NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

The NKPA course explains that upgrading an NKP license to the Ultimate tier unlocks advanced features such as fleet management, air-gapped deployments, and additional platform services (e.g., monitoring, logging, backup/restore). These services are deployed on the Management cluster and require sufficient resources to operate effectively. A key prerequisite is to size the Control Plane nodes appropriately to support the installation of default platform services (Option C).

The Control Plane nodes in the NKP Management cluster run critical components like the API server, controller manager, and Kommander, as well as platform services such as Prometheus, Grafana Loki, and Velero. The Ultimate license increases resource demands due to the expanded functionality, and undersized Control Plane nodes can lead to performance issues or failed deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before upgrading to an NKP Ultimate license, ensure the Control Plane nodes of the Management cluster are sized appropriately (e.g., sufficient CPU, memory, and storage) to support the additional default platform services enabled by the license.” For example, Control Plane nodes might need to be scaled to at least 4 vCPUs and 16 GB RAM, depending on the workload.

Incorrect Options:

A. Size the Sidecar containers appropriately: Sidecar containers are typically used for specific workloads (e.g., logging agents), not for platform services deployment, and are not a licensing prerequisite.

B. Size the ETCD nodes appropriately: While etcd is part of the Control Plane, the course refers to the Control Plane nodes as a whole, not etcd specifically, as the sizing requirement.

D. Size the Worker nodes appropriately: Worker nodes run user workloads, not the platform services, which are deployed on the Control Plane in the Management cluster.

When attaching an Amazon EKS cluster to NKP for fleet management, persistent volume (PV) errors during application deployments often indicate issues with storage configuration. The NKPA course identifies a common cause: the absence of a default StorageClass. Kubernetes requires a default StorageClass to automatically provision PVs for PersistentVolumeClaims (PVCs) when none is specified. Without a default, applications fail to bind PVCs, resulting in deployment errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For attached EKS clusters, ensure a default StorageClass is configured to support dynamic provisioning of persistent volumes. Review existing StorageClasses and set one as default using the storageclass.kubernetes.io/is-default-class annotation.” The engineer should run kubectl get storageclass to list available StorageClasses, verify their configurations, and set one as default by patching it with kubectl patch storageclass -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'. In EKS, the default StorageClass is typically backed by Amazon EBS (e.g., gp2 or gp3).

Incorrect Options:

A. The storage appliance is having issues: This assumes a hardware issue, which is not indicated by PV errors. The NKPA course suggests checking Kubernetes configurations first.

B. There is no compatible storage: EKS supports EBS and EFS, which are compatible with NKP. The issue is likely configuration, not compatibility.

D. There could be a misconfiguration in the ConfigMap: ConfigMaps are not directly related to PV provisioning. The NKPA course points to StorageClass issues for PV errors.

As per the NKPA 6.10 documentation, the correct approach for deleting an entire NKP-managed cluster (including nodes and deployed applications) is to use the nkp delete cluster command with the cluster name and --kubeconfig parameter. The --self-managed flag ensures the deletion of resources provisioned by the cluster.

Exact extract:

“Use nkp delete cluster --cluster-name= --self-managed --kubeconfig= to delete a cluster and its associated resources.”

For deployments in air-gapped environments where there is no external Internet connectivity, the --airgapped parameter is required. This instructs the NKP deployment to rely solely on internal resources, using pre-staged images and local container registries, ensuring that no external network dependencies cause deployment failures.

According to the NKPA 6.10 documentation, the Pre-provisioned infrastructure provider (CAPPP) requires the user to provide an inventory file of the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

The NKPA course explains the role of a bootstrap cluster in NKP deployments, particularly in hybrid architectures involving Nutanix on-prem and Amazon EKS. A bootstrap cluster is a temporary Kubernetes cluster created during the deployment process to initialize Cluster API (CAPI) components, which manage the lifecycle of the target NKP clusters. The primary function of the bootstrap cluster is to use Cluster API for infrastructure-agnostic provisioning (Option D).

CAPI enables NKP to provision clusters across different infrastructures (e.g., Nutanix AHV, AWS EKS) in a consistent, infrastructure-agnostic manner. The bootstrap cluster runs the CAPI controllers (e.g., CAPX for Nutanix, CAPA for AWS) that orchestrate the creation of the target clusters, abstracting the underlying infrastructure details. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The bootstrap cluster in NKP uses Cluster API to provide infrastructure-agnostic provisioning, enabling consistent cluster creation across diverse environments like Nutanix AHV and Amazon EKS.” This ensures that the same CAPI-based workflow can deploy clusters on both on-prem Nutanix and cloud-based EKS.

Incorrect Options:

A. Increases security from a single point of entry: A bastion host, not a bootstrap cluster, provides a single point of entry for security. The bootstrap cluster is temporary and focuses on provisioning.

B. Simplifies the networking requirements for Kubernetes: Networking is managed by the target cluster’s CNI (e.g., Calico), not the bootstrap cluster.

C. Saves cost by minimizing resources required for provisioning: The bootstrap cluster is temporary and does not significantly impact costs; its purpose is provisioning, not cost-saving.

The exhibit indicates an error during the creation of a bootstrap cluster using the nkp create bootstrap command in an air-gapped environment. The NKPA course explains that a bootstrap cluster is a temporary Kubernetes cluster used to initialize Cluster API (CAPI) components for provisioning the target NKP cluster. In an air-gapped environment, all required resources, including container images, must be available locally since there is no Internet access to pull them from public registries.

The most likely reason for the error is that the bootstrap cluster image needs to be loaded prior to creating the bootstrap cluster (Option B). The course specifies that in air-gapped deployments, the bootstrap cluster image (typically a kind or k3s image used by CAPI) must be pre-loaded into a local container registry or the bastion host before running nkp create bootstrap. This image is part of the Air-Gapped Bundle provided by Nutanix, which includes all necessary container images for NKP deployment. Without pre-loading this image, the nkp create bootstrap command fails because it cannot pull the required image.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In an air-gapped NKP deployment, ensure the bootstrap cluster image (e.g., kindest/node) is loaded into a local registry or host before executing nkp create bootstrap, as the command requires this image to create the temporary cluster.” The engineer must extract the bootstrap image from the Air-Gapped Bundle, load it using docker load or similar, and configure the local registry to make it accessible during the bootstrap process.

Incorrect Options:

A. The CAPI provisioning method needs to be specified as nkp create bootstrap nutanix: The nkp create bootstrap command does not require a provisioning method like nutanix at this stage; the provider (e.g., CAPX for Nutanix) is specified during the actual cluster creation (nkp create cluster), not bootstrap creation.

C. The Ubuntu 22.04 OS image needs to be NIB-prepped prior to creating the bootstrap: The Ubuntu 22.04 image is for the target NKP cluster nodes, not the bootstrap cluster, which uses a pre-built image (e.g., kind). NIB-prepping this image is a later step.

D. The nkp create bootstrap command needs to be executed as root: While some commands may require elevated privileges, the NKPA course does not specify that nkp create bootstrap must be run as root. The error is more likely related to missing images in an air-gapped setup.

The documentation confirms that when a new license is activated to upgrade to a higher tier, users must log out and log back in for the license changes to take effect. This ensures that updated entitlements are loaded into the UI and CLI environment.

Exact extract from documentation:

“After applying a new license for a higher-tier product, log out and log back in to see and activate the newly available features.”

The NKPA course specifies that the Nutanix Image Builder (NIB), used for creating custom machine images for NKP cluster nodes, supports specific Linux distributions that are compatible with Nutanix infrastructure and Kubernetes requirements. For NKP v2.12.x, the supported distributions for NIB are Ubuntu and Rocky Linux, as these are tested and optimized for NKP deployments, ensuring stability and compatibility with Cluster API (CAPI) and Nutanix AHV.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Image Builder (NIB) supports Ubuntu and Rocky Linux as base distributions for creating custom images for NKP cluster nodes, ensuring compatibility with Kubernetes and Nutanix infrastructure.” Ubuntu provides a widely-used, well-supported base with long-term support (LTS) versions, while Rocky Linux is a CentOS replacement that Nutanix has adopted for its reliability and enterprise focus, especially after CentOS 8’s end-of-life in 2021.

Incorrect Options:

B. Fedora: Fedora is not a supported distribution for NIB in NKP, as it is more suited for bleeding-edge development rather than production Kubernetes environments.

D. CentOS: CentOS 8 reached end-of-life in December 2021, and Nutanix has shifted to Rocky Linux as its replacement for NKP image building. The course does not list CentOS as a supported option for NIB in NKP v2.12.x.

The NKPA course recommends using a S3-compatible API for backup and restore operations in production NKP environments, as it integrates with Velero, NKP’s backup and restore tool. Velero supports S3-compatible storage (e.g., AWS S3, Nutanix Objects, or MinIO) as a backup storage location, allowing persistent data, including volumes and cluster resources, to be backed up and restored during disaster recovery scenarios. This approach ensures compatibility with cloud-native backup workflows and provides scalability and reliability for production use cases.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For production backup and restore in NKP, use Velero with an S3-compatible API to store backups, ensuring persistent data availability during disaster recovery.” Nutanix Objects, which provides an S3-compatible API, is often used in Nutanix environments for this purpose, but any S3-compatible storage (e.g., an off-site S3 bucket) can be configured.

Incorrect Options:

A. Protection Domain: Protection Domains are a Nutanix AOS feature for VM-level replication, not for Kubernetes backup/restore.

B. Rook Ceph: Rook Ceph provides persistent storage for NKP clusters but is not a backup solution; it can be backed up using Velero with S3 storage.

C. External Storage Class: Storage Classes define how volumes are provisioned, not how they are backed up or restored.

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools like Packer to build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is to rerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

As per the NKPA 6.10 documentation, the standard and supported approach for installing Kommander on an NKP cluster is using the NKP CLI. The CLI provides commands for deploying Kommander and associated platform components as part of the cluster lifecycle management workflow.

Key Reference:

“The recommended approach to deploy Kommander is by using the nkp CLI, which ensures compatibility and streamlined installation with the rest of the Nutanix Kubernetes Platform stack.”

The NKPA course explains that NKP’s fleet management capabilities allow centralized policy federation and management of multiple Kubernetes clusters from a single pane of glass, while workspaces provide isolation for different teams or groups. To meet the requirement of federating policy while separating clusters by group, the IT team needs the NKP Ultimate license, which includes advanced fleet management features.

With NKP Ultimate, the IT team can:

Create three workspaces (one for each group: Fin VD, Fin Insurance, Fin Travel).

Assign the corresponding Kubernetes clusters to each workspace, ensuring isolation between groups.

Use NKP’s fleet management to apply policies (e.g., RBAC, monitoring, logging) across all clusters from a single pane of glass, such as the NKP UI or CLI.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Ultimate provides fleet management for centralized policy federation across multiple clusters, using workspaces to isolate clusters for different teams or groups.” This setup ensures that each group’s clusters are separated while maintaining centralized policy management, aligning with the IT team’s requirements.

Incorrect Options:

B. NKP Starter: The Starter license lacks fleet management and workspace isolation features, making it unsuitable for this scenario.

C. NKP Pro with projects: Projects are sub-divisions within workspaces for resource allocation, not for cluster isolation or fleet management. NKP Pro may not include full fleet management capabilities.

D. NKP Pro with workspaces: While NKP Pro supports workspaces, it may not provide the full fleet management needed for centralized policy federation across all clusters. NKP Ultimate is the better fit.

The Secure Tunnel feature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

The primary benefit of a private registry is to ensure security and privacy for container images, especially when dealing with sensitive data and compliance requirements (such as financial or government use cases). While secure connections to public registries like DockerHub or GitHub container registries are possible, using a private registry ensures full control over image access and auditing.

Key reference:

“Private registries ensure images remain within the security and compliance boundaries of the enterprise, avoiding potential risks associated with public SaaS registries.”

For deploying NKP clusters in AWS, setting the AWS_REGION environment variable is a key prerequisite to ensure that the AWS CLI and underlying deployment scripts know which region to target. This is essential for provisioning instances using the specified AMI.

Exact extract:

“Set the AWS_REGION environment variable to the appropriate region prior to deploying clusters to ensure proper interaction with the AWS API.”

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the --to-registry option, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”