NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

Attaching an existing Amazon EKS cluster to NKP for fleet management involves integrating the cluster into NKP’s management plane, which requires specific preparatory steps. The NKPA course outlines that the first step is to create a service account with cluster-admin permissions in the EKS cluster. This service account is used by NKP to authenticate and manage the cluster, enabling operations like monitoring, scaling, and application deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide explains: “To attach an external Kubernetes cluster, such as Amazon EKS, to NKP, a service account with cluster-admin role bindings must be created to allow NKP to interact with the cluster’s API server.” The service account is configured with a token that NKP uses to authenticate requests. The NKPA course provides detailed steps, including creating the service account, assigning the cluster-admin ClusterRole, and generating a token for NKP integration. This step is critical to ensure NKP has the necessary permissions to manage the EKS cluster.

Incorrect Options :

A. Configure a ConfigMap according to EKS configuration : While ConfigMaps may be used for specific configurations, they are not the first step for attaching an EKS cluster. The NKPA course prioritizes service account creation.

C. Configure HAProxy to get connected to EKS clusters : HAProxy is a load balancer, not required for attaching EKS clusters to NKP. EKS uses AWS-native load balancers, and NKP connects via the Kubernetes API.

D. Deploy cert-manager in the EKS clusters : Cert-manager is used for certificate management, not a prerequisite for attaching EKS clusters. The NKPA course does not list it as a required step.

The NKPA course addresses resource contention in Kubernetes clusters, where one application (e.g., ApplicationB) consumes excessive resources, impacting others (e.g., ApplicationA). To mitigate this, the course recommends implementing Quotas and Limit Ranges .

Resource Quotas restrict the total amount of CPU, memory, and other resources a namespace can consume, ensuring fair resource allocation across teams.

Limit Ranges set minimum and maximum resource limits for individual pods and containers within a namespace, preventing any single application from monopolizing resources.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To prevent resource contention in NKP clusters, apply Resource Quotas to limit namespace resource usage and Limit Ranges to enforce pod and container resource boundaries.” For example, the administrator can create a ResourceQuota to cap ApplicationB’s namespace resource usage and a LimitRange to restrict its pod resource requests/limits, ensuring ApplicationA has sufficient resources.

Incorrect Options :

B. Setting up Network Policies : Network Policies control network traffic, not resource usage.

C. Configuring RBAC : RBAC manages access permissions, not resource allocation.

D. Implementing Continuous Deployment (CD) : CD automates deployments but does not address resource contention.

The NKPA 6.10 documentation outlines that in air-gapped environments where default pod network CIDR conflicts exist, the cluster manifest (created via the nkp create cluster command) should be updated to specify an alternate, non-conflicting pod CIDR block range before deployment.

The NKPA course explains that NKP provides a role-based access control (RBAC) system to manage permissions within its platform, in addition to Kubernetes-native RBAC. For a development team needing limited permissions to perform specific tasks (deploying applications, scaling deployments, viewing logs and metrics) within a specific namespace, the appropriate access type in the NKP GUI is an NKP Role .

NKP Roles are predefined or custom roles within the NKP platform that map to Kubernetes RBAC permissions but are managed through the NKP UI for ease of use. They allow granular control over actions within a workspace or namespace, ensuring the team can perform their tasks (e.g., deploy, scale, get logs) without having access to other environments or cluster-wide resources. For example, an NKP Role like “Developer” or a custom role can be configured to grant edit permissions in the team’s namespace while restricting access elsewhere. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In the NKP GUI, configure an NKP Role to grant limited permissions to a development team, allowing actions like deploying applications and viewing logs within their namespace while preventing unauthorized changes in other environments.”

Incorrect Options :

B. Cluster Role : A Kubernetes Cluster Role grants permissions across all namespaces, which is too broad for the team’s limited access requirement.

C. Cluster Admin : This grants full administrative access to the entire cluster, far exceeding the team’s needs and violating the principle of least privilege.

D. Kommander Role : Kommander is a management component in NKP, but “Kommander Role” is not a specific access type in the NKP GUI for this purpose.

When an attached cluster (e.g., an external cluster like EKS) is stuck in a ' deleting ' state in the NKP UI, it indicates an issue with the reconciliation process in the NKP management cluster. The NKPA course explains that attached clusters are represented in NKP as KommanderCluster custom resources in the management cluster. To resolve a stuck deletion, the engineer must manually delete the KommanderCluster resource using kubectl in the context of the NKP management cluster.

The correct command is kubectl delete kommandercluster , executed in the context of the NKP management cluster (not the attached cluster). For example: kubectl delete kommandercluster < cluster-name > -n < namespace > . The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “If an attached cluster is stuck in a ‘deleting’ state, delete the corresponding KommanderCluster resource in the NKP management cluster using kubectl delete kommandercluster to remove it from management.” This ensures the cluster is fully detached and removed from the UI.

Incorrect Options :

A. kubectl delete cluster : There is no cluster resource type in this context; the correct resource is kommandercluster.

B. nkp delete kommandercluster : The nkp CLI does not have a delete kommandercluster subcommand.

D. nkp delete cluster in the attached cluster : This command is for deleting NKP-managed clusters, not detaching external clusters, and it should be run from the management cluster context.

The NKPA 6.10 documentation confirms that the proper method to customize application deployment (including disabling Velero) is by generating a configuration file using the nkp install kommander --init command. The file can then be modified to set custom specs and disable Velero, and finally deployed using the nkp install kommander command.

Exact extract:

“Generate a custom configuration file using --init, modify it for your specific environment (including disabling Velero), and deploy with the same nkp install kommander command.”

The NKPA course clarifies that NKP licenses are based on the number of CPU cores in the infrastructure hosting the Kubernetes clusters. This licensing model applies to both on-premises (e.g., Nutanix AHV) and cloud-based deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP licenses are obtained based on the total number of CPU cores allocated to the clusters managed by the platform.” This core-based licensing ensures flexibility across different infrastructure types while aligning with the resource consumption of Kubernetes workloads.

Incorrect Options :

A. Flash : Flash storage is not a licensing unit for NKP.

B. CPU Sockets : Nutanix licenses for other products may use sockets, but NKP uses cores.

C. TiBs : Terabytes are used for storage licensing, not NKP.

The Nutanix Kubernetes Platform (NKP) is designed to simplify the deployment and management of Kubernetes clusters on Nutanix infrastructure, including on-premises AHV-based clusters in dark site environments with no Internet connectivity. The requirements specified in the question—dark site, Nutanix-provided Rocky Linux VM image, and AHV-based cluster—point to a deployment scenario where the environment must be self-contained and rely on Nutanix-specific tools and resources to meet the air-gapped constraints.

According to the Nutanix Kubernetes Platform Administration (NKPA) course, deploying NKP in a dark site environment requires specific prerequisites to ensure all necessary components, such as container images, dependencies, and configuration files, are available without Internet access. The course emphasizes the use of an Air-Gapped Bundle and an existing local container registry as critical components for such deployments.

Air-Gapped Bundle (Option B) :

The NKPA course explains that for dark site deployments, Nutanix provides an Air-Gapped Bundle , which is a comprehensive package containing all the software components, container images, and dependencies required to deploy and manage an NKP cluster without Internet connectivity. This bundle includes the Kubernetes binaries, NKP platform applications (e.g., Rook Ceph, monitoring tools), and other necessary artifacts.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide specifically states: “For air-gapped environments, the Nutanix Air-Gapped Bundle is required to provide all dependencies, including container images and installation files, to deploy NKP clusters.” This bundle is typically downloaded from the Nutanix Support Portal in an Internet-connected environment and then transferred to the dark site for deployment.

The bundle ensures that the Nutanix-provided Rocky Linux VM image, which serves as the base operating system for the Kubernetes nodes, can be provisioned with all required software components. The NKPA course further notes that the Air-Gapped Bundle is tailored for AHV-based clusters, ensuring compatibility with the Nutanix hypervisor.

Existing Local Container Registry (Option C) :

In a dark site environment, a local container registry is a prerequisite to store and distribute container images required by the NKP cluster. The NKPA course highlights that NKP relies on container images for Kubernetes components, platform applications, and user workloads. In an air-gapped setup, these images cannot be pulled from public registries like Docker Hub or Quay.io.

The course instructs administrators to set up a local container registry (e.g., Harbor, Nexus, or a Nutanix-managed registry) and populate it with the container images included in the Air-Gapped Bundle. The Nutanix Cloud Bible reinforces this, stating: “In air-gapped deployments, a local container registry must be pre-configured to host all required images, which are provided as part of the Nutanix Air-Gapped Bundle.”

The local container registry ensures that the Kubernetes nodes, running on the Nutanix-provided Rocky Linux VM image, can access the necessary images during cluster bootstrapping and operation. The NKPA course provides guidance on configuring the registry and integrating it with the NKP deployment process.

Incorrect Options :

Konvoy Image Builder (Option A) :

Konvoy Image Builder is a tool associated with D2iQ’s Konvoy platform, used to create custom machine images for Kubernetes deployments. While it can be used to build images for Kubernetes nodes, it is not a Nutanix-specific tool nor a prerequisite for NKP deployments. The NKPA course and NCP-CN 6.10 Study Guide do not mention Konvoy Image Builder, as NKP uses the Nutanix-provided Rocky Linux VM image, which is pre-configured for AHV-based clusters. This option is irrelevant to the Nutanix ecosystem.

Self-managed AWS cluster (Option D) :

A self-managed AWS cluster is unrelated to the requirements of deploying NKP on an AHV-based cluster in a dark site. The question specifies an AHV-based cluster, which is Nutanix’s Acropolis Hypervisor running on-premises, not a cloud-based AWS environment. The NKPA course focuses on Nutanix infrastructure (AHV, Prism Central) for NKP deployments and does not include AWS as a supported platform for this scenario. This option is incorrect as it contradicts the deployment environment.

Deployment Context :

The Nutanix-provided Rocky Linux VM image is a pre-configured operating system image optimized for NKP deployments on AHV. The NKPA course notes that this image includes the necessary kernel settings, drivers, and configurations to run Kubernetes nodes efficiently on Nutanix infrastructure.

The AHV-based cluster requirement indicates that the deployment leverages Nutanix’s hypervisor, managed through Prism Central, to provision and manage the Kubernetes nodes. The Air-Gapped Bundle and local container registry ensure that all software components are available in the dark site, aligning with the NKPA course’s guidelines for air-gapped deployments.

As per the NKPA 6.10 documentation , the primary requirement for attaching external (self-managed) Kubernetes clusters to NKP is network connectivity . Specifically, the NKP management cluster must be able to communicate with the Kubernetes API server and relevant services of the target cluster. This allows NKP to collect metrics, perform health checks, and manage the attached cluster through Kommander and associated tools.

Exact extract:

“For attaching existing Kubernetes clusters, ensure the NKP management cluster can reach the Kubernetes API server of the target cluster and that the kubeconfig used has sufficient permissions.”

There is no requirement that the Kubernetes versions be exactly matched or within N-1, nor that an NKP admin account be directly established on the target clusters; the connectivity and valid kubeconfig file are the essential requirements.

The exhibit shows the NKP UI with the " Create Cluster " option grayed out in a new workspace, indicating that a prerequisite for cluster creation is missing. The NKPA course explains that to create a new Kubernetes cluster in a workspace, an Infrastructure Provider must be configured for that workspace. An Infrastructure Provider defines the underlying infrastructure (e.g., Nutanix AHV, AWS, vSphere) where the cluster will be provisioned, and without it, the Create Cluster option remains disabled in the UI.

The NKP Ultimate license supports creating clusters across various infrastructures, but the workspace must be associated with an Infrastructure Provider to enable cluster creation. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before creating a cluster in a new workspace, ensure an Infrastructure Provider is configured for the workspace in the NKP UI; otherwise, the Create Cluster option will be grayed out.” The engineer should navigate to the Infrastructure Providers section in the NKP UI (typically under the Global or Administration view), create a provider (e.g., for Nutanix AHV, AWS, or vSphere), and associate it with the workspace. Once this is done, the Create Cluster option will become available.

Incorrect Options :

A. Create the cluster only using YAML and not the GUI : The issue is not with the GUI itself but with the missing Infrastructure Provider, which affects both GUI and CLI cluster creation. YAML alone does not resolve this.

B. Attach existing clusters instead of creating a new cluster : Attaching existing clusters is an alternative but does not address the requirement to create a new cluster.

D. Ensure NKP is upgraded to a minimum version of 2.12 : The NKP Ultimate license implies a recent version, and the course does not indicate that version 2.12 is specifically required for this functionality. The issue is configuration-related, not version-related.

According to the NKPA 6.10 documentation , the Pre-provisioned infrastructure provider (CAPPP) requires the user to provide an inventory file of the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

The Secure Tunnel feature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

According to the NKPA 6.10 documentation , Rook Ceph is the recommended out-of-the-box storage solution integrated with NKP for persistent data storage, backups, and object storage within the Kubernetes environment.

Key Reference:

“Rook Ceph is integrated with NKP for providing persistent storage and backup support within the cluster.”

Comprehensive and Detailed Explanation:

The correct procedure for deleting an NKP cluster involves using the nkp delete cluster command with the appropriate cluster name and namespace. This ensures that not only the Kubernetes resources but also the corresponding NKP resources (e.g., nodepools, Kommander integration) are deleted cleanly and consistently. Simply deleting the VMs does not clean up the associated NKP management objects. This approach is detailed in the NKP documentation for cluster lifecycle management, emphasizing the need to use the provided CLI commands for full removal.

The NKPA 6.10 documentation clarifies that the supported and recommended method to delete an entire node pool (including its worker nodes) in an NKP cluster is by using the nkp delete nodepool command. This command removes the specified node pool and all associated resources from the cluster in a controlled and supported manner.

Key reference from the documentation:

“Use nkp delete nodepool < nodepool-name > --cluster-name= < cluster-name > to safely remove the node pool and its associated resources.”

Manual VM deletion via ACLI or NCLI is not recommended because it bypasses the Kubernetes and NKP resource lifecycle, potentially leaving orphaned resources or inconsistent cluster states.

The error states:

pgsql

Copy

error upgrading CAPI components: unable to upgrade CAPI components: deployment " capp-controller-manager " is not ready after 10m0s: failed to connect to the management cluster: context deadline exceeded

This clearly points to connectivity issues between the VM (or nodes) and the management cluster , typically caused by registry communication issues in air-gapped or private environments. When the VM cannot connect to the registry to pull required images or configuration, the CAPI (Cluster API) components cannot be initialized, causing a timeout.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Air-Gapped and Registry Communication Issues”

NCP-CN 6.10 Study Guide – “Cluster API Upgrade Process and Network Prerequisites”

=======

As per the NKPA 6.10 documentation , the standard and supported approach for installing Kommander on an NKP cluster is using the NKP CLI . The CLI provides commands for deploying Kommander and associated platform components as part of the cluster lifecycle management workflow.

Key Reference:

“The recommended approach to deploy Kommander is by using the nkp CLI, which ensures compatibility and streamlined installation with the rest of the Nutanix Kubernetes Platform stack.”

In an air-gapped NKP installation, the engineer starts with the NKP Air-Gapped Bundle, a tarball containing all necessary components (e.g., container images, binaries, configuration files) for deployment without Internet access. The NKPA course specifies that the first step is to extract this bundle on the bastion host to make its contents available for the installation process. The correct command is tar -xzvf nkp-air-gapped-bundle_v2.12.0_linux_amd64.tar.gz , which extracts the bundle into a directory, revealing the container images, CLI tools, and other resources needed for the deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To begin an air-gapped NKP installation, first extract the NKP Air-Gapped Bundle using tar -xzvf < bundle-file > .tar.gz on the bastion host to access the installation artifacts.” After extraction, the engineer can proceed with loading container images (e.g., using docker load) and running NKP CLI commands to deploy the cluster, ensuring all dependencies are available locally.

Incorrect Options :

A. nkp push bundle --bundle : This is not a valid command. The bundle must be extracted before its contents can be used.

B. docker load -i konvoy-bootstrap-image-v2.12.0.tar : Loading the bootstrap image is a subsequent step after extracting the bundle, which contains this image tarball.

D. nkp create cluster nutanix : This command creates a cluster but cannot be run until the bundle is extracted and its images are loaded.

NKP uses Helm and Flux for application deployment, where applications are managed as HelmReleases , a custom resource that defines Helm chart deployments. The NKPA course explains that to validate the status of HelmReleases, administrators can use the kubectl command to query these resources. The correct command is kubectl get helmreleases -n ${PROJECT_NAMESPACE} , which lists all HelmReleases in the specified project namespace, showing their status (e.g., Ready, Failed) and other details like chart version and reconciliation status.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To check the status of HelmReleases in NKP, use kubectl get helmreleases -n < namespace > to view the current state of application deployments managed by Flux.” This command helps the operations team verify that applications are running correctly and identify any issues in production.

Incorrect Options :

A. kubectl get namespaces : This lists namespaces, not HelmReleases or their status.

C. kubectl edit helmreleases -n ${PROJECT_NAMESPACE} : This edits HelmRelease resources, not displays their status.

D. kubectl apply -f fluent-bit-overrides.yaml : This applies a configuration for Fluent Bit, unrelated to HelmRelease status.

As outlined in the NKPA 6.10 documentation , Goss is used to validate that an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”

As per the NKPA 6.10 documentation under “Day 2 Operations: Managing Applications”, the recommended procedure to enable an application (like NKP Insights) involves accessing the cluster’s Application Dashboard . The NKP Insights application does not appear in the general category list if the cluster does not have the correct context or if the application category is not globally enabled.

The specific procedure to enable NKP Insights includes:

Navigate to the Clusters section from the left-side menu.

Select View Details for the target cluster (prod-01 in this case).

In the Application Dashboard of that specific cluster, locate the NKP Insights application.

Click the three-dot menu (ellipsis) for NKP Insights and select Enable .

For creating custom images for vSphere (and other supported platforms), Konvoy Image Builder (KIB) is the officially supported tool for NKP. It can create images with custom configurations, package versions, and pre-bundled artifacts.

Key Reference:

“Konvoy Image Builder (KIB) is the Nutanix-recommended tool for building NKP cluster node images for vSphere, AWS, Azure, and other environments.”

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

The NKPA 6.10 documentation and Nutanix Best Practices recommend using workspaces to segment cluster deployments and their associated infrastructure providers, as well as to manage access control through RBAC. The typical workflow is:

Create an NKP workspace dedicated to the R & D environment.

Create an infrastructure provider (e.g., vSphere, AHV) scoped to that workspace.

Create an NKP group for the R & D team and assign admin roles to this group within the workspace.

Deploy workload clusters in this workspace, leveraging the scoped infrastructure provider.

This ensures that:

The R & D team has full administrative control over their resources.

Clusters and infrastructure are logically isolated in the R & D workspace.

RBAC policies are applied cleanly within the workspace context.

The scenario describes an isolated environment in Antarctica, implying an air-gapped NKP deployment where the bastion host serves as the primary management point for deploying and managing NKP clusters without Internet access. The NKPA course outlines the essential tools that must be installed on a bastion host to facilitate NKP deployment and management in such environments.

The required programs are kubectl and nkp :

kubectl : This is the Kubernetes command-line tool used to interact with Kubernetes clusters, essential for managing cluster resources, debugging, and applying configurations during and after deployment.

nkp : The NKP CLI (nkp) is the primary tool for deploying, managing, and scaling NKP clusters, including creating bootstrap clusters, deploying clusters, and managing platform applications. In an air-gapped setup, the nkp CLI is critical for executing deployment commands using the Air-Gapped Bundle.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For an air-gapped NKP deployment, ensure the bastion host has kubectl and the nkp CLI installed to manage the deployment process and interact with the resulting Kubernetes clusters.” These tools are sufficient for the engineer to deploy and operate NKP in an isolated environment.

Incorrect Options :

A. awscli and nkp : The awscli is specific to AWS environments, but the question does not specify AWS infrastructure. Additionally, in an isolated environment, awscli is less relevant without Internet access.

B. oc and kubectl : oc is the OpenShift CLI, not used for NKP deployments. NKP uses nkp CLI instead.

C. oc and az : az is the Azure CLI, and oc is for OpenShift—neither is relevant to NKP deployment.

The NKPA course highlights that NKP Insights is the platform’s integrated solution for observability and analytics, providing predictive analytics to detect current and future anomalies in Kubernetes clusters. NKP Insights leverages machine learning to analyze metrics, logs, and events, identifying performance issues and potential failures proactively. After deploying a new cluster, the administrator can enable NKP Insights as a platform application in the workspace to meet the predictive analytics requirement.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Insights provides predictive analytics and anomaly detection for Kubernetes clusters, enabling administrators to monitor and optimize cluster performance.” This is deployed via the NKP UI or CLI by enabling the Insights application in the workspace.

Incorrect Options :

B. NCM Intelligent Ops : Nutanix Cloud Manager (NCM) Intelligent Ops is for broader infrastructure management, not Kubernetes-specific analytics.

C. Nutanix Pulse : Pulse is a telemetry service for Nutanix support, not for analytics.

D. NKP AI Navigator : This is not a recognized NKP component in the NKPA documentation.

A bastion host in a dark site environment serves as a secure entry point for managing the NKP deployment, providing access to the cluster infrastructure without direct Internet connectivity. The NKPA course outlines the prerequisites for preparing a Linux VM as a bastion host, focusing on secure access and time synchronization, which are critical for air-gapped Kubernetes deployments.

Get or create SSH Keys (Option B) : The bastion host requires SSH keys to enable secure, passwordless access to the NKP cluster nodes and other infrastructure components (e.g., Nutanix AHV hosts). The NKPA course specifies that SSH keys must be generated or obtained and configured on the bastion host to facilitate secure communication during deployment and management tasks. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For a bastion host in an NKP dark site deployment, ensure SSH keys are created or obtained to enable secure access to cluster nodes and infrastructure.” The engineer can generate SSH keys using ssh-keygen and distribute the public key to the target systems.

Enable NTP Service (Option D) : Time synchronization is essential in Kubernetes clusters to ensure consistent logging, certificate management, and scheduling. In a dark site with no Internet access, the bastion host must be configured to synchronize time with an internal NTP (Network Time Protocol) server or act as an NTP server itself. The NKPA course emphasizes enabling the NTP service on the bastion host to maintain accurate time across the air-gapped environment. The NCP-CN 6.10 Study Guide notes: “Enable the NTP service on the bastion host to ensure time synchronization in a dark site NKP deployment, as Kubernetes requires accurate time for proper operation.” The engineer can enable NTP using commands like systemctl enable ntpd and configure it to use an internal time source.

Incorrect Options :

A. Install LDAP Server : LDAP is used for centralized authentication, but it is not a requirement for a bastion host in an NKP dark site deployment. The course focuses on SSH access instead.

C. Install Docker : While Docker is needed on Kubernetes nodes for container runtimes, the bastion host’s role is to provide secure access and management, not to run containers.

The NKPA course details the default node preparation process for NKP cluster nodes, which involves creating a machine image that is compliant with Cluster API (CAPI) standards. The primary tool used in this process is Packer , which automates the creation of machine images by provisioning a base OS image (e.g., Ubuntu or Rocky Linux) with the necessary components for Kubernetes, such as kubeadm, containerd, and other dependencies.

Packer ensures the image is CAPI-compliant by installing the required Kubernetes binaries, configuring the container runtime, and setting up networking and storage components. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In the default node preparation process for NKP, Packer is used to build a CAPI-compliant OS image, installing Kubernetes components and dependencies for use as an NKP node.” This process is typically orchestrated by NKP Image Builder (NIB) or Kubernetes Image Builder (KIB), both of which rely on Packer for image creation.

Incorrect Options :

B. Ansible is used to make the OS image CAPI-compliant : Ansible is used by KIB/NIB to apply configurations during the Packer build process, but Packer is the primary tool for creating the image. Ansible alone does not make the image CAPI-compliant.

C. Goss is used to harden the OS image : Goss is a validation tool that can be used for image hardening, but it is not part of the default NKP node preparation process. Hardening is an optional step.

D. Terraform is utilized to clone an existing OS image : Terraform is for infrastructure provisioning, not image creation or cloning. Packer handles image creation in NKP.

For deployments in air-gapped environments where there is no external Internet connectivity, the --airgapped parameter is required. This instructs the NKP deployment to rely solely on internal resources, using pre-staged images and local container registries, ensuring that no external network dependencies cause deployment failures.