2V0-71.23 Practice Questions

VMware Tanzu Mission Control and Tanzu CLI package plugin are two methods that can be used to install Fluent Bit on a VMware Tanzu Kubernetes Grid cluster. VMware Tanzu Mission Control is a centralized management platform for Kubernetes clusters across different environments. It allows users to install Fluent Bit on any attached cluster from the web console or the CLI, and configure the output plugins for log forwarding. Tanzu CLI package plugin is a command-line tool that enables users to interact with VMware Tanzu packages and services. It allows users to install Fluent Bit from a package repository on any standalone management or workload cluster, and configure the output plugins for log forwarding. References: Install Fluent Bit for Log Forwarding - VMware Docs, Implement Log Forwarding with Fluent Bit - VMware Docs

Two configurations that are valid for Zonal Supervisor Deployment are three-zone and one-zone. A Zonal Supervisor Deployment is a way of deploying the vSphere with Tanzu Supervisor Cluster across multiple vSphere clusters that are mapped to vSphere Zones1. A vSphere Zone is a logical grouping of vSphere clusters that share common characteristics, such as network connectivity, power source, or physical location2. A Zonal Supervisor Deployment provides high availability and fault tolerance for Kubernetes workloads by distributing them across different zones1. The supported configurations for Zonal Supervisor Deployment are:

• Three-zone: The Supervisor Cluster spans three vSphere clusters, each mapped to a different vSphere Zone. This configuration provides the highest level of availability and fault tolerance, as it can tolerate the failure of any one zone1.
• One-zone: The Supervisor Cluster runs on a single vSphere cluster that is mapped to a single vSphere Zone. This configuration is suitable for development or testing purposes, but does not provide any availability or fault tolerance guarantees1.

References: Requirements for Zonal Supervisor Deployment - VMware Docs, Create vSphere Zones for a Multi-Zone Supervisor Deployment - VMware Docs

The control plane nodes are the nodes that run the Kubernetes control plane components, such as the API server, the scheduler, the controller manager, and etcd. The control plane nodes are responsible for managing the cluster state and orchestrating workload operations. The possible counts of control plane nodes in a Tanzu Kubernetes Grid workload cluster are 1 or 3. The control plane must have an odd number of nodes to ensure quorum and high availability. A single control plane node is suitable for development or testing purposes, while three control plane nodes are recommended for production clusters23.

References: Deploy Workload Clusters - VMware Docs, Concepts and References - VMware Docs

Two services that require Transport Layer Security (TLS) certificates to provide encryption in VMware Tanzu Service Mesh are:

• Certificate Authority (CA) Service: A service that issues certificates to services in the service mesh to enable mutual TLS (mTLS) communication between them. The CA service uses a root certificate to sign the certificates for the services, and verifies the identity of the services using the certificates. The CA service also rotates the certificates periodically to ensure security8.
• Public Service: A service that exposes an internal service in the service mesh to external clients over HTTPS. The public service uses a TLS certificate to encrypt the traffic between the external clients and the internal service, and to authenticate itself to the clients. The TLS certificate must match the domain name of the public service9.

The other options are incorrect because:

• Internal Service: A service that runs inside the service mesh and communicates with other services using mTLS. The internal service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS10.
• Proxy Service: A service that acts as an intermediary between an internal service and an external service, such as a database or an API. The proxy service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS with the internal service. The proxy service also uses the external service’s certificate to verify its identity11.
• External Service: A service that runs outside the service mesh and communicates with an internal service over HTTPS or TCP. The external service does not require a TLS certificate from Tanzu Service Mesh, but rather uses its own certificate to encrypt the traffic with the internal service, and to authenticate itself to the internal service.

References: Certificate Authority (CA) Service, Public Services, Internal Services, Proxy Services,

Multus is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods. Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane. By installing these two packages in a VMware Tanzu Kubernetes Grid cluster, an administrator can create a pod with two interfaces and use Contour to route the application and management traffic to different networks.

The other options are incorrect because:

• external-dns is a package that synchronizes exposed Kubernetes services and ingresses with DNS providers. It does not provide multiple interfaces for pods.
• cert-manager is a package that automates the management and issuance of TLS certificates from various sources. It does not provide multiple interfaces for pods.
• qrafana is not a valid package name. The correct spelling is Grafana, which is a package that provides visualization and analytics for metrics collected by Prometheus. It does not provide multiple interfaces for pods.

References: Install Multus and Whereabouts for Container Networking, Install Contour for Ingress