haddock describe pod <new-pod-name> | sed -n '/Requests:/,/Limits:/p'You should see:Requests: memory 128MiLimits: memory <HALF_MEM>If rollout fails (common cause)If you accidentally set a limit above the namespace max, pods won’t start. Check events:kubectl -n haddock describe deploy nosqlkubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20
Question # 10
Context
You are asked to set resource requests and limits for a running workload to ensure fair
resource management.
“Do not delete the existing Deployment . Failure to do so will result in a reduced score.”
Next, ensure that the total amount of resources in the namespace matches the maximum
resources the Pods from the nginx-resources Deployment can request.
Failure to do so will result in the updated Deployment failing to roll out successfully.
Answer: See the Explanation below for complete solution. Explanation:Below are the exact steps/commands you can run.1) Locate the Deployment and its namespacekubectl get deploy -A | grep nginx-resourcesYou should see output like:<namespace> nginx-resources ...Set a variable (replace <NS> with what you see):NS=<NS>Confirm replicas:kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'2) Check if there is a ResourceQuota in that namespacekubectl -n $NS get resourcequotakubectl -n $NS describe resourcequotaIf there is a quota, note these fields (common ones):requests.cpurequests.memorylimits.cpulimits.memory3) Decide requests/limits for the Deployment (example values)If the question (in your environment) provides specific values, use those.If it doesn’t, a typical safe pair is:requests: cpu: 100m, memory: 128Milimits: cpu: 200m, memory: 256MiI’ll proceed with these example values. If your lab specifies different numbers, just swap them in.4) Update the existing Deployment (DO NOT DELETE)Option A (fastest): kubectl set resourcesAssuming the container name is the first container (we’ll detect it):kubectl -n $NS get deploy nginx-resources -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'If it prints a single container name, set it like this:kubectl -n $NS set resources deploy nginx-resources \--requests=cpu=100m,memory=128Mi \--limits=cpu=200m,memory=256MiVerify the Deployment now has resourceskubectl -n $NS get deploy nginx-resources -ojsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'5) Compute the total resources requested by the DeploymentGet replicas:REPLICAS=$(kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}')echo $REPLICAS6) Ensure the namespace quota matches (or exceeds) those totalsThis is the part the question warns about: if the quota is too low, the Deployment updatewill fail to roll out.6.1 If a ResourceQuota already existsPatch it to allow at least the totals you calculated.First, identify quota name:RQ=$(kubectl -n $NS get resourcequota -o jsonpath='{.items[0].metadata.name}')echo $RQThen patch (example: replicas=2 requests.cpu=200m, requests.memory=256Mi):kubectl -n $NS patch resourcequota $RQ --type='merge' -p '{"spec": {"hard": {"requests.cpu": "200m","requests.memory": "256Mi","limits.cpu": "400m","limits.memory": "512Mi"}}}'Adjust those numbers to your replicas × request, and replicas × limit (if your quota alsoenforces limits).6.2 If there is NO ResourceQuotaCreate one that matches the Deployment max request totals.Example for replicas=2 with our sample requests/limits:cat <<EOF | kubectl apply -n $NS -f -apiVersion: v1kind: ResourceQuotametadata:name: nginx-resources-quotaspec:hard:requests.cpu: "200m"requests.memory: "256Mi"limits.cpu: "400m"limits.memory: "512Mi"EOF7) Verify rollout succeedskubectl -n $NS rollout status deploy nginx-resourceskubectl -n $NS get podsVerify the running pods actually have the requests/limits:kubectl -n $NS get pod -l app=nginx-resources -o jsonpath='{range.items[*]}{.metadata.name}{" "}{.spec.containers[0].resources}{"\n"}{end}'(If the label selector app=nginx-resources doesn’t exist, just pick a pod name from kubectlget pods and run:)kubectl -n $NS describe pod <pod-name> | sed -n '/Limits:/,/Requests:/p'Common reasons this fails (and the fix)Rollout stuck / pods pending with “exceeded quota”Check:kubectl -n $NS describe pod <pending-pod>kubectl -n $NS describe resourcequotaFix: increase ResourceQuota hard values to match required totals.You set requests higher than quota allowsFix: either reduce requests or raisequota.kubectl get deploy -A | grep nginx-resourceskubectl -n <NS> get deploy nginx-resources -ojsonpath='{.spec.replicas}{"\n"}{.spec.template.spec.containers[0].name}{"\n"}'kubectl -n <NS> describe resourcequota
Question # 11
Context
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00043
A Deployment needs specific RBAC permissions.
Task
First, find the RBAC permissions needed by the scraper Deployment running in the
cute-panda namespace .
it kubectl logs may help you to find the permissions it needs.
Next, create a new ServiceAccount named scraper in the namespace cute-panda.
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00043You have two deliverables here:Figure out what RBAC permissions the scraper Deployment needs (the logs willusually show “Forbidden” with the missing verb/resource).Create a ServiceAccount named scraper in namespace cute-panda (and inpractice, you then bind the needed permissions to it and use it in the Deploymentso it actually works).Below is the exact CKAD-style workflow.1) Find the missing RBAC permissions (use logs + events)1.1 Identify the pods for the Deploymentkubectl -n cute-panda get deploy scraperkubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get podsPick one pod name and check logs:kubectl -n cute-panda logs deploy/scraper --tail=100If the pod is crashlooping and logs are short:POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')kubectl -n cute-panda logs "$POD" --previous --tail=2001.2 Look specifically for “Forbidden” linesMost apps print errors like:... is forbidden: User "system:serviceaccount:cute-panda:default" cannot listresource "pods" in API group "" in the namespace "cute-panda"or cannot get resource "configmaps"...or cannot watch ...If you don’t see it in logs, check events:kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 301.3 Extract verb/resource/apiGroup from the errorFrom a typical Kubernetes RBAC “forbidden” message, capture:verb: get/list/watch/create/update/patch/deleteresource: pods, configmaps, secrets, deployments, etc.apiGroup: "" (core), apps, batch, etc.namespace: cute-panda (this is a namespaced permission if it’s a Role)You may have multiple “cannot …” lines you need to allow all of them.2) Create the ServiceAccount scraper (required by the task)kubectl -n cute-panda create serviceaccount scraperkubectl -n cute-panda get sa scraper3) Create the RBAC objects to grant the needed permissionsThe task says “A Deployment needs specific RBAC permissions” — in CKAD, that usuallymeans: Role + RoleBinding (namespaced) bound to your new ServiceAccount.3.1 Create a Role (template you fill from the log output)Create scraper-role.yaml:cat <<'EOF' > scraper-role.yamlapiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:name: scraper-rolenamespace: cute-pandarules:# EXAMPLE ONLY: replace these rules with what your logs show- apiGroups: [""]resources: ["pods"]verbs: ["get","list","watch"]EOFApply it:kubectl apply -f scraper-role.yaml3.2 Bind the Role to the ServiceAccountkubectl -n cute-panda create rolebinding scraper-rb \--role=scraper-role \--serviceaccount=cute-panda:scraperVerify:kubectl -n cute-panda get role scraper-rolekubectl -n cute-panda get rolebinding scraper-rb -o yaml4) Update the Deployment to use the new ServiceAccount (so it actually works)Check current SA (likely default):kubectl -n cute-panda get deploy scraper -ojsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'Patch it to use scraper:kubectl -n cute-panda patch deploy scraper -p'{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'Rollout:kubectl -n cute-panda rollout status deploy scraperRe-check logs to confirm RBAC errors are gone:kubectl -n cute-panda logs deploy/scraper --tail=100
Question # 12
Context
You must connect to the correct host . Failure to do so may result in a zero score.
!
[candidate@base] $ ssh ckad00028
Task
A Pod within the Deployment named honeybee-deployment and in namespace gorilla is logging errors.
Look at the logs to identify error messages.
Look at the logs to identify error messages.
Find errors, including User
"system:serviceaccount:gorilla:default" cannot list resource "pods" [ ... ] in the
namespace "gorilla"
Update the Deployment
honeybee-deployment to resolve the errors in the logs of the Pod.
The honeybee-deployment 's manifest file can be found at
/home/candidate/prompt-escargot/honey bee-deployment.yaml
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00028You’re seeing RBAC errors like:User "system:serviceaccount:gorilla:default" cannot list resource "pods" … in namespace"gorilla"That means the Pod is running as the default ServiceAccount and needs permission tolist pods (and possibly also get/watch).You must fix it by updating the Deployment (via its manifest file) and giving it the properRBAC.1) Confirm the error in logskubectl -n gorilla get deploy honeybee-deploymentkubectl -n gorilla logs deploy/honeybee-deployment --tail=200If it’s CrashLooping and you need previous logs:POD=$(kubectl -n gorilla get pods -l app=honeybee -ojsonpath='{.items[0].metadata.name}' 2>/dev/null || kubectl -n gorilla get pods -ojsonpath='{.items[0].metadata.name}')kubectl -n gorilla logs "$POD" --previous --tail=200You should see the “cannot list resource pods” line.2) Create a dedicated ServiceAccount for the app(Using a dedicated SA is standard practice; the task wants you to “resolve the errors”.)kubectl -n gorilla create serviceaccount honeybee-sakubectl -n gorilla get sa honeybee-sa3) Create RBAC: Role + RoleBinding (namespaced)This will allow listing pods in namespace gorilla.cat <<'EOF' > honeybee-rbac.yamlapiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:name: honeybee-pod-readernamespace: gorillarules:- apiGroups: [""]resources: ["pods"]verbs: ["get", "list", "watch"]---apiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:name: honeybee-pod-reader-bindingnamespace: gorillasubjects:- kind: ServiceAccountname: honeybee-sanamespace: gorillaroleRef:apiGroup: rbac.authorization.k8s.iokind: Rolename: honeybee-pod-readerEOFApply it:kubectl apply -f honeybee-rbac.yamlQuick verification (optional but very useful):kubectl auth can-i list pods -n gorilla --as=system:serviceaccount:gorilla:honeybee-saShould return yes.4) Update the Deployment manifest to use the new ServiceAccountThe manifest is at:/home/candidate/prompt-escargot/honey bee-deployment.yamlBecause there’s a space in the filename, quote it.4.1 Edit the filecd /home/candidate/prompt-escargotls -lvi "honey bee-deployment.yaml"In the Deployment YAML, add (or set) this under:spec.template.spec:serviceAccountName: honeybee-saExample location:spec:template:spec:serviceAccountName: honeybee-sacontainers:- name: ...Save and exit.4.2 Apply the updated manifestkubectl apply -f "/home/candidate/prompt-escargot/honey bee-deployment.yaml"5) Ensure rollout succeeds and errors are gonekubectl -n gorilla rollout status deploy honeybee-deploymentkubectl -n gorilla logs deploy/honeybee-deployment --tail=200Also confirm the pods now run with the right ServiceAccount:kubectl -n gorilla get pods -o jsonpath='{range .items[*]}{.metadata.name}{"sa="}{.spec.serviceAccountName}{"\n"}{end}'You should no longer see the RBAC “cannot list pods” errors.
Question # 13
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00034c
Task
A Deployment named content-marlin-deployment , running in namespace content-marlin is
exposed via Ingress content-marlin-ingress .
The manifest files for the Deployment, Service and Ingress can be found at
/home/candidate/content-marlin/.
The Deployment is supposed to be reachable at
http://content-marlin.local/content-marlin , but requesting this URL is currently returning an
error.
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00034cYou’re debugging an Ingress Service Deployment chain. The fastest way is:reproduce the error with the right Host headercheck Ingress rules (host/path/backend)check Service (selector/port/targetPort)check Endpoints (do we have ready pods?)fix the manifest(s) under /home/candidate/content-marlin/apply + re-testBelow are the exact commands + the most common fixes for this exact symptom.1) Reproduce the failing request correctlyEven if DNS isn’t set up, you can test with a Host header:curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlinIf your ingress controller is not on localhost, find the NodePort/LoadBalancer IP. In theselabs it’s often localhost via a local proxy, but if needed:kubectl get svc -A | egrep -i 'ingress|nginx'kubectl get nodes -o wide(But start with the localhost curl above.)2) Inspect the provided manifests (this is what you must edit)cd /home/candidate/content-marlin/ls -lsed -n '1,200p' *.yamlAlso view what’s currently live in the cluster:kubectl -n content-marlin get deploy,svc,ingresskubectl -n content-marlin describe ingress content-marlin-ingresskubectl -n content-marlin get ingress content-marlin-ingress -o yamlWhat to look for in the Ingress:spec.rules.host should be content-marlin.localspec.rules.http.paths[].path should match /content-marlinBackend service name must be your serviceBackend service port must match the service port (name or number)pathType should be Prefix (usually safest)3) Validate Service Pod wiring (most common real cause)3.1 Check service selector and portskubectl -n content-marlin get svc -o widekubectl -n content-marlin describe svc content-marlin-deployment 2>/dev/null || truekubectl -n content-marlin describe svcIdentify the service that the Ingress points to (from describe ingress).Check if the Service selector matches pod labels:kubectl -n content-marlin get pods --show-labelskubectl -n content-marlin get svc <SERVICE_NAME> -o jsonpath='{.spec.selector}{"\n"}'3.2 Check endpoints (this tells you instantly if traffic can reach pods)kubectl -n content-marlin get endpointskubectl -n content-marlin get endpoints <SERVICE_NAME> -o wide??????If ENDPOINTS is empty Service selector doesn’t match Pods OR Pods aren’tReady.3.3 If endpoints empty, check pod readiness and labelskubectl -n content-marlin get pods -o widekubectl -n content-marlin describe pod <pod-name>4) Apply the most likely fix patternsFix pattern A: Ingress path needs rewriteIf your app serves / but you route /content-marlin, you often need rewrite.Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:path: /content-marlinpathType: Prefixannotation: rewrite to / (common for nginx ingress)Example (typical nginx-ingress):metadata:annotations:nginx.ingress.kubernetes.io/rewrite-target: /spec:rules:- host: content-marlin.localhttp:paths:- path: /content-marlinpathType: Prefixbackend:service:name: <SERVICE_NAME>port:number: 80If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it’svery often nginx.Fix pattern B: Ingress points to wrong Service portIf the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port),align them:Either change Ingress backend port.numberOr change Service spec.ports[].port / targetPortFix pattern C: Service selector mismatch (endpoints empty)If pods have label app=content-marlin but service selector is app=content-marlindeployment (or vice versa), fix the Service selector to match pod labels.Service should have:spec:selector:app: <label-that-actually-exists-on-pods>Fix pattern D: Service targetPort wrongIf container listens on 8080 but service targetPort is 80, fix it:spec:ports:- port: 80targetPort: 80805) Apply the corrected manifestsAfter editing the YAMLs under /home/candidate/content-marlin/:kubectl apply -f /home/candidate/content-marlin/Wait for readiness:kubectl -n content-marlin rollout status deploy content-marlin-deploymentkubectl -n content-marlin get endpointskubectl -n content-marlin describe ingress content-marlin-ingress6) Re-test the URLcurl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlinIf you still get errors, also check ingress controller logs/events quickly:kubectl -n content-marlin get events --sort-by=.lastTimestamp | tail -n 30kubectl get pods -A | egrep -i 'ingress|nginx'The fastest way for you to finish in 1 shotRun these and paste the output (I’ll tell you exactly which line to change and what tochange it to):kubectl -n content-marlin describe ingress content-marlin-ingresskubectl -n content-marlin get svc -o widekubectl -n content-marlin get endpoints -o widekubectl -n content-marlin get pods --show-labelssed -n '1,200p' /home/candidate/content-marlin/*.yamlBut even without pasting, if you follow steps 2–4 above, you’ll find the broken link (Ingressrule, Service port, selector, or rewrite) and fix it cleanly.
Join the Conversation
Be part of the conversation — share your thoughts, reply to others, and contribute your experience.
Sun Hao
Some scenario questions about Kubernetes services and container orchestration were interesting.
Sun Hao
Some scenario questions about Kubernetes services and container orchestration were interesting.
Frederik Klein
Those usually test Certified Kubernetes Application Developer certification and cloud-native development concepts.