NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the--to-registryoption, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”

TheNKPA 6.10 documentationclarifies that when creating a workload cluster using the nkp create cluster command, specifying the target workspace (namespace) is critical for properly associating the workload cluster with that workspace in the NKP UI. If the --namespace parameter is omitted, the cluster is provisioned in the default workspace, not in the intended workspace (in this case, code-green).

Key documentation excerpt:

“If you do not specify the workspace (namespace) using the --namespace parameter when creating a cluster, the cluster will be created in the default workspace. It will not appear in custom workspaces until manually assigned.”

TheNKPA 6.10 documentationconfirms thatVelerois the built-in backup and recovery solution provided as part of the NKP platform. It provides cluster-level and namespace-level backup, restore, and migration capabilities.

Exact extract from the documentation:

“Velero is the integrated, out-of-the-box backup and restore solution in NKP. It supports scheduled backups, disaster recovery, and application migration workflows.”

TheSecure Tunnelfeature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

The exhibit shows the NKP UI with a list of clusters, including "arca," "demo," and "production," each with a three-dot menu on the right side. The NKPA course explains that to delete a cluster directly from the NKP UI, the engineer should use theDeleteoption available in the cluster’s three-dot menu. This action initiates the deletion process, removing the cluster from NKP management and freeing up any associated licenses (e.g., CPU core-based licenses, as per NKP licensing).

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To delete a cluster in NKP via the UI, navigate to the cluster list, click the three-dot menu for the target cluster (e.g., demo), and select ‘Delete’ to remove the cluster and its resources.” The UI in the exhibit aligns with this process, showing the three-dot menu next to the "demo" cluster, which includes the Delete option. This is the most straightforward method to delete the demo cluster and reallocate resources to the arca cluster.

Incorrect Options:

A. Download kubeconfig and use kubectl delete cluster: kubectl delete cluster is not a valid command for deleting NKP clusters. NKP uses the nkp CLI or UI for cluster deletion.

C. Select Detach and ask the cluster owner to delete: Detach is for external clusters (e.g., EKS), not NKP-managed clusters like "demo," which is on Nutanix infrastructure. Detaching does not delete the cluster.

D. SSH to kommander cluster and execute kubectl delete cluster: Kommander is a management component, but kubectl delete cluster is not a valid command for NKP cluster deletion.

As per theNKPA 6.10 documentationand cluster autoscaler behavior, when nodes are scaled down in NKP (or any CAPI-managed environment), the node isdeletedfrom the infrastructure provider (vSphere, AWS, Nutanix, etc.). This effectively removes it from both the cluster and the underlying hypervisor or cloud provider, thus freeing up resources and reducing costs.

The NKPA course explains that deleting a workspace in NKP, especially after all associated clusters have been removed, is a straightforward process through the NKP UI. The correct method is to navigate to theGlobalview in the top menu bar, selectWorkspacesfrom the menu, locate the target workspace, click thethree-dot buttonnext to it, and selectDelete. This action removes the workspace and its associated configurations from NKP, ensuring a clean environment after the project is finished.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To delete an empty workspace in NKP, go to the Global view in the UI, select Workspaces, click the three-dot menu for the workspace, and choose Delete.” The course confirms that a workspace must be empty (no clusters or resources) before it can be deleted, which aligns with the scenario where the three clusters have already been removed.

Incorrect Options:

A & B. Run kubectl delete workspace: Both options are syntactically similar, but kubectl delete workspace is not a valid command in NKP. Workspaces are managed through the NKP UI or CLI (nkp), not directly via kubectl.

D. Ask a workspace user to delete the workspace: Workspace users typically lack permissions to delete workspaces; this action is reserved for administrators via the Global view.

When an attached cluster (e.g., an external cluster like EKS) is stuck in a 'deleting' state in the NKP UI, it indicates an issue with the reconciliation process in the NKP management cluster. The NKPA course explains that attached clusters are represented in NKP as KommanderCluster custom resources in the management cluster. To resolve a stuck deletion, the engineer must manually delete the KommanderCluster resource using kubectl in the context of the NKP management cluster.

The correct command iskubectl delete kommandercluster, executed in the context of the NKP management cluster (not the attached cluster). For example: kubectl delete kommandercluster -n . The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “If an attached cluster is stuck in a ‘deleting’ state, delete the corresponding KommanderCluster resource in the NKP management cluster using kubectl delete kommandercluster to remove it from management.” This ensures the cluster is fully detached and removed from the UI.

Incorrect Options:

A. kubectl delete cluster: There is no cluster resource type in this context; the correct resource is kommandercluster.

B. nkp delete kommandercluster: The nkp CLI does not have a delete kommandercluster subcommand.

D. nkp delete cluster in the attached cluster: This command is for deleting NKP-managed clusters, not detaching external clusters, and it should be run from the management cluster context.

According to theNKPA 6.10 documentation, the critical system components for NKP nodes are:

kubelet

containerdThese components are deployed in the standard Linux path:/var/lib.

Exact extract from the documentation:

“The kubelet and containerd services require disk space in /var/lib on the host operating system. It’s essential to allocate sufficient storage in /var/lib to accommodate these core Kubernetes components.”

Comprehensive and Detailed Explanation:

The correct procedure for deleting an NKP cluster involves using the nkp delete cluster command with the appropriate cluster name and namespace. This ensures that not only the Kubernetes resources but also the corresponding NKP resources (e.g., nodepools, Kommander integration) are deleted cleanly and consistently. Simply deleting the VMs does not clean up the associated NKP management objects. This approach is detailed in the NKP documentation for cluster lifecycle management, emphasizing the need to use the provided CLI commands for full removal.

Comprehensive and Detailed Explanation:

Both the Konvoy Image Builder (KIB) and the Nutanix Image Builder (NIB) are included tools used to create and manage custom OS images suitable for NKP deployments. KIB is responsible for building images that conform to the standards required by Konvoy-based environments, while NIB is designed for direct integration with the Nutanix AHV infrastructure. These tools support automated preparation, hardening, and upload of images to the appropriate repositories.

As per theNKPA 6.10 documentationunder “NKP Insights Prerequisites”, one of the essential requirements for deploying NKP Insights is thatcert-manageris installed and properly configured in the target workload cluster. Cert-manager provides the necessary certificates for secure communication and observability between the cluster components and the NKP Insights platform.

The documentation specifies:

“NKP Insights requires cert-manager to be installed on the target workload cluster. If cert-manager is not enabled, the cluster will be shown as unavailable (grayed out) for NKP Insights deployment.”

Without cert-manager, the Insights operator cannot validate or securely deploy its components, resulting in the cluster being unavailable for selection during the Insights enablement process.

As stated in theNKPA 6.10 documentation, when using external storage (such as AWS S3) withLokifor log storage, AWS credentials must be provided securely. This typically involves creating a KubernetesSecretcontaining the static AWS credentials (access key ID and secret access key), which are referenced in the override ConfigMap to authenticate Loki’s S3 storage backend.

Key reference from documentation:

“For Loki to store logs in an S3 bucket, AWS credentials must be created as a Kubernetes secret and referenced in the storage configuration.”

The NKPA course explains that NKP supports auto-scaling for clusters using Cluster API (CAPI), which manages the lifecycle of Kubernetes nodes. When auto-scaling is enabled, NKP monitors cluster workloads and automatically adjusts the number of nodes based on demand. The behavior involvesCAPI creating or deleting nodesas needed to scale the cluster up or down, ensuring optimal resource utilization.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP auto-scaling uses Cluster API to dynamically create or delete nodes in response to workload demands, ensuring the cluster scales efficiently.” For example, if the workload increases, CAPI provisions additional worker nodes; if demand decreases, CAPI deletes nodes to reduce costs.

Incorrect Options:

A. CPU is hot-added or hot-removed: Hot-adding/removing CPU is not a Kubernetes auto-scaling behavior; scaling involves adding/removing nodes.

B. Memory is hot-added or hot-removed: Similar to CPU, memory scaling at the node level is not supported in this context.

C. Power-On Status/Mode of a node is changed: Auto-scaling does not involve changing node power states; it adds or removes nodes.

Comprehensive and Detailed Explanation From General Kubernetes Knowledge:

Since this question involves AWS EKS and Azure AKS specifics outside the NKP context, and web search is unavailable, I will rely on general Kubernetes knowledge as of my last update. Using a custom image for EKS and AKS worker nodes means replacing the default, optimized images provided by AWS and Azure, which are pre-configured with components tailored for their managed Kubernetes services.

The primary functionality lost by using a custom image in both EKS and AKS isbuilt-in autoscaling and security capabilities(Option C):

Autoscaling: Both EKS and AKS rely on their default node images to integrate with their native autoscaling mechanisms, such as the EKS Cluster Autoscaler (which uses AWS Auto Scaling Groups) and AKS Cluster Autoscaler (which integrates with Azure Virtual Machine Scale Sets). Custom images may lack the necessary agents or configurations (e.g., AWS SSM Agent, Azure VM extensions) to communicate with these autoscaling services, requiring manual configuration.

Security Capabilities: Default images include pre-configured security features, such as AWS’s integration with IAM roles for service accounts (IRSA) and Azure’s integration with Azure Active Directory (AAD) for RBAC. Custom images may not include these integrations, potentially breaking security features like automatic credential rotation or managed identity support unless manually configured.

Incorrect Options:

A. Native monitoring tools, logging, and alerting: Monitoring and logging (e.g., AWS CloudWatch, Azure Monitor) are managed at the control plane level, not the node image level, so these features are generally unaffected by custom images.

B. Cluster networking and load balancing: Networking (e.g., AWS VPC CNI, Azure CNI) and load balancing (e.g., AWS ALB, Azure Load Balancer) are configured by the control plane and CNI plugins, not the node image.

D. Ability to use GPUs and persistent storage: GPU support and persistent storage (e.g., EBS, Azure Disk) depend on drivers and CSI plugins, which can be installed on custom images without losing functionality.

In an air-gapped NKP installation, the engineer starts with the NKP Air-Gapped Bundle, a tarball containing all necessary components (e.g., container images, binaries, configuration files) for deployment without Internet access. The NKPA course specifies that the first step is to extract this bundle on the bastion host to make its contents available for the installation process. The correct command istar -xzvf nkp-air-gapped-bundle_v2.12.0_linux_amd64.tar.gz, which extracts the bundle into a directory, revealing the container images, CLI tools, and other resources needed for the deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To begin an air-gapped NKP installation, first extract the NKP Air-Gapped Bundle using tar -xzvf .tar.gz on the bastion host to access the installation artifacts.” After extraction, the engineer can proceed with loading container images (e.g., using docker load) and running NKP CLI commands to deploy the cluster, ensuring all dependencies are available locally.

Incorrect Options:

A. nkp push bundle --bundle: This is not a valid command. The bundle must be extracted before its contents can be used.

B. docker load -i konvoy-bootstrap-image-v2.12.0.tar: Loading the bootstrap image is a subsequent step after extracting the bundle, which contains this image tarball.

D. nkp create cluster nutanix: This command creates a cluster but cannot be run until the bundle is extracted and its images are loaded.

When deploying NKP to AWS, the bootstrap process requires AWS credentials to interact with AWS APIs for provisioning resources like EC2 instances. The NKPA course specifies that the nkp CLI supports the --aws-profile flag to specify a custom AWS profile for authentication. This profile, defined in the AWS credentials file (~/.aws/credentials), contains the access key and secret key for the desired AWS account.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy NKP on AWS with custom credentials, use the --aws-profile= flag during the nkp create bootstrap command to reference a specific AWS profile.” This approach leverages the AWS CLI’s profile management, ensuring secure and flexible credential handling. For example, the command would be nkp create bootstrap --aws-profile=my-profile --kubeconfig bootstrap-cluster.conf.

Incorrect Options:

B. --cloud-credentials=<my-profile></my-profile>: This flag is not used by the nkp CLI. The NKPA course specifies --aws-profile for AWS.

C. --with-aws-bootstrap-credentials=true: This flag does not exist in the NKPA documentation for NKP bootstrap.

D. --aws-access-key=<aws access="" key=""> --aws-secret-key=<aws secret="" key=""></aws></aws>: While these flags may be used in some tools, the NKPA course recommends using --aws-profile to avoid hardcoding sensitive credentials.

Comprehensive and Detailed Explanation:

The NKP Pro licensing tier includes Fleet Management, which enables centralized lifecycle management of multiple Kubernetes clusters. This feature is critical for managing larger environments, providing visibility and control over fleet-wide configurations and updates. Other features, like AI OPS and advanced observability, are typically associated with higher tiers (e.g., Ultimate).

The kube-prometheus-stack is a key component of NKP’s monitoring stack, providing tools for metrics collection, visualization, and alerting. The NKPA course explains thatAlertmanager, a component of the kube-prometheus-stack, is responsible for handling alerts generated from Prometheus metrics. It aggregates, deduplicates, and routes notifications to the appropriate channels (e.g., email, Slack, PagerDuty), ensuring that the Platform Engineer stays informed of critical events and anomalies in the NKP cluster, such as node failures, resource exhaustion, or application errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Alertmanager in the kube-prometheus-stack processes alerts from Prometheus, enabling administrators to stay informed of cluster events through configured notification channels.” By configuring Alertmanager with appropriate routing rules and receivers, the engineer can receive real-time notifications about cluster events, driving proactive management and productivity.

Incorrect Options:

A. prometheus-operator: The operator manages Prometheus and related resources but does not directly handle event notifications.

B. service monitors: Service monitors define how Prometheus scrapes metrics, not how events are communicated.

D. node-exporter: Node-exporter collects node-level metrics, not event notifications.

The exhibit shows a YAML manifest for a NodeGroup resource that has autoscaler-related annotations:

yaml

Copy

cluster.x-k8s.io/cluster-api-autoscaler-node-group-min-size: "3"

cluster.x-k8s.io/cluster-api-autoscaler-node-group-max-size: "15"

According to theNKPA 6.10 documentation, these annotations configure theminimumandmaximumnumber of nodes for the autoscaler in the specified NodeGroup. The autoscaler will ensure the number of nodes never goes below the minimum (3) and never exceeds the maximum (15).

Key Reference:

"The cluster-autoscaler will scale the NodeGroup up to the maximum size and down to the minimum size based on workload requirements."

The error states:

lua

Copy

Could not find or access '/home/.../nkp-image-builder-.../playbooks/.../artifacts/1.29.6_ubuntu_22.04_x86_64.tar.gz'

This indicates that theOS package bundle(artifacts/1.29.6_ubuntu_22.04_x86_64.tar.gz) has not been created or is missing. Creating the OS package bundle is a prerequisite step in the NIB workflow.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Creating OS Package Bundles for NIB”

NCP-CN 6.10 Study Guide – “NIB Preparation Prerequisites”

=======

According to theNKPA 6.10 documentationunder the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools likePackerto build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is torerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

To push the NKP Catalog Applications image bundle to a private registry, the officialnkp push bundlecommand must be used with the specified parameters to authenticate and push the bundle to the registry.

Exact extract:

“Use the nkp push bundle command to upload the NKP catalog applications image bundle to the specified private registry, ensuring secure and complete image upload.”

NKPA 6.10recommends leveragingworkspacesto isolate different tenants (clients) in a multi-tenant environment. LDAP connectors can be scoped to individual workspaces, allowing separate authentication and RBAC configurations per client.

Key reference from documentation:

“In multi-tenant scenarios, create a dedicated workspace for each tenant and configure a unique LDAP connector within that workspace to integrate their identity source.”

The error states:

pgsql

Copy

error upgrading CAPI components: unable to upgrade CAPI components: deployment "capp-controller-manager" is not ready after 10m0s: failed to connect to the management cluster: context deadline exceeded

This clearly points to connectivity issues between the VM (or nodes) and themanagement cluster, typically caused byregistry communication issuesin air-gapped or private environments. When the VM cannot connect to the registry to pull required images or configuration, the CAPI (Cluster API) components cannot be initialized, causing a timeout.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Air-Gapped and Registry Communication Issues”

NCP-CN 6.10 Study Guide – “Cluster API Upgrade Process and Network Prerequisites”

=======

As outlined in theNKPA 6.10 documentation,Gossis used tovalidatethat an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”