Linux Foundation CKA 問題集

質問 1：
You must connect to the correct host.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000056
Task
Review and apply the appropriate NetworkPolicy from the provided YAML samples.
Ensure that the chosen NetworkPolicy is not overly permissive, but allows communication between the frontend and backend Deployments, which run in the frontend and backend namespaces respectively.
First, analyze the frontend and backend Deployments to determine the specific requirements for the NetworkPolicy that needs to be applied.
Next, examine the NetworkPolicy YAML samples located in the ~/netpol folder.
Failure to comply may result in a reduced score.
Do not delete or modify the provided samples. Only apply one of them.
Finally, apply the NetworkPolicy that enables communication between the frontend and backend Deployments, without being overly permissive.
正解：
Task Summary
* Connect to host cka000056
* Review existing frontend and backend Deployments
* Choose one correct NetworkPolicy from the ~/netpol directory
* The policy must:
* Allow traffic only from the frontend Deployment to the backend Deployment
* Avoid being overly permissive
* Apply the correct NetworkPolicy without modifying any sample files
Step-by-Step Instructions
Step 1: SSH into the correct node
ssh cka000056
Step 2: Inspect the frontend Deployment
Check the labels used in the frontend Deployment:
kubectl get deployment -n frontend -o yaml
Look under metadata.labels or spec.template.metadata.labels. Note the app or similar label (e.g., app:
frontend).
Step 3: Inspect the backend Deployment
kubectl get deployment -n backend -o yaml
Again, find the labels assigned to the pods (e.g., app: backend).
Step 4: List and review the provided NetworkPolicies
List the available files:
ls ~/netpol
Check the contents of each policy file:
cat ~/netpol/<file-name>.yaml
Look for a policy that:
* Has kind: NetworkPolicy
* Applies to the backend namespace
* Uses a podSelector that matches the backend pods
* Includes an ingress.from rule that references the frontend namespace using a namespaceSelector (and optionally a podSelector)
* Does not allow traffic from all namespaces or all pods
Here's what to look for in a good match:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-frontend-to-backend
namespace: backend
spec:
podSelector:
matchLabels:
app: backend
ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend
Even better if the policy includes:
- namespaceSelector:
matchLabels:
name: frontend
podSelector:
matchLabels:
app: frontend
This limits access to pods in the frontend namespace with a specific label.
Step 5: Apply the correct NetworkPolicy
Once you've identified the best match, apply it:
kubectl apply -f ~/netpol/<chosen-file>.yaml
Apply only one file. Do not alter or delete any existing sample.
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml
Command Summary
ssh cka000056
kubectl get deployment -n frontend -o yaml
kubectl get deployment -n backend -o yaml
ls ~/netpol
cat ~/netpol/*.yaml # Review carefully
kubectl apply -f ~/netpol/<chosen-file>.yaml

質問 2：
What is the maximum number of samples that can be submitted to WildFire manually per day?
A. 15,000
B. 2,000
C. 1,000
D. 5,000
正解：C

質問 3：
Create a snapshot of the etcd instance running at https://127.0.0.1:2379, saving the snapshot to the file path
/srv/data/etcd-snapshot.db.
The following TLS certificates/key are supplied for connecting to the server with etcdctl:
* CA certificate: /opt/KUCM00302/ca.crt
* Client certificate: /opt/KUCM00302/etcd-client.crt
* Client key: Topt/KUCM00302/etcd-client.key
正解：


質問 4：
List all the pods showing name and namespace with a json path expression See the solution below.
正解：
kubectl get pods -o=jsonpath="{.items[*]['metadata.name',
'metadata.namespace']}"

質問 5：
A Kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the case, and perform any appropriate steps to bring the node to a Ready state, ensuring that any changes are made permanent.
You can ssh to the failed node using:
[student@node-1] $ | ssh Wk8s-node-0
You can assume elevated privileges on the node with the following command:
[student@w8ks-node-0] $ | sudo -i
正解：