2V0-71.23 VMware Tanzu for Kubernetes Operations Professional Questions and Answers

Two configurations that are valid for Zonal Supervisor Deployment are three-zone and one-zone.  A Zonal Supervisor Deployment is a way of deploying the vSphere with Tanzu Supervisor Cluster across multiple vSphere clusters that are mapped to vSphere Zones 1 .  A vSphere Zone is a logical grouping of vSphere clusters that share common characteristics, such as network connectivity, power source, or physical location 2 .  A Zonal Supervisor Deployment provides high availability and fault tolerance for Kubernetes workloads by distributing them across different zones 1 . The supported configurations for Zonal Supervisor Deployment are:

Three-zone: The Supervisor Cluster spans three vSphere clusters, each mapped to a different vSphere Zone.  This configuration provides the highest level of availability and fault tolerance, as it can tolerate the failure of any one zone 1 .

One-zone: The Supervisor Cluster runs on a single vSphere cluster that is mapped to a single vSphere Zone.  This configuration is suitable for development or testing purposes, but does not provide any availability or fault tolerance guarantees 1 .

References:  Requirements for Zonal Supervisor Deployment - VMware Docs ,  Create vSphere Zones for a Multi-Zone Supervisor Deployment - VMware Docs

The role of the Tanzu Kubernetes Grid Service is to provision Kubernetes clusters that integrate with the underlying vSphere Namespace resources and Supervisor Services.  The Tanzu Kubernetes Grid Service is a component of vSphere with Tanzu that provides self-service lifecycle management of Tanzu Kubernetes clusters 3 .  A Tanzu Kubernetes cluster is an opinionated installation of Kubernetes that runs on top of the Supervisor Cluster and inherits its capabilities, such as storage integration, pod networking, load balancing, authentication, and authorization 4 .  The Tanzu Kubernetes Grid Service exposes three layers of controllers to manage the lifecycle of a Tanzu Kubernetes cluster: Cluster API, Virtual Machine Service, and Tanzu Kubernetes Release Service 3 . References:  Tanzu Kubernetes Grid Service Architecture - VMware Docs ,  What Is a Tanzu Kubernetes Cluster? - VMware Docs

The purpose of setting ENABLE_AUDIT_LOGGING=true during a cluster deployment is to log metadata about all requests made to the Kubernetes API server. This enables auditing of the cluster activities and helps with security and compliance. The audit logs are stored in /var/log/kubernetes/audit.log on the control plane node and can be accessed by the cluster administrator.  The audit logs are generated based on an audit policy file that defines what events should be recorded and what data they should include 1 2

References:  1 : https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-troubleshooting-tkg-audit-logging.html  2 : https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/

To create a vSphere Namespace, the correct steps are to use the vSphere web client, select Workload Management, select Namespaces tab, and click Create Namespace.  A vSphere Namespace is a logical grouping of Kubernetes resources that can be used to isolate and manage workloads on a Supervisor Cluster 1 .  To create a vSphere Namespace, a user needs to have the vSphere Client and the required privileges to access the Workload Management menu and the Namespaces tab 2 .  From there, the user can select the Supervisor Cluster where to place the namespace, enter a name for the namespace, configure the network settings, set the resource limits, assign permissions, and enable services for the namespace 2 . References:  Create and Configure a vSphere Namespace - VMware Docs ,  vSphere with Tanzu Concepts - VMware Docs

The key benefit of Tanzu Service Mesh Autoscaler feature is to autoscale microservices that meet changing levels of demand based on metrics, such as CPU or memory usage.  These metrics are available to Tanzu Service Mesh without needing additional code changes or metrics plugins 1 .  Tanzu Service Mesh Autoscaler supports configuring an autoscaling policy for services inside a global namespace through the UI or API, or using a Kubernetes custom resource definition (CRD) for services directly in cluster namespaces 2 .  Tanzu Service Mesh Autoscaler also supports two modes: performance mode, where services are scaled up but not down, and efficiency mode, where services are scaled up and down to optimize resource utilization 2 . References:  VMware Aria Operations for Applications ,  Tanzu Service Mesh Service Autoscaling Overview - VMware Docs

To register the vSphere management cluster in VMware Tanzu Mission Control, an administrator can use either the web console or the CLI of VMware Tanzu Mission Control. The web console provides a graphical user interface to perform the registration, while the CLI provides a command-line interface to run a script that automates the registration process. Both methods require the administrator to have access to the vSphere management cluster and to provide some information such as the cluster name, context, and namespace. The registration process creates a service account and a secret in the vSphere management cluster, and generates a kubeconfig file that is used by VMware Tanzu Mission Control to connect to the cluster. References:  VMware Tanzu Mission Control Documentation ,  Registering a vSphere Management Cluster

The command that can be used to upgrade a VMware Tanzu Kubernetes Cluster that is managed by VMware Tanzu Mission Control is tmc cluster upgrade [version] < clustername > .  This command allows you to upgrade a managed cluster to a newer version of Kubernetes that is supported by Tanzu Mission Control 5 . The version flag is optional and specifies the target version of Kubernetes.  If not specified, the command upgrades the cluster to the latest available version 5 .  The clustername argument is required and specifies the name of the cluster to upgrade 5 . References:  Upgrade Kubernetes on Your Cluster - VMware Docs

Two statements about the NSX Advanced Load Balancer are correct:

It can be configured as the VIP endpoint for the management cluster on vSphere. The VIP endpoint is the IP address that clients use to access the Kubernetes API server on the management cluster. By default, this IP address is assigned by DHCP, but it can also be configured manually or by using a load balancer. Using a load balancer provides high availability and scalability for the VIP endpoint.  NSX Advanced Load Balancer can be used as the load balancer provider for the VIP endpoint by creating a virtual service that points to the control plane nodes of the management cluster 5 .

It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere. Workload clusters are Kubernetes clusters that run user workloads on vSphere with Tanzu. Workload clusters require a load balancer to expose services of type LoadBalancer to external clients. NSX Advanced Load Balancer can be used as the load balancer provider for workload clusters by deploying an Avi Kubernetes Service (AKS) pod on each cluster node.  The AKS pod acts as an ingress controller that communicates with the NSX Advanced Load Balancer Controller and creates virtual services for each service of type LoadBalancer 6 .

The other options are incorrect because:

It can only be used if Antrea CNI is installed on the workload cluster is false. Antrea is one of the supported Container Network Interface (CNI) plugins for workload clusters on vSphere with Tanzu, but it is not mandatory to use it with NSX Advanced Load Balancer.  Other CNI plugins, such as Calico or Flannel, can also work with NSX Advanced Load Balancer 7 .

It only supports the service type LoadBalancer is false. NSX Advanced Load Balancer supports other service types as well, such as ClusterIP and NodePort.  These service types can be used to expose services within or across clusters without requiring an external load balancer 8 .

It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments is false. NSX Advanced Load Balancer is not natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments.  Tanzu Kubernetes Grid on AWS uses the AWS Elastic Load Balancing service as the default load balancer provider for both management and workload clusters 9 .

References:  Configure the VIP Endpoint for the Management Cluster ,  Deploy and Configure NSX Advanced Load Balancer as a Load Balancer for Workload Clusters ,  Supported CNI Plugins ,  Service Types ,  Load Balancing on AWS

The statement that correctly describes the Cluster API is that it is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in the Kubernetes ecosystem.  Cluster API is a Kubernetes sub-project that provides declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters 5 . Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects.  Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms 5 . References:  Introduction - The Cluster API Book

Kubernetes services and Contour HTTP Proxy are two resources that External DNS can create records for. External DNS is a Kubernetes controller that synchronizes exposed Kubernetes resources with DNS providers. It supports creating DNS records for Kubernetes services of type LoadBalancer or NodePort, as well as Ingress resources. Contour HTTP Proxy is a custom resource definition (CRD) that provides an alternative way to configure HTTP routes on Kubernetes clusters. External DNS can also create DNS records for Contour HTTP Proxy resources, as long as they have an associated service of type LoadBalancer or NodePort. References:  kubernetes-sigs/external-dns - GitHub ,  Contour HTTPProxy User Guide

vSphere with Tanzu storage policies are converted to storage classes when they are assigned to namespaces.  A storage class is a Kubernetes object that defines a set of parameters for provisioning persistent volumes 1 .  A storage policy is a vSphere object that defines the characteristics of the underlying storage for a given workload 2 .  When a vSphere administrator assigns a storage policy to a namespace, vSphere with Tanzu automatically creates a corresponding storage class in the namespace with the same name as the storage policy 3 .  The storage class references the storage policy ID and allows DevOps engineers to use the storage policy for dynamic provisioning of persistent volumes 3 . References:  Storage Classes - Kubernetes ,  Create Storage Policies for vSphere with Tanzu - VMware Docs ,  Assign Storage Policies to Namespaces - VMware Docs

A Deployment is a Kubernetes object that allows you to perform a rolling update without disrupting services. A Deployment manages a ReplicaSet or a Pod and provides declarative updates for them. You can describe the desired state of your application using a Deployment, and it will change the actual state to the desired state at a controlled rate.  A Deployment also allows you to roll back to a previous version if something goes wrong during the update 14 .

The other options are incorrect because:

A ReplicaSet is a Kubernetes object that ensures that a specified number of pod replicas are running at any given time.  It does not provide any mechanism for updating or rolling back pods 15 .

A Service is a Kubernetes object that defines a logical set of pods and a policy to access them.  It does not provide any mechanism for updating or rolling back pods 16 .

A Container is not a Kubernetes object, but rather a component of a Pod. A Pod is the smallest deployable unit of computing in Kubernetes. A Pod can contain one or more containers that share storage and network resources.  A Pod does not provide any mechanism for updating or rolling back itself or its containers 17 .

References:  Deployments ,  ReplicaSets ,  Services ,  Pods

VMware Tanzu Kubernetes Grid supports StorageClass objects for different storage types, provisioned by Kubernetes internal (“in-tree”) or external (“out-of-tree”) plug-ins. Two of the supported storage types are vSphere Cloud Native Storage (CNS) and Amazon EBS. vSphere Cloud Native Storage (CNS) is a vSphere feature that provides persistent storage for Kubernetes clusters running on vSphere 6.7 or later.  CNS integrates with the vSphere Container Storage Interface (CSI) driver to dynamically provision persistent volumes backed by First Class Disks on a datastore 1 . Amazon EBS is a block storage service that provides persistent storage for Amazon EC2 instances.  EBS volumes can be attached to EC2 instances as block devices, and can be used to create persistent volumes for Kubernetes clusters running on AWS 2 .  Both CNS and EBS support dynamic provisioning of persistent volumes using StorageClass objects with the provisioner field set to csi.vsphere.vmware.com and kubernetes.io/aws-ebs respectively 1 2 . References:  Back Up and Restore Cluster Workloads - VMware Docs ,  Amazon Elastic Block Store (EBS) - Amazon Web Services

Two services that require Transport Layer Security (TLS) certificates to provide encryption in VMware Tanzu Service Mesh are:

Certificate Authority (CA) Service: A service that issues certificates to services in the service mesh to enable mutual TLS (mTLS) communication between them. The CA service uses a root certificate to sign the certificates for the services, and verifies the identity of the services using the certificates.  The CA service also rotates the certificates periodically to ensure security 8 .

Public Service: A service that exposes an internal service in the service mesh to external clients over HTTPS. The public service uses a TLS certificate to encrypt the traffic between the external clients and the internal service, and to authenticate itself to the clients.  The TLS certificate must match the domain name of the public service 9 .

The other options are incorrect because:

Internal Service: A service that runs inside the service mesh and communicates with other services using mTLS.  The internal service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS 10 .

Proxy Service: A service that acts as an intermediary between an internal service and an external service, such as a database or an API. The proxy service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS with the internal service.  The proxy service also uses the external service’s certificate to verify its identity 11 .

External Service: A service that runs outside the service mesh and communicates with an internal service over HTTPS or TCP. The external service does not require a TLS certificate from Tanzu Service Mesh, but rather uses its own certificate to encrypt the traffic with the internal service, and to authenticate itself to the internal service.

References:  Certificate Authority (CA) Service ,  Public Services ,  Internal Services ,  Proxy Services ,

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps:

Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0.  Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator 1

Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls.  The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer 2

References:  1 : https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html  2 : https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html