Why Dumpsforsure is the best choice for Linux-Foundation CKAD exam preparation?
Secure your position in Highly Competitive IT Industry:
Linux-Foundation CKAD exam certification is the best way to demonstrate your understanding, capability and talent. DumpsforSure is here to provide you with best knowledge on CKAD certification. By using our CKAD questions & answers you can not only secure your current position but also expedite your growth process.
Verified by IT and Industry Experts:
We are devoted and dedicated to providing you with real and updated CKAD exam dumps, along with explanations. Keeping in view the value of your money and time, all the questions and answers on Dumpsforsure has been verified by Linux-Foundation experts. They are highly qualified individuals having many years of professional experience.
Ultimate preparation Source:
Dumpsforsure is a central tool to help you prepare your Linux-Foundation CKAD exam. We have collected real exam questions & answers which are updated and reviewed by professional experts regularly. In order to assist you understanding the logic and pass the Linux-Foundation exams, our experts added explanation to the questions.
Instant Access to the Real and Updated Linux-Foundation CKAD Questions & Answers:
Dumpsforsure is committed to update the exam databases on regular basis to add the latest questions & answers. For your convenience we have added the date on the exam page showing the most latest update. Getting latest exam questions you'll be able to pass your Linux-Foundation CKAD exam in first attempt easily.
Free CKAD Dumps DEMO before Purchase:
Dumpsforsure is offering free Demo facility for our valued customers. You can view Dumpsforsure's content by downloading CKAD free Demo before buying. It'll help you getting the pattern of the exam and form of CKAD dumps questions and answers.
Three Months Free Updates:
Our professional expert's team is constantly checking for the updates. You are eligible to get 90 days free updates after purchasing CKAD exam. If there will be any update found our team will notify you at earliest and provide you with the latest PDF file.
SAMPLE QUESTIONS
Question # 1
Context
You are asked to deploy an application developed for an older version of Kubernetes on a
cluster running a recent version of Kubernetes .
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00026 Task
Fix any API -deprecation issues in the manitest file
/home/candidate/credible-mite/web.yaml
so that the application can be deployed on cluster ckad00026.
The application was developed for Kubernetes v1.15.
The cluster ckad00026 runs Kubernetes 1.29+.
Deploy the application specified in the updated manifest file
/home/candidate/credible-mite/web.yaml in namespace garfish .
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00026Your job is to edit /home/candidate/credible-mite/web.yaml so it uses APIs supported onKubernetes 1.29+, then deploy it into namespace garfish.Because I can’t see your file from here, the most reliable exam approach is:run a server-side dry-run to reveal the exact deprecated/removed APIs andschema errorsedit the manifest to the modern API versions/fieldsre-run dry-run until it passesapply for real and verify rollout1) Go to the manifest and run a server-side dry-runcd /home/candidate/credible-mitels -lsed -n '1,200p' web.yamlMake sure the namespace exists:kubectl get ns garfish || kubectl create ns garfishNow run a server-side dry-run (this catches removed APIs on the cluster):kubectl apply -n garfish -f web.yaml --dry-run=serverWhatever errors you get here tell you exactly what to fix.2) Fix the common v1.15 v1.29 API deprecationsEdit the file:vi web.yamlBelow are the most common objects from older manifests and how to update them for1.29+.A) Deployments / DaemonSets / StatefulSetsOld (v1.15 often used):extensions/v1beta1 or apps/v1beta1 or apps/v1beta2New:apiVersion: apps/v1Also in apps/v1, .spec.selector is required and must match the pod template labels.Example conversion:apiVersion: apps/v1kind: Deploymentmetadata:name: webspec:replicas: 2selector:matchLabels:app: webtemplate:metadata:labels:app: webspec:containers:- name: webimage: nginxKey rule:spec.selector.matchLabels must exactly match spec.template.metadata.labels (at least forthe keys you select on).B) IngressOld:apiVersion: extensions/v1beta1 (or networking.k8s.io/v1beta1)New:apiVersion: networking.k8s.io/v1Required changes:spec.rules.http.paths[].pathType is required (usually Prefix)backend format changes from serviceName/servicePort toservice.name/service.port.number (or .name for named ports)Old backend:backend:serviceName: webservicePort: 80New backend:backend:service:name: webport:number: 80Full path example:apiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: webspec:rules:- host: example.localhttp:paths:- path: /pathType: Prefixbackend:service:name: webport:number: 80C) CronJobOld:apiVersion: batch/v1beta1New:apiVersion: batch/v1Most fields stay the same; just update apiVersion.D) PodDisruptionBudgetOld:policy/v1beta1New:policy/v1spec.selector/minAvailable/maxUnavailable remain, but apiVersion changes.E) RBACUsually already:rbac.authorization.k8s.io/v1 (this is fine)F) Removed APIs you must delete/replaceIf you see these in a v1.15-era manifest, they are removed in modern clusters:PodSecurityPolicy (policy/v1beta1) is removed. You cannot deploy it on 1.29+.Remove it from the manifest (or replace with whatever your environment uses, butfor CKAD tasks you usually delete PSP sections from the file).Some old admission/alpha resources also removed.If dry-run complains “no matches for kind … in version …”, that’s your cue.3) Re-run dry-run until it succeedsAfter you edit:kubectl apply -n garfish -f web.yaml --dry-run=serverKeep iterating until there are no errors.4) Deploy for realkubectl apply -n garfish -f /home/candidate/credible-mite/web.yaml5) Verify everything in namespace garfishList what was created:kubectl -n garfish get allkubectl -n garfish get ingress 2>/dev/null || trueIf there is a Deployment, verify rollout:kubectl -n garfish get deploykubectl -n garfish rollout status deploy --allCheck pods/events if something fails:kubectl -n garfish get pods -o widekubectl -n garfish describe pod <pod-name>kubectl -n garfish get events --sort-by=.lastTimestamp | tail -n 30
Question # 2
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00029
Task
Modify the existing Deployment named store-deployment, running in namespace
grubworm, so that its containers
run with user ID 10000 and
have the NET_BIND_SERVICE capability added
The store-deployment 's manifest file Click to copy
/home/candidate/daring-moccasin/store-deplovment.vaml
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00029You must modify the existing Deployment store-deployment in namespace grubworm sothat its containers:run as user ID 10000have Linux capability NET_BIND_SERVICE addedAnd you’re told to use the manifest file at:/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looksmisspelled; follow it exactly on the host)1) Inspect the current Deployment and locate the manifest filekubectl -n grubworm get deploy store-deploymentls -l /home/candidate/daring-moccasin/Open the manifest:sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"2) Edit the manifest to add SecurityContextEdit the file:vi "/home/candidate/daring-moccasin/store-deplovment.vaml"2.1 Set Pod-level runAsUser = 10000Under:spec.template.spec add:securityContext:runAsUser: 100002.2 Add NET_BIND_SERVICE capability at container-levelUnder the container spec (for each container in containers:), add:securityContext:capabilities:add: ["NET_BIND_SERVICE"]A complete example of what it should look like (mind indentation):apiVersion: apps/v1kind: Deploymentmetadata:name: store-deploymentnamespace: grubwormspec:template:spec:securityContext:runAsUser: 10000containers:- name: storeimage: someimagesecurityContext:capabilities:add: ["NET_BIND_SERVICE"]Important notes:runAsUser can be set at Pod level (applies to all containers) or per-container. Podlevel is cleanest if all containers should run as 10000.Capabilities must be set per-container (that’s where Kubernetes supports it).Save and exit.3) Apply the updated manifestkubectl apply -f "/home/candidate/daring-moccasin/store-deplovment.vaml"4) Ensure the Deployment rolls outkubectl -n grubworm rollout status deploy store-deployment5) Verify the settings are in effectCheck the rendered pod template:kubectl -n grubworm get deploy store-deployment -ojsonpath='{.spec.template.spec.securityContext}{"\n"}'kubectl -n grubworm get deploy store-deployment -ojsonpath='{.spec.template.spec.containers[0].securityContext}{"\n"}'Verify on a running pod:kubectl -n grubworm get podskubectl -n grubworm describe pod <pod-name> | sed -n '/Security Context:/,/Containers:/p'kubectl -n grubworm describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'If there are multiple containersRepeat the container-level securityContext.capabilities.add block for each container underspec.template.spec.containers.
Question # 3
Context
An existing web application must be exposed externally.
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00025
An application externally using the URL external.sterling-bengal.local . Any requests
starting with / must be routed to the application web-app.
To test the web application's external reachability, run
[candidate@ckad00025] $ curl http://external.sterling-bengal.local/ or open this URL in the remote desktop's browser.
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00025You need to expose the existing app “web-app” externally at:Host: external.sterling-bengal.localPath: / (and anything starting with /) route to web-appIn CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.1) Find where web-app Service lives (namespace + port)kubectl get svc -A | grep -w web-appYou’ll get something like:<NAMESPACE> web-app ClusterIP ... <PORT>/TCPSet the namespace:NS=<NAMESPACE>Check the service port(s):kubectl -n $NS get svc web-app -o yamlNote the service port number (commonly 80).Also verify it has endpoints (so it actually routes to pods):kubectl -n $NS get endpoints web-app -o wideIf endpoints are empty, the Service selector doesn’t match pods — tell me and I’ll give theexact fix. But usually it’s fine.2) Create the Ingress to route / to web-appCreate a manifest (use the service port you saw; I’ll assume 80 below):cat <<'EOF' > web-app-ingress.yamlapiVersion: networking.k8s.io/v1kind: Ingressmetadata:name: web-app-ingressspec:rules:- host: external.sterling-bengal.localhttp:paths:- path: /pathType: Prefixbackend:service:name: web-appport:number: 80EOFApply it:kubectl -n $NS apply -f web-app-ingress.yamlVerify:kubectl -n $NS get ingress web-app-ingresskubectl -n $NS describe ingress web-app-ingressIf your Service port is not 80, change number: 80 to the correct value and re-apply.3) Test external reachability (as instructed)Run exactly:curl -i http://external.sterling-bengal.local/If curl still fails (quick checks)A) Is there an ingress controller running?kubectl get pods -A | egrep -i 'ingress|nginx'kubectl get svc -A | egrep -i 'ingress|nginx'B) Does Ingress show an address?kubectl -n $NS get ingress web-app-ingress -o wideC) Do we have endpoints?kubectl -n $NS get endpoints web-app -o wide
Question # 4
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00044
Task:
Update the existing Deployment busybox running in the namespace rapid-goat .
First, change the container name to musl.
Next, change the container image to busybox:musl .
Finally, ensure that the changes to the busybox Deployment, running in the
namespace rapid-goat, are rolled out.
Answer: See the Explanation below for complete solution. Explanation:0) SSH to the correct hostssh ckad00044(Optional sanity)kubectl config current-contextkubectl get ns | grep rapid-goat1) Inspect the Deployment and current container namekubectl -n rapid-goat get deploy busyboxkubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'kubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[*].image}{"\n"}'Note the current container name (likely something like busybox). We need to rename it tomusl.2) Edit the Deployment (best for renaming container)Renaming a container is easiest with edit:kubectl -n rapid-goat edit deploy busyboxIn the editor, find:spec:template:spec:containers:- name: <old-name>image: <old-image>Change it to:- name: muslimage: busybox:muslSave and exit.3) Ensure the rollout happens and completeskubectl -n rapid-goat rollout status deploy busybox4) Verify the new Pod template is correctCheck the Deployment template:kubectl -n rapid-goat get deploy busybox -ojsonpath='{.spec.template.spec.containers[0].name}{"\n"}{.spec.template.spec.containers[0].image}{"\n"}'Check running Pods and the image actually used:kubectl -n rapid-goat get pods -o widePOD=$(kubectl -n rapid-goat get pods -l app=busybox -ojsonpath='{.items[0].metadata.name}' 2>/dev/null || true)If you don’t have that label selector, just pick a pod name from kubectl get pods and:kubectl -n rapid-goat describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'
Question # 5
Context
You are asked to allow a Pod to communicate with two other Pods but nothing else.
You must connect to the correct host . Failure to do so may result
in a zero score.
! [candidate@base] $ ssh ckad000
18
charming-macaw namespace to use a NetworkPolicy allowing the Pod to send and receive
traffic only to and from the Pods front and db.
All required NetworkPolicies have already been created.
You must not create, modify or delete any NetworkPolicy while working on this task. You
may only use existing NetworkPolicies .
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00018You cannot create/modify/delete any NetworkPolicy.So the only way to make the existing policies “take effect” is to ensure the right Pods havethe labels/selectors those policies expect.The task: in namespace charming-macaw, configure things so the target Pod can send +receive traffic ONLY to/from Pods front and db.1) Inspect what NetworkPolicies already exist (don’t change them)kubectl -n charming-macaw get netpolkubectl -n charming-macaw get netpol -o wideDump them to see the selectors they use:kubectl -n charming-macaw get netpol -o yamlYou are looking for policies that:select the restricted pod via spec.podSelectorand allow ingress/egress only with selectors that match front and dboften there’s also a “default deny” policy.2) Identify the Pods and their current labelskubectl -n charming-macaw get pods -o widekubectl -n charming-macaw get pods --show-labelsSpecifically inspect labels for front and db:kubectl -n charming-macaw get pod front --show-labelskubectl -n charming-macaw get pod db --show-labels(If they’re Deployments instead of single Pods, do:)kubectl -n charming-macaw get deploy --show-labelskubectl -n charming-macaw get pods -l app=front --show-labelskubectl -n charming-macaw get pods -l app=db --show-labels3) Figure out which pod is “the Pod” to restrictUsually there’s a third pod (e.g., backend, api, app) besides front and db.List pods again and identify the “other” one:kubectl -n charming-macaw get podsLet’s assume the pod to restrict is called app (replace as needed):TARGET=<pod-to-restrict>4) Match the existing NetworkPolicy selectors by labeling pods (allowed)Because you can’t edit NetworkPolicies, you must make labels on Pods (or theircontrollers) match the policies’ selectors.4.1 Determine the label required on the TARGET podFrom the YAML, find the policy that selects the restricted pod, e.g.:spec:podSelector:matchLabels:role: restrictedExtract podSelector from each policy quickly:kubectl -n charming-macaw get netpol -o jsonpath='{range .items[*]}{.metadata.name}{" =>"}{.spec.podSelector}{"\n"}{end}'Pick the selector that is meant for the restricted pod, then apply it to the TARGET pod(example: role=restricted):kubectl -n charming-macaw label pod $TARGET role=restricted --overwriteBest practice (if the pod is managed by a Deployment): label the Deployment templateinstead, so it persists.Find the owner:kubectl -n charming-macaw get pod $TARGET -ojsonpath='{.metadata.ownerReferences[0].kind}{""}{.metadata.ownerReferences[0].name}{"\n"}'If it’s a ReplicaSet, find its Deployment:RS=$(kubectl -n charming-macaw get pod $TARGET -ojsonpath='{.metadata.ownerReferences[0].name}')kubectl -n charming-macaw get rs $RS -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.metadata.ownerReferences[0].name}{"\n"}'Then label the Deployment (example):kubectl -n charming-macaw label deploy <DEPLOYMENT_NAME> role=restricted --overwrite4.2 Ensure front and db match what the allow-rules referenceLook inside the allow policy ingress.from / egress.to. You might see something like:from:- podSelector:matchLabels:name: front- podSelector:matchLabels:name: dbSo you must ensure:front pod has name=frontdb pod has name=dbApply labels (examples—use what the policy expects):kubectl -n charming-macaw label pod front name=front --overwritekubectl -n charming-macaw label pod db name=db --overwriteAgain, if they’re Deployments, label the Deployment instead:kubectl -n charming-macaw label deploy front name=front --overwritekubectl -n charming-macaw label deploy db name=db --overwrite5) Verify the NetworkPolicies now “select” the right podsCheck which labels each pod has now:kubectl -n charming-macaw get pods --show-labelsConfirm the restricted pod matches the NetPol podSelector:kubectl -n charming-macaw get netpol <POLICY_NAME> -ojsonpath='{.spec.podSelector}{"\n"}'kubectl -n charming-macaw get pod $TARGET --show-labels6) Functional verification (quick network tests)Exec into the restricted pod and try to reach:front alloweddb allowedanything else blockedIf busybox has wget:kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://front 2>/dev/null ||true'kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://db 2>/dev/null ||true'Test something that should be blocked (example: kubernetes service DNS name):kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qOhttps://kubernetes.default.svc 2>/dev/null || echo "blocked"'Also test inbound (from front to target, and from db to target) if the target listens on a port;otherwise inbound testing may be limited.What you’re doing conceptuallyExisting NetPols are already correct.Your job is to make pod labels match the NetPol selectors so:
Question # 6
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00021
Task
Create a Cronjob named grep that executes a Pod running the following single container:
name: busybox
image: busybox:stable
command: ["grep", "-i", "nameserv
er", "/etc/resolv.conf"] Configure the CronJob to:
execute Once every 30 minutes
keep 96 completed Job
keep 192 failed Job
never restart podsterminate pods after 8 seconds
Manually create and execute once job
named grep-test from the grep Cronjob
Answer: See the Explanation below for complete solution. Explanation:ssh ckad00021Below is the clean, CKAD-friendly way (YAML + apply + verify + manual job).1) Create the CronJob grepCreate a file (anywhere, e.g. in your home):cat <<'EOF' > grep-cronjob.yamlapiVersion: batch/v1kind: CronJobmetadata:name: grepspec:schedule: "*/30 * * * *"successfulJobsHistoryLimit: 96failedJobsHistoryLimit: 192jobTemplate:spec:activeDeadlineSeconds: 8template:spec:restartPolicy: Nevercontainers:- name: busyboximage: busybox:stablecommand: ["grep", "-i", "nameserver", "/etc/resolv.conf"]EOFApply it:kubectl apply -f grep-cronjob.yamlVerify:kubectl get cronjob grepkubectl describe cronjob grepConfirm the key fields quickly:kubectl get cronjob grep -ojsonpath='{.spec.schedule}{"\n"}{.spec.successfulJobsHistoryLimit}{"\n"}{.spec.failedJobsHistoryLimit}{"\n"}'kubectl get cronjob grep -ojsonpath='{.spec.jobTemplate.spec.activeDeadlineSeconds}{"\n"}{.spec.jobTemplate.spec.template.spec.restartPolicy}{"\n"}'2) Manually create and execute the one-off Job grep-test from the CronJobCreate the Job from the CronJob:kubectl create job --from=cronjob/grep grep-testWatch it:kubectl get jobs grep-testkubectl get pods -l job-name=grep-testGet logs (most important proof):POD=$(kubectl get pods -l job-name=grep-test -o jsonpath='{.items[0].metadata.name}')kubectl logs "$POD"You should see one or more nameserver ... lines from /etc/resolv.conf.
Question # 7
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00033
Task
A Dockerfile has been prepared at /home/candidate/build/Dockerfile.
Using the prepared Dockerfile, build a container image with the name macaque and tag
1.2. You may install and use the tool of your choice.
Multiple image builders and tools have been pre-installed in the base system,
including: docker, skopeo, buildah, img , and podman.
Please do not push the built image to a registry, run a container, or otherwise consume it.
Using the tool of your choice, export the built container image in OCI or Docker image
format and store it at /home/candidate/macaque-1.2.tar.
Answer: See the Explanation below for complete solution. Explanation:Understood — I’ll redo Question 13 without using any (or similar) icons.ssh ckad00033This task is only about building and exporting a container image.You must not push it, run it, or consume it in any way.You may use any image builder. Below are clean, correct solutions. Use one of them.Option A: Using Docker1) Go to the Dockerfile locationcd /home/candidate/buildls -l Dockerfile2) Build the imageImage name: macaqueTag: 1.2docker build -t macaque:1.2 .Verify:docker images | grep macaque3) Export the image to a tar fileDocker image format is acceptable.docker save macaque:1.2 -o /home/candidate/macaque-1.2.tarVerify the file exists:ls -lh /home/candidate/macaque-1.2.tarDo not load or run the image.Option B: Using Podman (rootless alternative)1) Build the imagecd /home/candidate/buildpodman build -t macaque:1.2 .Verify:podman images | grep macaque2) Export the imagepodman save macaque:1.2 -o /home/candidate/macaque-1.2.tarVerify:ls -lh /home/candidate/macaque-1.2.tarOption C: Using Buildah (OCI format)cd /home/candidate/buildbuildah bud -t macaque:1.2 .buildah push macaque:1.2 oci-archive:/home/candidate/macaque-1.2.tar
Question # 8
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00027
Task
A Deployment named app-deployment in namespace prod runs a web application port
0001 A Deployment named app-deployment in namespace prod runs a web application
on port 8081.
The Deployment 's manifest files can be found at
/home/candidate/spicy-pikachu/app-deployment.yaml
Modify the Deployment specifying a readiness probe using path /healthz .
Set initialDelaySeconds to 6 and periodSeconds to 3.
Answer: See the Explanation below for complete solution. Explanation:Do this on ckad00027 and edit the given manifest file (that’s what the task expects).0) Connect to correct hostssh ckad000271) Open the manifest and identify the container + portcd /home/candidate/spicy-pikachuls -lsed -n '1,200p' app-deployment.yamlConfirm the container port is 8081 in the YAML (usually under ports:).2) Edit the YAML to add a readinessProbeEdit the file:vi app-deployment.yamlInside the Deployment, locate:spec:template:spec:containers:- name: ...image: ...Add this under the container (same indentation level as image, ports, etc.):readinessProbe:httpGet:path: /healthzport: 8081initialDelaySeconds: 6periodSeconds: 3Notes:Use port: 8081 (because the app runs on 8081).Ensure indentation is correct (2 spaces per level commonly).Save and exit.3) Apply the updated manifestkubectl apply -f /home/candidate/spicy-pikachu/app-deployment.yaml4) Ensure the Deployment rolls out successfullykubectl -n prod rollout status deploy app-deployment5) Verify the readiness probe is setCheck the probe from the live object:kubectl -n prod get deploy app-deployment -ojsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'And confirm pods are becoming Ready:kubectl -n prod get pods -l app=app-deploymentIf the label selector differs, just:kubectl -n prod get podskubectl -n prod describe pod <pod-name> | sed -n '/Readiness:/,/Conditions:/p'That completes the task: readiness probe on /healthz, initialDelaySeconds: 6,periodSeconds: 3.
Question # 9
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00032
The Pod for the Deployment named nosql in the haddock namespace fails to start because
its Container runs out of resources.
Update the nosql Deployment so that the Container :
requests 128Mi of memory
limits the memory to half the maximum memory constraint set for the haddock
namespace
Answer: See the Explanation below for complete solution. Explanation:Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:memory request = 128Mi? memory limit = half of the namespace’s maximum memory constraintYou must do this on the correct host.0) Connect to the correct hostssh ckad000321) Confirm the failing Deployment / Podskubectl -n haddock get deploy nosqlkubectl -n haddock get pods -l app=nosql 2>/dev/null || kubectl -n haddock get podsIf pods are crashing, check why (you’ll likely see OOMKilled):kubectl -n haddock describe pod <pod-name>2) Find the maximum memory constraint set for the haddock namespaceIn CKAD labs, this is commonly enforced by a LimitRange (max memory per container).Sometimes it can also be a ResourceQuota.2A) Check LimitRange (most likely)kubectl -n haddock get limitrangekubectl -n haddock get limitrange -o yamlExtract the max memory value quickly:MAX_MEM=$(kubectl -n haddock get limitrange -ojsonpath='{.items[0].spec.limits[0].max.memory}')echo "Namespace max memory constraint: $MAX_MEM"2B) If no LimitRange exists, check ResourceQuotakubectl -n haddock get resourcequotakubectl -n haddock describe resourcequotaIf quota is used, you’re looking for something like limits.memory (but the question wording“maximum memory constraint” usually points to LimitRange max.memory).3) Compute “half of the max memory constraint”Run this small snippet to compute HALF in Mi (handles Mi and Gi):HALF_MEM=$(python3 - <<'PY'import os, req = os.environ.get("MAX_MEM","").strip()m = re.fullmatch(r"(\d+)(Mi|Gi)", q)if not m:raise SystemExit(f"Cannot parse MAX_MEM='{q}'. Expected like 512Mi or 1Gi.")val = int(m.group(1))unit = m.group(2)# convert to Mimi = val if unit == "Mi" else val * 1024half_mi = mi // 2print(f"{half_mi}Mi")PY)echo "Half of max: $HALF_MEM"Example: if MAX_MEM=512Mi HALF_MEM=256MiExample: if MAX_MEM=1Gi HALF_MEM=512Mi4) Update the nosql Deployment (DO NOT delete it)First, get the container name (Deployment may have a custom container name):kubectl -n haddock get deploy nosql -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'Now set resources (this updates the Deployment in-place):kubectl -n haddock set resources deploy nosql \--requests=memory=128Mi \--limits=memory=$HALF_MEM5) Ensure the update rolls out successfullykubectl -n haddock rollout status deploy nosql6) Verify the pod has the right requests/limitskubectl -n haddock get deploy nosql -ojsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'kubectl -n haddock get podsPick the new pod and confirm:kubectl -n haddock describe pod <new-pod-name> | sed -n '/Requests:/,/Limits:/p'You should see:Requests: memory 128MiLimits: memory <HALF_MEM>If rollout fails (common cause)If you accidentally set a limit above the namespace max, pods won’t start. Check events:kubectl -n haddock describe deploy nosqlkubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20
Question # 10
Context
You are asked to set resource requests and limits for a running workload to ensure fair
resource management.
“Do not delete the existing Deployment . Failure to do so will result in a reduced score.”
Next, ensure that the total amount of resources in the namespace matches the maximum
resources the Pods from the nginx-resources Deployment can request.
Failure to do so will result in the updated Deployment failing to roll out successfully.
Answer: See the Explanation below for complete solution. Explanation:Below are the exact steps/commands you can run.1) Locate the Deployment and its namespacekubectl get deploy -A | grep nginx-resourcesYou should see output like:<namespace> nginx-resources ...Set a variable (replace <NS> with what you see):NS=<NS>Confirm replicas:kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'2) Check if there is a ResourceQuota in that namespacekubectl -n $NS get resourcequotakubectl -n $NS describe resourcequotaIf there is a quota, note these fields (common ones):requests.cpurequests.memorylimits.cpulimits.memory3) Decide requests/limits for the Deployment (example values)If the question (in your environment) provides specific values, use those.If it doesn’t, a typical safe pair is:requests: cpu: 100m, memory: 128Milimits: cpu: 200m, memory: 256MiI’ll proceed with these example values. If your lab specifies different numbers, just swap them in.4) Update the existing Deployment (DO NOT DELETE)Option A (fastest): kubectl set resourcesAssuming the container name is the first container (we’ll detect it):kubectl -n $NS get deploy nginx-resources -ojsonpath='{.spec.template.spec.containers[*].name}{"\n"}'If it prints a single container name, set it like this:kubectl -n $NS set resources deploy nginx-resources \--requests=cpu=100m,memory=128Mi \--limits=cpu=200m,memory=256MiVerify the Deployment now has resourceskubectl -n $NS get deploy nginx-resources -ojsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'5) Compute the total resources requested by the DeploymentGet replicas:REPLICAS=$(kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}')echo $REPLICAS6) Ensure the namespace quota matches (or exceeds) those totalsThis is the part the question warns about: if the quota is too low, the Deployment updatewill fail to roll out.6.1 If a ResourceQuota already existsPatch it to allow at least the totals you calculated.First, identify quota name:RQ=$(kubectl -n $NS get resourcequota -o jsonpath='{.items[0].metadata.name}')echo $RQThen patch (example: replicas=2 requests.cpu=200m, requests.memory=256Mi):kubectl -n $NS patch resourcequota $RQ --type='merge' -p '{"spec": {"hard": {"requests.cpu": "200m","requests.memory": "256Mi","limits.cpu": "400m","limits.memory": "512Mi"}}}'Adjust those numbers to your replicas × request, and replicas × limit (if your quota alsoenforces limits).6.2 If there is NO ResourceQuotaCreate one that matches the Deployment max request totals.Example for replicas=2 with our sample requests/limits:cat <<EOF | kubectl apply -n $NS -f -apiVersion: v1kind: ResourceQuotametadata:name: nginx-resources-quotaspec:hard:requests.cpu: "200m"requests.memory: "256Mi"limits.cpu: "400m"limits.memory: "512Mi"EOF7) Verify rollout succeedskubectl -n $NS rollout status deploy nginx-resourceskubectl -n $NS get podsVerify the running pods actually have the requests/limits:kubectl -n $NS get pod -l app=nginx-resources -o jsonpath='{range.items[*]}{.metadata.name}{" "}{.spec.containers[0].resources}{"\n"}{end}'(If the label selector app=nginx-resources doesn’t exist, just pick a pod name from kubectlget pods and run:)kubectl -n $NS describe pod <pod-name> | sed -n '/Limits:/,/Requests:/p'Common reasons this fails (and the fix)Rollout stuck / pods pending with “exceeded quota”Check:kubectl -n $NS describe pod <pending-pod>kubectl -n $NS describe resourcequotaFix: increase ResourceQuota hard values to match required totals.You set requests higher than quota allowsFix: either reduce requests or raisequota.kubectl get deploy -A | grep nginx-resourceskubectl -n <NS> get deploy nginx-resources -ojsonpath='{.spec.replicas}{"\n"}{.spec.template.spec.containers[0].name}{"\n"}'kubectl -n <NS> describe resourcequota