Q1.
Create a new Clusterrole name deployment-clusterrole , which only allows to create the following
resources types deployment,statefulSet,Daemonset
Create a new Serviceaccount named cicd-tocken in the existing namespace app-team1
bind the new clisterrole deplyment-clusterrole to the new service account cicd-tocken limited to the
namespace app-team1
kubectl create clusterrole deployment-clusterrole –verb=create --resource=deployment,statefulSet,Daemonset
kubectl create serviceaccount cicd-tocken -n app-team1
kubectl create clusterrolebinding my-bind --clusterrole= deplyment-clusterrole –serviceaccount=app-team1:cicd-tocken
Q 2.: Set a node named eks-node-0 as unavailale and reschedule all the pods running on it.
Ans:
kubectl get nodes
kubectl drain eks-node-0 –-ignore-daemonsets --force –delete-local-data
kubectl describe eks-node-0
Q 3: Given an existing kubernetes cluster running version 1.18.8, upgrade all of the kubernetes control
plane and node components on the master node only to version 1.19.0
You are expected to upgrade kubelet and kubectl on the master node.
Kubeadm…Kubelet and Kubectl in Master
Ans:
kubectl drain control-plane --ignore-daemonsets
apt update
apt-cache madison kubeadm
apt-mark unhold kubeadm && \
apt-get update && apt-get install -y kubeadm=1.19.0-00 && \
apt-mark hold kubeadm
kubeadm version
kubeadm upgrade plan
sudo kubeadm upgrade apply v1.19.0
apt-mark unhold kubelet kubectl && \
apt-get update && apt-get install -y kubelet=1.19.0-00 kubectl=1.19.0-00 && \
apt-mark hold kubelet kubectl
sudo systemctl daemon-reload
sudo systemctl restart kubelet
kubectl uncordon control-plane
Q 4: Create a snapeshote of the existing etcd instance running at https://127.0.0.1:2379, saving the
snapshot to /srrv/data/etcd-snapshot.db
Next restore an existing, previous snapshot located at /var/lib/backup/etcd-snapshot-previous.db
CA cert: /op/KUNIN00601/ca.crt
Client crt /op/KUNIN00601/etcd-client.crt
Client key /op/KUNIN00601/etcd-client.key
Ans:
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
--cacert= /op/KUNIN00601/ca.crt --cert=/op/KUNIN00601/etcd-client.crt --key= /op/KUNIN00601/etcd-
client.key
snapshot save /srrv/data/etcd-snapshot.db
ETCDCTL_API=3 etcdctl --write-out=table snapshot status snapshotdb
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
--cacert= /op/KUNIN00601/ca.crt --cert=/op/KUNIN00601/etcd-client.crt --key= /op/KUNIN00601/etcd-
client.key
snapshot restore /var/lib/backup/etcd-snapshot-previous.db
Q 5: Create a new network policy named allow-port-from-namespace that allows pods in the existing
namespace my-app to connect to port 9000 of other pods in the same namespace.
Ensure that the new NetworkPolicy
. does not allow access to pods not listening on port 9000
. does not allow access from Pods not in namespace my-app
Ans:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: my-app
spec:
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
project: my-app
ports:
- protocol: TCP
port: 9000
kubectl create -f netpolice.yaml
Q 6. Reconfigure the existing deployment front-end and add a port specification named http exposing
port 80/tcp of the existing container nginx
create a new service named front-end-svc exposing the container port http.
Configure the service also expose the individual pods via a NodePort on the nodes on which they are
scheduled.
Ans:
kubectl edit deployment n frontend
apiVersion: apps/v1
kind: Deployment
metadata:
name: front-end
labels:
app: front-end
spec:
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.
ports:
- name: http
protocol: TCP
port: 80
kubectl expose deployment front-end --service=front-end-svc --type= Nodeport --port=9000
Q 7. Create a new nginx Ingress resource as follows:
.Name: pong
.Namespace: in-internal
.Exposing service service hello on path /hello using service port 5678
Availablity of sevice can be checked by curl -kL <IN Terminal_IP>/hello
Reff URL: https://kubernetes.io/docs/concepts/services-networking/ingress/
Ans:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: pong
namespace: n-internal
spec:
rules:
- http:
paths:
- path: /hello
pathType: Prefix
backend:
service:
name: hello
port:
number: 5678
Q 8. Scale the deployment presentaion to 6 pods.
Ans:-
kubectl scale --replicas=6 deployment/<name of deployment>
Q 9, Schedule a pod as follows:
. Name: nginx-kusc00401
. Image: nginx
. Node Selector: disk=ssd
Ans:
apiVersion: v1
kind: Pod
metadata:
name: nginx-kusc00401
spec:
containers:
- name: nginx
image: nginx
nodeSelector:
disktype: ssd
Q 10. Check to see how many nodes are ready (not including nodes tainted NoSchedule) and write the
number to /opt/KUSC00402/kusc00402.txt
Ans:
kubectl get nodes
echo “2” > /opt/KUSC00402/kusc00402.txt
cat /opt/KUSC00402/kusc00402.txt
Q 11. Create a pod named kucc4 with single app container for each of the following images running
inside (there may be between 3 and 4 images specified):
nginx + redis + memcached + consul
Ans:
apiVersion: v1
kind: Pod
metadata:
name: kucc4
spec:
containers:
- name: nginx
image: nginx
- name: redis
image: redis
- name: memcached
image:memcached
- name: consul
image: consul
Q 12. Create a persistent volume with name app-data, of capacity 1Gi and access mode
ReadWriteMany, The type of volume is hostPath and its location is /srv/app-data
Ans:
apiVersion: v1
kind: PersistentVolume
metadata:
name: app-data
spec:
storageClassName: manual
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
hostPath:
path: "srv/app-data"
Q 13. Create a new PersistentVolumeClaim:
. Name: pv-volume.
. Class: csi-hostpath-sc
. Capacity: 10Mi\
Second create pod and claim the space from PVC
Extend PVC to 70Mi
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pv-volume
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Mi\
storageClassName: csi-hostpath-sc
apiVersion: v1
kind: Pod
metadata:
name: mypod
spec:
containers:
- name: myfrontend
image: nginx
volumeMounts:
- mountPath: "/var/www/html"
name: mypd
volumes:
- name: mypd
persistentVolumeClaim:
claimName: pv-volume
k apply -f pod.yaml
k edit pvc
extend 10mb to 70mb
Q 14. Monitor the logs of pod foo and:
. Extract log lines corrosponding to error " unable-to-access-website"
. Write them to /opt/KUTR00101/f00
Ans:
k logs foo | grep unable-to-access-website > /opt/KUTR00101/f00
Q15: Without changing its existing containers, an existing Pod needs to be integrated into Kubernetes's
built-in logging architecture (eg: kubectl logs). Adding a steaming sidecar container is a good and
common way to accomplish this requirment.
Kubectl get pods
kubectl edit pod
add side car container to pod-read
apiVersion: v1
kind: Pod
metadata:
name: counter
spec:
containers:
- name: count
image: busybox:1.28
args:
- /bin/sh
- -c
->
i=0;
while true;
do
echo "$i: $(date)" >> /var/log/1.log;
echo "$(date) INFO $i" >> /var/log/2.log;
i=$((i+1));
sleep 1;
done
volumeMounts:
- name: varlog
mountPath: /var/log
- name: count-log-1
image: busybox:1.28
args: [/bin/sh, -c, 'tail -n+1 -F /var/log/1.log']
volumeMounts:
- name: varlog
mountPath: /var/log
volumes:
- name: varlog
emptyDir: {}
Q16: From the pod lable name=cpu-utilizer, find pods running high CPU workloads and write the name
of the pod consuming most to the file /opt/KUTR00401/KUTROO401.txt (Which is already exist)
Ans:
kubectl top pod -l name=cpu-utilizer --sort-by=cpu –no-header | cut-f1 d” “” |headn1 > /opt/KUTR00401/KUTROO401.txt
Q 17. A kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the
case, and perform any appropriate steps to bring the node to a Ready state, ensureing that any changes
are made permanent.
You can assume elevated privileages sudo -i
Ans:
k get nodes
ssh <node-name>
systemctl ststus kubelet
systemctl enable kubelet
systemctlrestart kubelet
kubectl status kubelet
In exam 4 to 5 cluster will be there
Kubectl set context ###
******* kubectl config current-context
