KCNA Practice Questions

The Kubernetes scheduler is responsible for assigning Pods to Nodes. The event message Insufficient cpu directly indicates that the scheduler evaluated all available nodes and none of them had enough unallocated CPU capacity to meet the Pod's requested CPU amount. Image pull errors would result in a different state like ImagePullBackOff, and unresponsive kubelets would typically mark the node as NotReady.

The CNCF has three project maturity levels. 'Graduated' projects (like Kubernetes, Prometheus, and Envoy) are considered the most mature, stable, and widely adopted. 'Incubating' projects are stable but still maturing. 'Sandbox' projects are for early-stage experimentation. For a committee seeking proven and stable technologies, Graduated projects are the most appropriate choice.

Pod Security Standards (PSS) are the successor to PodSecurityPolicies and define different security levels for Pods (e.g., Privileged, Baseline, Restricted). They are applied at the namespace level via labels and are enforced by the built-in Pod Security admission controller. This mechanism is specifically designed to enforce workload security postures like preventing root containers and risky volume mounts. RBAC controls access to the API, while NetworkPolicies control traffic flow.

The LoadBalancer Service type is the standard way to expose a service externally using a cloud provider's load balancer. When this type is used, Kubernetes communicates with the cloud provider's API to provision a load balancer, which then directs external traffic to the service's NodePorts. ClusterIP is only for internal communication, NodePort exposes the service on each node's IP but doesn't provision an external load balancer, and ExternalName is for DNS aliasing.

This scenario describes configuration drift, where the live state of the cluster differs from the desired state in Git. A core feature of GitOps tools like Argo CD is automated reconciliation. By enabling an automated sync policy with the 'self-heal' option, Argo CD will continuously monitor for drift and automatically revert any manual changes (like the kubectl set image command) to match the configuration defined in the Git repository, thus enforcing Git as the single source of truth.

Harbor is a CNCF graduated project that provides a private container registry with integrated vulnerability scanning (like Trivy or Clair). Open Policy Agent (OPA) can be used as a Kubernetes admission controller to enforce policies, such as rejecting pods that attempt to use images from untrusted registries or images with known critical vulnerabilities. This combination directly addresses the requirements.

Jaeger is a CNCF-graduated project for distributed tracing. It allows developers to monitor and troubleshoot transactions in complex distributed systems, like microservices. It visualizes the path of a request as it travels through different services, which is exactly what the team needs to debug the intermittent failures. Prometheus is for metrics, and Fluentd is for logging.

The core principle of pull-based GitOps, as implemented by tools like Flux and Argo CD, is an in-cluster operator (or agent). This operator periodically pulls the state of the Git repository and compares it to the live state of the Kubernetes cluster. If there's a difference (drift), the operator takes action to make the cluster state match the 'source of truth' in Git. This is known as reconciliation.

A Service of type ClusterIP exposes the Service on a cluster-internal IP. This makes the Service reachable only from within the cluster. To expose a Service to the outside world, you must use other Service types like NodePort or LoadBalancer, or an Ingress resource.