CKA — all questions

kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets
kubectl create serviceaccount cicd-token -n app-team1
kubectl create rolebinding deploy-binding -n app-team1 --clusterrole=deployment-clusterrole --serviceaccount=app-team1:cicd-token
kubectl auth can-i create deployment -n app-team1 --as=system:serviceaccount:app-team1:cicd-token

A RoleBinding grants the ClusterRole only inside app-team1; a ClusterRoleBinding would grant it cluster-wide.

kubectl drain ek8s-node-0 --ignore-daemonsets --delete-emptydir-data --force

drain cordons the node and evicts eligible workloads so controllers can reschedule them elsewhere.

kubectl drain <master-node> --ignore-daemonsets
apt-mark unhold kubeadm kubelet kubectl
apt-get update && apt-get install -y kubeadm=1.22.2-00
kubeadm upgrade plan
kubeadm upgrade apply v1.22.2
apt-get install -y kubelet=1.22.2-00 kubectl=1.22.2-00
apt-mark hold kubeadm kubelet kubectl
systemctl daemon-reload && systemctl restart kubelet
kubectl uncordon <master-node>

Upgrade kubeadm first, apply the control-plane upgrade, then upgrade kubelet and kubectl and return the node to service.

ETCDCTL_API=3 etcdctl snapshot save /var/lib/backup/etcd-snapshot.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
ETCDCTL_API=3 etcdctl snapshot restore /var/lib/backup/etcd-snapshot-previous.db --data-dir=/var/lib/etcd-from-backup
# Point the etcd static Pod data-dir/hostPath at /var/lib/etcd-from-backup and verify the API server.

The snapshot uses the etcd client certificates; restoration creates a new data directory that etcd must be configured to use.

kubectl label namespace internal kubernetes.io/metadata.name=internal --overwrite
cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-port-from-namespace
  namespace: fubar
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: internal
    ports:
    - {protocol: TCP, port: 9000}
EOF

The empty pod selector protects every pod in fubar while the namespace and port selectors admit only the required traffic.

kubectl edit deployment front-end
# Add to the nginx container: ports: [{name: http, containerPort: 80, protocol: TCP}]
kubectl expose deployment front-end --name=front-end-svc --type=NodePort --port=80 --target-port=http
kubectl get service front-end-svc

The named container port lets the NodePort Service target the deployment's HTTP endpoint reliably.

kubectl scale deployment presentation --replicas=3
kubectl get deployment presentation

Scaling updates the deployment's desired replica count to three.

kubectl run nginx-kusc00401 --image=nginx --dry-run=client -o yaml > pod.yaml
# Add under spec: nodeSelector: {disk: ssd}
kubectl apply -f pod.yaml

nodeSelector restricts the Pod to a node carrying the disk=ssd label.

kubectl get nodes -o jsonpath='{range .items[?(@.status.conditions[?(@.type=="Ready")].status=="True")]}{.metadata.name}{"\t"}{.spec.taints}{"\n"}{end}' | grep -v 'NoSchedule' | wc -l > /opt/KUSC00402/kusc00402.txt

The command selects Ready nodes, excludes any with a NoSchedule taint, and writes only the count.

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata: {name: kucc8}
spec:
  containers:
  - {name: nginx, image: nginx}
  - {name: consul, image: hashicorp/consul:latest}
EOF

Both containers share one Pod while retaining separate images and container names.

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: PersistentVolume
metadata: {name: app-data}
spec:
  capacity: {storage: 2Gi}
  accessModes: [ReadOnlyMany]
  hostPath: {path: /srv/app-data}
EOF

The PersistentVolume provides the requested hostPath capacity with ReadOnlyMany access.

mkdir -p /opt/KUTR00101
kubectl logs foo | grep 'file-not-found' > /opt/KUTR00101/foo

The pipeline filters the Pod log to matching records and redirects them to the required file.

kubectl get pod big-corp-app -o yaml > pod.yaml
# Recreate the Pod with an emptyDir mounted at /var/log in both containers and add:
# - name: sidecar
#   image: busybox
#   args: [/bin/sh, -c, 'tail -n+1 -F /var/log/big-corp-app.log']
#   volumeMounts: [{name: varlog, mountPath: /var/log}]
kubectl replace --force -f pod.yaml
kubectl logs big-corp-app -c sidecar

The shared emptyDir lets the sidecar continuously stream the main container's log file; the omitted command is recovered from the discussion and screenshot.

mkdir -p /opt/KUTR00401
kubectl top pod -l name=overloaded-cpu --sort-by=cpu --no-headers | awk 'NR==1 {print $1}' > /opt/KUTR00401/KUTR00401.txt

kubectl top sorts matching Pods by CPU and the pipeline writes the highest consumer's name.

kubectl describe node wk8s-node-0
ssh wk8s-node-0
sudo systemctl status kubelet
sudo systemctl enable --now kubelet
sudo systemctl restart kubelet
exit
kubectl get node wk8s-node-0

Enabling and restarting kubelet fixes the common NotReady cause and ensures the service returns after reboot.

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: pv-volume}
spec:
  storageClassName: csi-hostpath-sc
  accessModes: [ReadWriteOnce]
  resources: {requests: {storage: 10Mi}}
---
apiVersion: v1
kind: Pod
metadata: {name: web-server}
spec:
  containers:
  - name: web-server
    image: nginx
    volumeMounts: [{name: data, mountPath: /usr/share/nginx/html}]
  volumes:
  - name: data
    persistentVolumeClaim: {claimName: pv-volume}
EOF
kubectl patch pvc pv-volume -p '{"spec":{"resources":{"requests":{"storage":"70Mi"}}}}'
kubectl get pvc pv-volume

The claim requests the provided storage class, the Pod mounts it, and the patch expands the requested capacity when the class allows expansion.

kubectl create ingress pong -n ing-internal --class=nginx --rule='/hello/*=hello:5678'
kubectl describe ingress pong -n ing-internal

A Prefix path sends /hello traffic through the nginx Ingress to service hello on port 5678.

kubectl create ingress ping -n ing-internal --class=nginx --rule='/hi/*=hi:5678'
kubectl describe ingress ping -n ing-internal

A Prefix path sends /hi traffic through the nginx Ingress to service hi on port 5678.

cat <<'EOF' | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: allow-port-from-namespace, namespace: echo}
spec:
  podSelector: {}
  policyTypes: [Ingress]
  ingress:
  - from:
    - namespaceSelector:
        matchLabels: {kubernetes.io/metadata.name: internal}
    ports:
    - {protocol: TCP, port: 9200}
EOF

The policy permits only TCP 9200 ingress from the internal namespace to Pods in echo.

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata: {name: kucc1}
spec:
  containers:
  - {name: redis, image: redis}
  - {name: consul, image: hashicorp/consul:latest}
EOF

The manifest schedules the two required containers in one Pod.