CKAD Practice Questions

Solution:

Solution:

Solution:

To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.

First, you will need to create a livenessProbe and a readinessProbe in the pod's definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.

Here's an example of how you can configure the liveness and readiness probes in the pod definition yaml file:

apiVersion: v1

kind: Pod

metadata:

name: probe-pod

spec:

containers:

- name: probe-pod

image:

ports:

- containerPort: 8080

livenessProbe:

httpGet:

path: /healthz

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

readinessProbe:

httpGet:

path: /started

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.

You can use kubectl to create the pod by running the following command:

kubectl apply -f .yaml

Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.

Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.

The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.

To find the broken pod and store its name and namespace to /opt/KDOB00401/broken.txt, you can use the kubectl get pods command and filter the output by the status of the pod.

kubectl get pods --field-selector=status.phase=Failed -o jsonpath='{.items[*].metadata.namespace}/{.items[*].metadata.name}' > /opt/KDOB00401/broken.txt

This command will list all pods with a status of Failed and output their names and namespaces in the format /. The output is then written to the /opt/KDOB00401/broken.txt file.

To store the associated error events to a file /opt/KDOB00401/error.txt, you can use the kubectl describe command to retrieve detailed information about the pod, and the grep command to filter the output for error events.

kubectl describe pods --namespace | grep -i error -B5 -A5 > /opt/KDOB00401/error.txt

Replace and with the name and namespace of the broken pod you found in the previous step.

This command will output detailed information about the pod, including error events. The grep command filters the output for lines containing "error" and also prints 5 lines before and after the match.

To fix the issue, you need to analyze the error events and find the root cause of the issue.

It could be that the application inside the pod is not running, the container image is not available, the pod has not enough resources, or the liveness probe configuration is incorrect.

Once you have identified the cause, you can take appropriate action, such as restarting the application, updating the container image, increasing the resources, or modifying the liveness probe configuration.

After fixing the issue, you can use the kubectl get pods command to check the status of the pod and ensure

Solution:

ssh ckad00043

You have two deliverables here:

Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).

Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).

Below is the exact CKAD-style workflow.

1) Find the missing RBAC permissions (use logs + events)

1.1 Identify the pods for the Deployment

kubectl -n cute-panda get deploy scraper

kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods

Pick one pod name and check logs:

kubectl -n cute-panda logs deploy/scraper --tail=100

If the pod is crashlooping and logs are short:

POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n cute-panda logs "$POD" --previous --tail=200

1.2 Look specifically for “Forbidden” lines

Most apps print errors like:

... is forbidden: User "system:serviceaccount:cute-panda:default" cannot list resource "pods" in API group "" in the namespace "cute-panda"

or cannot get resource "configmaps"...

or cannot watch ...

If you don’t see it in logs, check events:

kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 30

1.3 Extract verb/resource/apiGroup from the error

From a typical Kubernetes RBAC “forbidden” message, capture:

verb: get/list/watch/create/update/patch/delete

resource: pods, configmaps, secrets, deployments, etc.

apiGroup: "" (core), apps, batch, etc.

namespace: cute-panda (this is a namespaced permission if it’s a Role)

You may have multiple “cannot …” lines → you need to allow all of them.

2) Create the ServiceAccount scraper (required by the task)

kubectl -n cute-panda create serviceaccount scraper

kubectl -n cute-panda get sa scraper

3) Create the RBAC objects to grant the needed permissions

The task says “A Deployment needs specific RBAC permissions” — in CKAD, that usually means: Role + RoleBinding (namespaced) bound to your new ServiceAccount.

3.1 Create a Role (template you fill from the log output)

Create scraper-role.yaml:

cat <<'EOF' > scraper-role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: scraper-role

namespace: cute-panda

rules:

# EXAMPLE ONLY: replace these rules with what your logs show

- apiGroups: [""]

resources: ["pods"]

verbs: ["get","list","watch"]

EOF

Apply it:

kubectl apply -f scraper-role.yaml

3.2 Bind the Role to the ServiceAccount

kubectl -n cute-panda create rolebinding scraper-rb \

--role=scraper-role \

--serviceaccount=cute-panda:scraper

Verify:

kubectl -n cute-panda get role scraper-role

kubectl -n cute-panda get rolebinding scraper-rb -o yaml

4) Update the Deployment to use the new ServiceAccount (so it actually works)

Check current SA (likely default):

kubectl -n cute-panda get deploy scraper -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'

Patch it to use scraper:

kubectl -n cute-panda patch deploy scraper -p '{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'

Rollout:

kubectl -n cute-panda rollout status deploy scraper

Re-check logs to confirm RBAC errors are gone:

kubectl -n cute-panda logs deploy/scraper --tail=100

Below are the exact steps/commands you can run.

1) Locate the Deployment and its namespace

kubectl get deploy -A | grep nginx-resources

You should see output like:

nginx-resources ...

Set a variable (replace with what you see):

NS=

Confirm replicas:

kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'

2) Check if there is a ResourceQuota in that namespace

kubectl -n $NS get resourcequota

kubectl -n $NS describe resourcequota

If there is a quota, note these fields (common ones):

requests.cpu

requests.memory

limits.cpu

limits.memory

3) Decide requests/limits for the Deployment (example values)

If the question (in your environment) provides specific values, use those.

If it doesn’t, a typical safe pair is:

requests: cpu: 100m, memory: 128Mi

limits: cpu: 200m, memory: 256Mi

I’ll proceed with these example values. If your lab specifies different numbers, just swap them in.

4) Update the existing Deployment (DO NOT DELETE)

Option A (fastest): kubectl set resources

Assuming the container name is the first container (we’ll detect it):

kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'

If it prints a single container name, set it like this:

kubectl -n $NS set resources deploy nginx-resources \

--requests=cpu=100m,memory=128Mi \

--limits=cpu=200m,memory=256Mi

Verify the Deployment now has resources

kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'

5) Compute the total resources requested by the Deployment

Get replicas:

REPLICAS=$(kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}')

echo $REPLICAS

6) Ensure the namespace quota matches (or exceeds) those totals

This is the part the question warns about: if the quota is too low, the Deployment update will fail to roll out.

6.1 If a ResourceQuota already exists

Patch it to allow at least the totals you calculated.

First, identify quota name:

RQ=$(kubectl -n $NS get resourcequota -o jsonpath='{.items[0].metadata.name}')

echo $RQ

Then patch (example: replicas=2 → requests.cpu=200m, requests.memory=256Mi):

kubectl -n $NS patch resourcequota $RQ --type='merge' -p '{

"spec": {

"hard": {

"requests.cpu": "200m",

"requests.memory": "256Mi",

"limits.cpu": "400m",

"limits.memory": "512Mi"

}

}

}'

Adjust those numbers to your replicas × request, and replicas × limit (if your quota also enforces limits).

6.2 If there is NO ResourceQuota

Create one that matches the Deployment max request totals.

Example for replicas=2 with our sample requests/limits:

cat <

apiVersion: v1

kind: ResourceQuota

metadata:

name: nginx-resources-quota

spec:

hard:

requests.cpu: "200m"

requests.memory: "256Mi"

limits.cpu: "400m"

limits.memory: "512Mi"

EOF

7) Verify rollout succeeds

kubectl -n $NS rollout status deploy nginx-resources

kubectl -n $NS get pods

Verify the running pods actually have the requests/limits:

kubectl -n $NS get pod -l app=nginx-resources -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.spec.containers[0].resources}{"\n"}{end}'

(If the label selector app=nginx-resources doesn’t exist, just pick a pod name from kubectl get pods and run:)

kubectl -n $NS describe pod | sed -n '/Limits:/,/Requests:/p'

Common reasons this fails (and the fix)

Rollout stuck / pods pending with “exceeded quota”Check:

kubectl -n $NS describe pod

kubectl -n $NS describe resourcequota

Fix: increase ResourceQuota hard values to match required totals.

You set requests higher than quota allowsFix: either reduce requests or raise quota.

kubectl get deploy -A | grep nginx-resources

kubectl -n get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}{.spec.template.spec.containers[0].name}{"\n"}'

kubectl -n describe resourcequota

Solution:

Solution:

Solution: