Free Linux Foundation CKAD Practice Exam with Questions & Answers

Solution:

To deploy the counter pod to the cluster using the provided YAML spec file, you can use the kubectl apply command. The apply command creates and updates resources in a cluster.

kubectl apply -f /opt/KDOB00201/counter.yaml

This command will create the pod in the cluster. You can use the kubectl get pods command to check the status of the pod and ensure that it is running.

kubectl get pods

To retrieve all currently available application logs from the running pod and store them in the file /opt/KDOB0020l/log_Output.txt, you can use the kubectl logs command. The logs command retrieves logs from a container in a pod.

kubectl logs -f > /opt/KDOB0020l/log_Output.txt

Replace with the name of the pod.

You can also use -f option to stream the logs.

kubectl logs -f > /opt/KDOB0020l/log_Output.txt &

This command will retrieve the logs from the pod and write them to the /opt/KDOB0020l/log_Output.txt file.

Please note that the above command will retrieve all logs from the pod, including previous logs. If you want to retrieve only the new logs that are generated after running the command, you can add the --since flag to the kubectl logs command and specify a duration, for example --since=24h for logs generated in the last 24 hours.

Also, please note that, if the pod has multiple containers, you need to specify the container name using -c option.

kubectl logs -f -c > /opt/KDOB0020l/log_Output.txt

The above command will redirect the logs of the specified container to the file.

Solution:

Solution:

Solution:

Do this on ckad00027 and edit the given manifest file (that’s what the task expects).

0) Connect to correct host

ssh ckad00027

1) Open the manifest and identify the container + port

cd /home/candidate/spicy-pikachu

ls -l

sed -n '1,200p' app-deployment.yaml

Confirm the container port is 8081 in the YAML (usually under ports:).

2) Edit the YAML to add a readinessProbe

Edit the file:

vi app-deployment.yaml

Inside the Deployment, locate:

spec:

template:

spec:

containers:

- name: ...

image: ...

Add this under the container (same indentation level as image, ports, etc.):

readinessProbe:

httpGet:

path: /healthz

port: 8081

initialDelaySeconds: 6

periodSeconds: 3

Notes:

Use port: 8081 (because the app runs on 8081).

Ensure indentation is correct (2 spaces per level commonly).

Save and exit.

3) Apply the updated manifest

kubectl apply -f /home/candidate/spicy-pikachu/app-deployment.yaml

4) Ensure the Deployment rolls out successfully

kubectl -n prod rollout status deploy app-deployment

5) Verify the readiness probe is set

Check the probe from the live object:

kubectl -n prod get deploy app-deployment -o jsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'

And confirm pods are becoming Ready:

kubectl -n prod get pods -l app=app-deployment

If the label selector differs, just:

kubectl -n prod get pods

kubectl -n prod describe pod | sed -n '/Readiness:/,/Conditions:/p'

That completes the task: readiness probe on /healthz, initialDelaySeconds: 6, periodSeconds: 3.

ssh ckad00043

You have two deliverables here:

Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).

Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).

Below is the exact CKAD-style workflow.

1) Find the missing RBAC permissions (use logs + events)

1.1 Identify the pods for the Deployment

kubectl -n cute-panda get deploy scraper

kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods

Pick one pod name and check logs:

kubectl -n cute-panda logs deploy/scraper --tail=100

If the pod is crashlooping and logs are short:

POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n cute-panda logs "$POD" --previous --tail=200

1.2 Look specifically for “Forbidden” lines

Most apps print errors like:

... is forbidden: User "system:serviceaccount:cute-panda:default" cannot list resource "pods" in API group "" in the namespace "cute-panda"

or cannot get resource "configmaps"...

or cannot watch ...

If you don’t see it in logs, check events:

kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 30

1.3 Extract verb/resource/apiGroup from the error

From a typical Kubernetes RBAC “forbidden” message, capture:

verb: get/list/watch/create/update/patch/delete

resource: pods, configmaps, secrets, deployments, etc.

apiGroup: "" (core), apps, batch, etc.

namespace: cute-panda (this is a namespaced permission if it’s a Role)

You may have multiple “cannot …” lines → you need to allow all of them.

2) Create the ServiceAccount scraper (required by the task)

kubectl -n cute-panda create serviceaccount scraper

kubectl -n cute-panda get sa scraper

3) Create the RBAC objects to grant the needed permissions

The task says “A Deployment needs specific RBAC permissions” — in CKAD, that usually means: Role + RoleBinding (namespaced) bound to your new ServiceAccount.

3.1 Create a Role (template you fill from the log output)

Create scraper-role.yaml:

cat <<'EOF' > scraper-role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: scraper-role

namespace: cute-panda

rules:

# EXAMPLE ONLY: replace these rules with what your logs show

- apiGroups: [""]

resources: ["pods"]

verbs: ["get","list","watch"]

EOF

Apply it:

kubectl apply -f scraper-role.yaml

3.2 Bind the Role to the ServiceAccount

kubectl -n cute-panda create rolebinding scraper-rb \

--role=scraper-role \

--serviceaccount=cute-panda:scraper

Verify:

kubectl -n cute-panda get role scraper-role

kubectl -n cute-panda get rolebinding scraper-rb -o yaml

4) Update the Deployment to use the new ServiceAccount (so it actually works)

Check current SA (likely default):

kubectl -n cute-panda get deploy scraper -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'

Patch it to use scraper:

kubectl -n cute-panda patch deploy scraper -p '{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'

Rollout:

kubectl -n cute-panda rollout status deploy scraper

Re-check logs to confirm RBAC errors are gone:

kubectl -n cute-panda logs deploy/scraper --tail=100

Solution:

Solution:

To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.

First, you will need to create a livenessProbe and a readinessProbe in the pod's definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.

Here's an example of how you can configure the liveness and readiness probes in the pod definition yaml file:

apiVersion: v1

kind: Pod

metadata:

name: probe-pod

spec:

containers:

- name: probe-pod

image:

ports:

- containerPort: 8080

livenessProbe:

httpGet:

path: /healthz

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

readinessProbe:

httpGet:

path: /started

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.

You can use kubectl to create the pod by running the following command:

kubectl apply -f .yaml

Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.

Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.

The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.

ssh ckad00028

You’re seeing RBAC errors like:

User "system:serviceaccount:gorilla:default" cannot list resource "pods" … in namespace "gorilla"

That means the Pod is running as the default ServiceAccount and needs permission to list pods (and possibly also get/watch).

You must fix it by updating the Deployment (via its manifest file) and giving it the proper RBAC.

1) Confirm the error in logs

kubectl -n gorilla get deploy honeybee-deployment

kubectl -n gorilla logs deploy/honeybee-deployment --tail=200

If it’s CrashLooping and you need previous logs:

POD=$(kubectl -n gorilla get pods -l app=honeybee -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || kubectl -n gorilla get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n gorilla logs "$POD" --previous --tail=200

You should see the “cannot list resource pods” line.

2) Create a dedicated ServiceAccount for the app

(Using a dedicated SA is standard practice; the task wants you to “resolve the errors”.)

kubectl -n gorilla create serviceaccount honeybee-sa

kubectl -n gorilla get sa honeybee-sa

3) Create RBAC: Role + RoleBinding (namespaced)

This will allow listing pods in namespace gorilla.

cat <<'EOF' > honeybee-rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: honeybee-pod-reader

namespace: gorilla

rules:

- apiGroups: [""]

resources: ["pods"]

verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

name: honeybee-pod-reader-binding

namespace: gorilla

subjects:

- kind: ServiceAccount

name: honeybee-sa

namespace: gorilla

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: Role

name: honeybee-pod-reader

EOF

Apply it:

kubectl apply -f honeybee-rbac.yaml

Quick verification (optional but very useful):

kubectl auth can-i list pods -n gorilla --as=system:serviceaccount:gorilla:honeybee-sa

Should return yes.

4) Update the Deployment manifest to use the new ServiceAccount

The manifest is at:

/home/candidate/prompt-escargot/honey bee-deployment.yaml

Because there’s a space in the filename, quote it.

4.1 Edit the file

cd /home/candidate/prompt-escargot

ls -l

vi "honey bee-deployment.yaml"

In the Deployment YAML, add (or set) this under:

spec.template.spec:

serviceAccountName: honeybee-sa

Example location:

spec:

template:

spec:

serviceAccountName: honeybee-sa

containers:

- name: ...

Save and exit.

4.2 Apply the updated manifest

kubectl apply -f "/home/candidate/prompt-escargot/honey bee-deployment.yaml"

5) Ensure rollout succeeds and errors are gone

kubectl -n gorilla rollout status deploy honeybee-deployment

kubectl -n gorilla logs deploy/honeybee-deployment --tail=200

Also confirm the pods now run with the right ServiceAccount:

kubectl -n gorilla get pods -o jsonpath='{range .items[*]}{.metadata.name}{" sa="}{.spec.serviceAccountName}{"\n"}{end}'

You should no longer see the RBAC “cannot list pods” errors.

Solution: