CKA Certified Kubernetes Administrator (CKA) Program Questions and Answers

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 D.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 E.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 F.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\21 G.JPG

Task Summary

SSH into cka000054

Install a CNI plugin that supports NetworkPolicies

Two CNI options provided:

Flannel v0.26.1 (❌ does NOT support NetworkPolicies)

Calico v3.28.2 ✅ (does support NetworkPolicies)

❗ Decision Point: Which CNI to choose?

✅ Choose Calico, because only Calico supports enforcing NetworkPolicies natively. Flannel does not.

✅ Step-by-Step Solution

1️⃣ SSH into the correct node

ssh cka000054

⚠️ Required. Skipping this results in zero score.

2️⃣ Install Calico CNI (v3.28.2)

Use the official manifest provided:

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml

This installs the Calico Operator, which then deploys the full Calico CNI stack.

3️⃣ Wait for Calico components to come up

Check the pods in tigera-operator and calico-system namespaces:

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

✅ You should see pods like:

calico-kube-controllers

calico-node

calico-typha

tigera-operator

Wait for all to be in Running state.

✅ (Optional) 4️⃣ Confirm CNI is enforcing NetworkPolicies

You can check:

kubectl get crds | grep networkpolicy

You should see:

networkpolicies.crd.projectcalico.org

This confirms Calico ' s CRDs are installed for policy enforcement.

Final Command Summary

ssh cka000054

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

kubectl get crds | grep networkpolicy

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 D.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\3 E.JPG

solution

You must use the kubeadm configuration file located at /etc/kubeadm.conf when initializing

your cluster.

You may use any CNI plugin to complete this task, but if you don ' t have your favourite CNI plugin ' s manifest URL at hand, Calico is one popular option: https://docs.projectcalico.org/v3.14/manifests/calico.yaml

Docker is already installed on both nodes and apt has been configured so that you can install the required tools.

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\14 B.JPG

kubectl get pods -o=jsonpath= " {.items[*][ ' metadata.name '

, ' metadata.namespace ' ]} "

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\10 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\10 C.JPG

kubectl get po nginx -o

jsonpath= ' {.spec.containers[].image}{ " \n " } '

image=nginx, image=redis, image=consul

Name nginx container as “nginx-container”

Name redis container as “redis-container”

Name consul container as “consul-container”

Create a pod manifest file for a container and append container

section for rest of the images

kubectl run multi-container --generator=run-pod/v1 --image=nginx --

dry-run -o yaml > multi-container.yaml

# then

vim multi-container.yaml

apiVersion: v1

kind: Pod

metadata:

labels:

run: multi-container

name: multi-container

spec:

containers:

- image: nginx

name: nginx-container

- image: redis

name: redis-container

- image: consul

name: consul-container

restartPolicy: Always

Task Summary

Create an Ingress named echo in the sound-repeater namespace that:

Routes requests to /echo on host example.org

Forwards traffic to service echoserver-service

Uses service port 8080

Verification should return HTTP 200 using curl

✅ Step-by-Step Answer

1️⃣ SSH into the correct node

As shown in the image:

bash

CopyEdit

ssh cka000024

⚠️ Skipping this will result in a ZERO score!

2️⃣ Verify the namespace and service

Ensure the sound-repeater namespace and echoserver-service exist:

kubectl get svc -n sound-repeater

Look for:

echoserver-service ClusterIP ... 8080/TCP

3️⃣ Create the Ingress manifest

Create a YAML file: echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

4️⃣ Apply the Ingress resource

kubectl apply -f echo-ingress.yaml

5️⃣ Test with curl as instructed

Use the exact verification command:

curl -o /dev/null -s -w " %{http_code}\n " http://example.org/echo

✅ You should see:

200

✅ Final Answer Summary

ssh cka000024

kubectl get svc -n sound-repeater

# Create the Ingress YAML

cat < < EOF > echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

EOF

kubectl apply -f echo-ingress.yaml

curl -o /dev/null -s -w " %{http_code}\n " http://example.org/echo

Kubect1 get po -o wide

Using JsonPath

kubect1 get pods -o=jsonpath= ' {range

items[*]}{.metadata.name}{ " \t " }{.status.podIP}{ " \n " }{end} '

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\12 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\12 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\12 D.JPG

Solution:

kubectl run kucc8 --image=nginx --dry-run -o yaml > kucc8.yaml

# vi kucc8.yaml

apiVersion: v1

kind: Pod

metadata:

creationTimestamp: null

name: kucc8

spec:

containers:

- image: nginx

name: nginx

- image: redis

name: redis

- image: memcached

name: memcached

- image: consul

name: consul

#

kubectl create -f kucc8.yaml

#12.07

Solution:

kubectl get deploy front-end

kubectl edit deploy front-end -o yaml

#port specification named http

#service.yaml

apiVersion: v1

kind: Service

metadata:

name: front-end-svc

labels:

app: nginx

spec:

ports:

- port: 80

protocol: tcp

name: http

selector:

app: nginx

type: NodePort

# kubectl create -f service.yaml

# kubectl get svc

# port specification named http

kubectl expose deployment front-end --name=front-end-svc --port=80 --tarport=80 --type=NodePort

Kubectl logs frontend | grep -i “started” > /opt/error-logs

kubectl run --generator=run-pod/v1 --image=nginx -- labels=env=prod nginx-prod --dry-run -o yaml > nginx-prodpod.yaml Now, edit nginx-prod-pod.yaml file and remove entries like “creationTimestamp: null” “dnsPolicy: ClusterFirst”

vim nginx-prod-pod.yaml

apiVersion: v1

kind: Pod

metadata:

labels:

env: prod

name: nginx-prod

spec:

containers:

- image: nginx

name: nginx-prod

restartPolicy: Always

# kubectl create -f nginx-prod-pod.yaml

kubectl run --generator=run-pod/v1 --image=nginx --

labels=env=dev nginx-dev --dry-run -o yaml > nginx-dev-pod.yaml

apiVersion: v1

kind: Pod

metadata:

labels:

env: dev

name: nginx-dev

spec:

containers:

- image: nginx

name: nginx-dev

restartPolicy: Always

# kubectl create -f nginx-prod-dev.yaml

Verify :

kubectl get po --show-labels

kubectl get po -l env=prod

kubectl get po -l env=dev

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\1 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\1 C.JPG

Step 0: Set the correct Kubernetes context

If you ' re given a specific context (k8s in this case), you must switch to it:

kubectl config use-context k8s

⚠️ Skipping this can cause you to work in the wrong cluster/namespace and cost you marks.

Step 1: Identify the namespace of the pod foo

First, check if foo is running in a specific namespace or in the default namespace.

kubectl get pods --all-namespaces | grep foo

Assume the pod is in the default namespace if no namespace is mentioned.

Step 2: Confirm pod foo exists and is running

kubectl get pod foo

You should get output similar to:

NAME READY STATUS RESTARTS AGE

foo 1/1 Running 0 1h

If the pod is not running, logs may not be available.

Step 3: View logs and filter specific error lines

We’re looking for log lines that contain:

unable-to-access-website

Command:

kubectl logs foo | grep " unable-to-access-website "

Step 4: Write the filtered log lines to a file

Redirect the output to the required path:

kubectl logs foo | grep " unable-to-access-website " > /opt/KULM00201/foo

✅ This creates or overwrites the file /opt/KULM00201/foo with the filtered logs.

???? You may need sudo if /opt requires elevated permissions. But in most exam environments, you ' re already the root or privileged user.

Step 5: Verify the output file (optional but smart)

Check that the file was created and has the correct content:

cat /opt/KULM00201/foo

✅ Final Answer Summary:

kubectl config use-context k8s

kubectl logs foo | grep " unable-to-access-website " > /opt/KULM00201/foo

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\19 B.JPG

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\7 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\7 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\7 D.JPG

kubectl get pods --sort-by=.metadata.name

kubectl run busybox --image=busybox --restart=Never -- /bin/sh -c

" sleep 3600 "