Pass with CKAD Practice Materials 100% for sure

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Update the Deployment YAMLI
- Set 'strategy.type' to 'RollingLJpdate'
- Configure 'strategy.rollingupdate.maxunavailable' to 'I' to limit the number of unavailable replicas during the update.
- Set 'strategy-rollinglJpdate.maxSurge' to to allow for a maximum of six replicas during the update process.

2. Control Update Duration (Optional): - Optionally, you can use 'strategy-rollingUpdate.partition' to control the number of pods updated at a time. This allows you to slow down the update process by updating fewer pods at once- For example, setting 'partition' to ' 2' would update only two pods at a time.

3. Create or IJpdate the Deployment: - Apply the updated YAML file using 'kubectl apply -f my-critical-service-deployment.yaml' 4. Trigger the Update: - Update the image of your application to a newer version. - You can trigger the update by pushing a new image to your container registry. 5. Monitor the Update: - Use 'kubectl get pods -I app=my-critical-service to monitor the pod updates during the rolling update process. - Observe the pods being updated one at a time, ensuring that there's always at least four replicas available. 6. Check for Successful Update: - Once the update is complete, use 'kubectl describe deployment my-critical-service' to verify that the 'updatedReplicaS field matches the 'replicas' field.,

Correct Answer:

See the Explanation below for complete solution.
Explanation:
Do this on ckad00027 and edit the given manifest file (that's what the task expects).
0) Connect to correct host
ssh ckad00027
1) Open the manifest and identify the container + port
cd /home/candidate/spicy-pikachu
ls -l
sed -n '1,200p' app-deployment.yaml
Confirm the container port is 8081 in the YAML (usually under ports:).
2) Edit the YAML to add a readinessProbe
Edit the file:
vi app-deployment.yaml
Inside the Deployment, locate:
spec:
template:
spec:
containers:
- name: ...
image: ...
Add this under the container (same indentation level as image, ports, etc.):
readinessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 6
periodSeconds: 3
Notes:
* Use port: 8081 (because the app runs on 8081).
* Ensure indentation is correct (2 spaces per level commonly).
Save and exit.
3) Apply the updated manifest
kubectl apply -f /home/candidate/spicy-pikachu/app-deployment.yaml
4) Ensure the Deployment rolls out successfully
kubectl -n prod rollout status deploy app-deployment
5) Verify the readiness probe is set
Check the probe from the live object:
kubectl -n prod get deploy app-deployment -o jsonpath='{.spec.template.spec.containers[0].readinessProbe}
{"\n"}'
And confirm pods are becoming Ready:
kubectl -n prod get pods -l app=app-deployment
If the label selector differs, just:
kubectl -n prod get pods
kubectl -n prod describe pod <pod-name> | sed -n '/Readiness:/,/Conditions:/p' That completes the task: readiness probe on /healthz, initialDelaySeconds: 6, periodSeconds: 3.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Secret for the Configuration File:
- Create a Kubernetes Secret to store the 'config.json' file securely. This will ensure that the configuration data is encrypted and stored in a way that is not accessible directly by users or processes within the pod.
- Use the following command to create the Secret:
bash
kubectl create secret generic config-secret -from-file-config .json=configjson
2. Mount the Secret as a Volume:
- In your Deployment YAML, mount the 'contig-secret' as a volume to the pod. This will make the secret's content available to the pod.
- Define the volume mount in the 'spec-template-spec-containers' section of your Deployment YAML:

3. Restrict Access using Security Context: - Define a 'securityContexts for the container in your Deployment YAML. This will restrict the container's capabilities and permissions. - Add a 'securitycontext' section to the section of your Deployment YAML:

4. Limit the Container's Capabilities: - Configure the 'capabilities' section within the 'securityContexts to restrict the container's access to specific system capabilities. This is essential for limiting the containers ability to access sensitive information or perform privileged operations. - Add a 'capabilities' section to the 'spec-template-spec-containers-securitycontext' section of your Deployment YAML:

5. Apply the Deployment: - Once tne Deployment configuration is updated, apply it to the cluster using the following command: bash kubectl apply -f deployment.yaml By implementing these steps, you ensure that the 'config.json' file is secured using a Kubernetes Secret, mounted as a volume, and access is restricted using security context and capabilities settings. This effectively protects the sensitive configuration from unauthorized access within the pod.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. IJPdate the Deployment YAMLI
- Update the 'replicas to 2.
- Define 'maxunavailable: 2 and 'maxSurge: O' in the 'strategy.rollingupdate' section to control the rolling update process.
- Configure a 'strategy-type' to 'RollinglJpdate' to trigger a rolling update when the deployment is updated.
- Add a 'spec-template-spec-imagePullPolicy: Always" to ensure that the new image is pulled even if it exists in the pod's local cache.

2. Create the Deployment - Apply the updated YAML file using 'kubectl apply -f wordpress-deploymentyamr 3. Verify the Deployment: - Check the status of the deployment using 'kubectl get deployments wordpress-deployment to confirm the rollout and updated replica count. 4. Trigger the Automatic Update: - Push a new image to the 'wordpress/wordpress:latest' Docker Hub repository. 5. Monitor the Deployment: - Use 'kubectl get pods -l app=wordpress' to monitor the pod updates during the rolling update process. You will observe that two pods are terminated at a time, while two new pods with the updated image are created. 6. Check for Successful Update: - Once the deployment is complete, use 'kubectl describe deployment wordpress-deployment' to see that the 'updatedReplicas' field matches the 'replicas' field, indicating a successful update.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
I). Create a Role:
- Define a new Role named 'my-app-log-reader' that grants access to read logs of the 'my-app' pod.
- This role will be bound to the ServiceAccount used by the 'my-app' Deployment.

2. Create a RoleBinding: - Create a RoleBinding named 'my-app-log-reader-binding' to link the 'my-app-log-reader' Role to the 'my-app-sa' ServiceAccount. - This binding allows the 'my-app-sa' to use the permissions defined in the 'my-app-log-reader' role.

3. Apply the Configurations: - Apply the Role and RoleBinding YAML files to your Kubernetes cluster using 'kubectl apply -f role.yamr and 'kubectl apply -f rolebinding_yamr 4. verify the RBAC: - Once applied, you can verify the RBAC configuration by using 'kubectl auth can-i get pods --as=my-app-sa --namespace=' - This command should show 'yes' indicating that the ServiceAccount can access pods. - You can also check for access to logs with a similar command: 'kubectl auth can-i get pods/my-app-pod-name --namespace=' - Replace "my-app-pod-name' with the actual pod name of the application. 5. Test Access: - Try accessing the logs using "kubectl logs my-app-pod-name -n ' while impersonating the ServiceAccount 'my-app-sa' - You should be able to view the logs successfully. If any user tries to access the logs without the necessary permissions, they will be denied. Important Note: This is a basic example and can be further Kustomize d depending on your specific security needs. You can adjust the 'rules' in the Role definition to control specific permissions for users or ServiceAccounts. For example, you might restrict access to certain namespaces or resources. ]