Linux Foundation CKAD 問題集

質問 1：
You have a microservice application that is deployed as a Deployment. You want to implement a mechanism to handle temporary network issues or other transient failures that may occur during the application's communication with external services. Explain how you can use readiness probes and liveness probes in combination with a restart policy to address these failures.
正解：
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define Readiness Probes:
- Add a 'readinessProbe' to the container spec of your application pods.
- The probe should check the health and readiness of the application to receive incoming requests.
- This probe should be executed periodically.
- If the probe fails, the pod will be considered not ready and won't receive traffic.
- Example using a TCP socket check:

2. Define Liveness Probes: - Add a 'livenessProbe' to the container spec of your application pods- - This probe should check the health of the application pod itself. - It should be executed periodically to detect issues that might not affect readiness but indicate a problem with the application. - If the liveness probe fails for a specified number of consecutive attempts, the pod will be restarted. - Example using a HTTP endpoint cneck:

3. Set Restart Policy: - Ensure that the restart policy for the pod is set to 'Always' (the default) to automatically restart the pod upon failure detected by the liveness probe. 4. Implement Health Check Endpoints: - Implement the health check endpoints within your application (e.g., ' Ihealth' for the liveness probe, a simple TCP connection for the readiness probe) to allow probes to assess the nealth of the application and its dependencies. 5. Verify and Monitor: - Deploy the updated Deployment and simulate network failures or other transient issues. - Monitor the pods' health and observe that they are automatically restarted and marked as not ready when necessary, ensuring continued application availability despite temporary disruptions.

質問 2：
You are developing a container image for a .NET Core application tnat requires a specific version of tne .NET Core SDK to be installed. How would you ensure that the correct SDK version is available within your Docker image during the build process?
正解：
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
I). Choose .NET SDK Base Image:
- Select a base image that includes the desired .NET Core SDK version from Docker Hub.
- Example (for .NET core 3.1 SDK):
dockerfile
FROM mcr-microsoft.com/dotneVsdk:3.1
2. Copy Application Code:
- Copy your .NET Core application code into the Docker image.
- Example:
dockerfile
COPY
3. Build the Application:
- Use the 'RIJN' instruction to build your .NET Core application using the 'dotnet publish' command.
- Example:
dockerfile
RUN dotnet publish -c Release -o /app
4. Define Runtime Image (Optional):
- Create a second stage Dockerfile that uses a smaller base image, copying only the published application files.
- This optimizes the final image size.
- Example:
dockerfile
FROM mcr-microsoft.com/dotnet/aspnet:3.1
COPY -from=build /app /app
WORKDIR /app
ENTRYPOINT ["dotnet", "your-app.dll"]
5. Build and Deploy:
- Use 'docker build' to construct the final Docker image.
- Deploy this image to your Kubernetes cluster.

質問 3：
You are running a web application with multiple services exposed via Kubernetes Ingress. The application has two distinct environments: 'staging' and 'production' , each with its own set of services and domain names. You need to configure Ingress rules to route traffic to the appropriate services based on the requested hostname and environment. For example, requests to 'staging.example.com' should be directed to the staging environment, while requests to 'example.com' should go to the production environment. Implement this configuration using Ingress rules.
正解：
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Service for Each Environment:
- Define services for both 'staging' and 'production' environments, ensuring that the services for each environment are named appropriately. For example, 'staging-service' and .

2. Create an Ingress Resource: - Define an Ingress resource that maps the hostnames to the corresponding services.

3. Apply the Configuration: - Apply the service and ingress definitions using 'kubectl apply -f services.yaml' and 'kubectl apply -f ingress.yaml' respectively. 4. Test the Configuration: - Access 'staging.example.com' and 'example.com' in your browser to ensure that the traffic is directed to the correct services and environments. ,

質問 4：
You are building a microservice application that consists of three components: a frontend service, a backend service, and a database service_ Each service is deployed as a separate pod in a Kubernetes cluster_ You need to implement health checks for each service to ensure that the application remains healthy and available. The frontend service should be able to reach both the backend service and the database service successfully. How would you implement health checks using Kustomize and ensure that the trontend service can only access the backend service and the database service within the cluster?
正解：
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define Service Resources: Create separate Kubernetes Service resources for each component (frontend, backend, and database) using Kustomize.

2. Implement Health Checks: Add liveness and readiness probes to the containers in each pod's deployment configuration. This will ensure that the pods are continuously monitored for their health.

3. Configure Network Policy: Create a Network Policy to restrict communication between pods. This policy will allow the frontend service to communicate With the backend service and the database service, but prevent it from accessing other pods in the cluster.

4. Apply Configurations: Apply the Kustomize configurations using 'kuactl apply -k .s. This Will create the services, deployments, and network policy in your Kubernetes cluster. 5. Test Health Checks: Verify the health checks are working correctly by checking the pod status and using 'kubectl exec -it' to interact With the pods. You can also use tools like 'kubectl describe deployment' to see tne results of the probes. - If the health checks are not working, troubleshoot the issues by Checking logs, inspecting pod events, and ensuring the probes are configured correctly in the deployments. - You can also use 'kubectl logs to check for any error messages related to network connectivity or the health checks. - If you are experiencing network policy issues, ensure that the policy is correctly applied, and that there are no conflicts with other policies. 6. Monitor Application Health: use Kubernetes monitoring tools to track the health of your microservices and ensure that any issues are detected and resolved promptly. Tools like Prometheus and Grafana can be used to monitor the liveness and readiness probes, as well as other metrics related to your application's health. - Health Checks: The liveness and readiness probes in the deployments allow Kubernetes to continuously monitor the health of the pods- If a probe fails, Kubernetes Will restan the pod or mark it as unhealthy, preventing traffic from being routed to tne pod. - Network Policy: The Network Policy restricts communication between pods. In this example, it ensures that the frontend service can only communicate with the backend service and the database service. - Kustomize: Kustomize helps to simplify tne management of Kubernetes configurations. You can define common configurations and override them for specific deployments or environments using Kustomize. Note: Make sure to adapt the port numbers and labels in the configurations to match your application's setup. You may also need to adjust the initial delay, period, timeout, and failure thresholds for the probes based on the requirements ot your services. ,

質問 5：
You are building a web application with two microservices: a frontend service ('frontend') and a backend service ( ' backend'). The frontend service requires access to the backend service, which iS exposed on port 8080 within the Kubernetes cluster. How would you configure an Ingress resource to direct traffic to the correct service based on the hostname, ensuring that the frontend service can access the backend service internally without exposing the backend service to the public internet?
正解：
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Service tor the Backend Service:
- Define a Service for the 'backend' service, exposing it internally within the Kubernetes cluster on port 8080.

2. Configure the Ingress Resource: - Create an Ingress resource that directs traffic to the frontend service based on the hostname, allowing the frontend service to access the backend service internally without exposing it to the public internet - Define the Ingress rule to map the hostname 'frontend-example.com' to the 'frontend' service on port 80. - Configure an Ingress rule to enable access to the 'backend' service on port 8080 using the hostname 'internal-backend-example-com' within the Kubernetes cluster.

3. Create a Secret for the Frontend TLS Certificate: - Create a Secret in Kubernetes to store the TLS certificate and key for the frontend service.

4. Apply the Resources: - Apply the Service, Ingress, and Secret YAML files to your Kubernetes cluster using 'kubectl apply -f 5. Access the Frontend Service: - Access the frontend service using the hostname 'frontend-example.com'. The frontend service can now access the backend service internally using the hostname 'internal-backend-example-com' without exposing the backend service to the public internet.]