Free Linux Foundation CKA Practice Exam with Questions & Answers | Set: 2

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\4 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\4 C.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\4 D.JPG

Task Summary

Create an Ingress named echo in the sound-repeater namespace that:

Routes requests to /echo on host example.org

Forwards traffic to service echoserver-service

Uses service port 8080

Verification should return HTTP 200 using curl

✅ Step-by-Step Answer

1️⃣ SSH into the correct node

As shown in the image:

bash

CopyEdit

ssh cka000024

⚠️ Skipping this will result in a ZERO score!

2️⃣ Verify the namespace and service

Ensure the sound-repeater namespace and echoserver-service exist:

kubectl get svc -n sound-repeater

Look for:

echoserver-service ClusterIP ... 8080/TCP

3️⃣ Create the Ingress manifest

Create a YAML file: echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

4️⃣ Apply the Ingress resource

kubectl apply -f echo-ingress.yaml

5️⃣ Test with curl as instructed

Use the exact verification command:

curl -o /dev/null -s -w "%{http_code}\n" http://example.org/echo

✅ You should see:

200

✅ Final Answer Summary

ssh cka000024

kubectl get svc -n sound-repeater

# Create the Ingress YAML

cat < echo-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: echo

namespace: sound-repeater

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /$1

spec:

rules:

- host: example.org

http:

paths:

- path: /echo

pathType: Prefix

backend:

service:

name: echoserver-service

port:

number: 8080

EOF

kubectl apply -f echo-ingress.yaml

curl -o /dev/null -s -w "%{http_code}\n" http://example.org/echo

kubectl run --generator=run-pod/v1 --image=nginx -- labels=env=prod nginx-prod --dry-run -o yaml > nginx-prodpod.yaml Now, edit nginx-prod-pod.yaml file and remove entries like “creationTimestamp: null” “dnsPolicy: ClusterFirst”

vim nginx-prod-pod.yaml

apiVersion: v1

kind: Pod

metadata:

labels:

env: prod

name: nginx-prod

spec:

containers:

- image: nginx

name: nginx-prod

restartPolicy: Always

# kubectl create -f nginx-prod-pod.yaml

kubectl run --generator=run-pod/v1 --image=nginx --

labels=env=dev nginx-dev --dry-run -o yaml > nginx-dev-pod.yaml

apiVersion: v1

kind: Pod

metadata:

labels:

env: dev

name: nginx-dev

spec:

containers:

- image: nginx

name: nginx-dev

restartPolicy: Always

# kubectl create -f nginx-prod-dev.yaml

Verify :

kubectl get po --show-labels

kubectl get po -l env=prod

kubectl get po -l env=dev

Solution:

#backup

ETCDCTL_API=3 etcdctl --endpoints="https://127.0.0.1:2379 " --cacert=/opt/KUIN000601/ca.crt --cert=/opt/KUIN000601/etcd-client.crt --key=/opt/KUIN000601/etcd-client.key snapshot save /etc/data/etcd-snapshot.db

#restore

ETCDCTL_API=3 etcdctl --endpoints="https://127.0.0.1:2379 " --cacert=/opt/KUIN000601/ca.crt --cert=/opt/KUIN000601/etcd-client.crt --key=/opt/KUIN000601/etcd-client.key snapshot restore /var/lib/backup/etcd-snapshot-previoys.db

Solution:

kubectl get deploy front-end

kubectl edit deploy front-end -o yaml

#port specification named http

#service.yaml

apiVersion: v1

kind: Service

metadata:

name: front-end-svc

labels:

app: nginx

spec:

ports:

- port: 80

protocol: tcp

name: http

selector:

app: nginx

type: NodePort

# kubectl create -f service.yaml

# kubectl get svc

# port specification named http

kubectl expose deployment front-end --name=front-end-svc --port=80 --tarport=80 --type=NodePort

kubectl run busybox --image=busybox --restart=Never -- /bin/sh -c

"sleep 3600"

Task Summary

SSH into cka000048b

Update the nginx-config ConfigMap in the nginx-static namespace to allow TLSv1.2

Ensure the nginx-static Deployment picks up the new config

Verify the change using the provided curl command

Step-by-Step Instructions

Step 1: SSH into the correct host

ssh cka000048b

Step 2: Get the ConfigMap

kubectl get configmap nginx-config -n nginx-static -o yaml > nginx-config.yaml

Open the file for editing:

nano nginx-config.yaml

Look for the TLS configuration in the data field. You are likely to find something like:

ssl_protocols TLSv1.3;

Modify it to include TLSv1.2 as well:

ssl_protocols TLSv1.2 TLSv1.3;

Save and exit the file.

Now update the ConfigMap:

kubectl apply -f nginx-config.yaml

Step 3: Restart the NGINX pods to pick up the new ConfigMap

Pods will not reload a ConfigMap automatically unless it’s mounted in a way that supports dynamic reload and the app is watching for it (NGINX typically doesn't by default).

The safest way is to restart the pods:

Option 1: Roll the deployment

kubectl rollout restart deployment nginx-static -n nginx-static

Option 2: Delete pods to force recreation

kubectl delete pod -n nginx-static -l app=nginx-static

Step 4: Verify using curl

Use the provided curl command to confirm that TLS 1.2 is accepted:

curl --tls-max 1.2 https://web.k8s.local

A successful response means the TLS configuration is correct.

Final Command Summary

ssh cka000048b

kubectl get configmap nginx-config -n nginx-static -o yaml > nginx-config.yaml

nano nginx-config.yaml # Modify to include "ssl_protocols TLSv1.2 TLSv1.3;"

kubectl apply -f nginx-config.yaml

kubectl rollout restart deployment nginx-static -n nginx-static

# or

kubectl delete pod -n nginx-static -l app=nginx-static

curl --tls-max 1.2 https://web.k8s.local

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\9 B.JPG

// create a pod

kubectl run nginx --image=nginx --restart=Never --port=80

// List the pod with different verbosity

kubectl get po nginx --v=7

kubectl get po nginx --v=8

kubectl get po nginx --v=9

Task Summary

You are given a host to prepare for Kubernetes:

Use dpkg to install cri-dockerd

Enable and start the cri-docker service

Set net.bridge.bridge-nf-call-iptables to 1 via sysctl

Step-by-Step Instructions

1️⃣ SSH into the correct node

bash

CopyEdit

ssh cka000051

⚠️ Required — failure to connect to the correct host = zero score.

2️⃣ Install cri-dockerd

You are told the .deb file is already located at:

bash

CopyEdit

~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb

Install it with dpkg:

bash

CopyEdit

sudo dpkg -i ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb

???? If any dependencies are missing (e.g., golang or containerd), you might need:

bash

CopyEdit

sudo apt-get install -f -y

But usually, the exam system provides a pre-validated .deb environment.

3️⃣ Enable and start cri-docker service

Start and enable both services:

bash

CopyEdit

sudo systemctl enable cri-docker.service

sudo systemctl enable --now cri-docker.socket

sudo systemctl start cri-docker.service

Check status (optional but smart):

bash

CopyEdit

sudo systemctl status cri-docker.service

You should see it active (running).

4️⃣ Configure the sysctl parameter

Set net.bridge.bridge-nf-call-iptables=1 immediately and persistently.

Step A: Apply immediately:

sudo sysctl net.bridge.bridge-nf-call-iptables=1

Step B: Persist it in /etc/sysctl.d:

Create or modify a file:

echo "net.bridge.bridge-nf-call-iptables = 1" | sudo tee /etc/sysctl.d/k8s.conf

Reload sysctl:

sudo sysctl --system

Verify:

sysctl net.bridge.bridge-nf-call-iptables

Should return:

net.bridge.bridge-nf-call-iptables = 1

✅ Now the system is ready for kubeadm with Docker (via cri-dockerd)!

ssh cka000051

sudo dpkg -i ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb

sudo systemctl enable cri-docker.service

sudo systemctl enable --now cri-docker.socket

sudo systemctl start cri-docker.service

sudo sysctl net.bridge.bridge-nf-call-iptables=1

echo "net.bridge.bridge-nf-call-iptables = 1" | sudo tee /etc/sysctl.d/k8s.conf

sudo sysctl --system