Linux Foundation CKAD Certified Kubernetes Application Developer (CKAD) Program Exam Practice Test

Solution:

Below is an exam-style, step-by-step solution (commands + verification). Follow exactly on host ckad000.

0) Connect to the right host

ssh ckad000

(Optional but good sanity check)

kubectl config current-context

kubectl get ns

1) Inspect the existing Deployment (to know its labels/ports)

kubectl -n prod get deploy nginx-deployment

kubectl -n prod get deploy nginx-deployment -o wide

Check what labels the Pod template already has (important for the Service selector):

kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}'

Check container ports (so we expose the correct targetPort):

kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.spec.containers[0].ports}{"\n"}'

If ports output is empty, it’s still often nginx on 80, but the safest is to confirm by describing a pod later.

2) Update Deployment to 2 replicas

Fastest:

kubectl -n prod scale deploy nginx-deployment --replicas=2

Verify:

kubectl -n prod get deploy nginx-deployment

3) Add label role=webFrontEnd to the Pod (Pod template label)

You must add it under:

spec.template.metadata.labels

Use a patch (quick + safe):

kubectl -n prod patch deploy nginx-deployment \

-p '{"spec":{"template":{"metadata":{"labels":{"role":"webFrontEnd"}}}}}'

Verify the Deployment template now includes it:

kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}'

Now verify the running Pods have the label (important!):

kubectl -n prod get pods --show-labels

If the label doesn’t show on pods immediately, wait for rollout:

kubectl -n prod rollout status deploy nginx-deployment

kubectl -n prod get pods --show-labels

4) Create a NodePort Service rover exposing the Deployment’s Pods

4.1 Get a reliable target port

Try to read containerPort:

kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.spec.containers[0].ports[0].containerPort}{"\n"}'

If this prints a number (commonly 80), use it as --target-port.

If it prints nothing/empty, check a pod:

POD=$(kubectl -n prod get pod -l role=webFrontEnd -o jsonpath='{.items[0].metadata.name}')

kubectl -n prod describe pod "$POD" | sed -n '/Containers:/,/Conditions:/p' | sed -n '/Ports:/,/Environment:/p'

Assuming nginx is on 80 (most common), create the service:

kubectl -n prod expose deploy nginx-deployment \

--name=rover \

--type=NodePort \

--port=80 \

--target-port=80

If your nginx container port is different (e.g., 8080), change --target-port=8080 accordingly.

5) Verify Service + endpoints (critical)

kubectl -n prod get svc rover -o wide

kubectl -n prod describe svc rover

kubectl -n prod get endpoints rover -o wide

You should see 2 endpoints (matching 2 pods).

Also confirm the pods are Ready:

kubectl -n prod get pods -l role=webFrontEnd -o wide

Quick “CKAD checkpoints”

Deployment in prod has replicas=2

Pod template has label role=webFrontEnd

Service rover in prod is NodePort

Service endpoints point to the nginx pods

Solution:

Solution:

Solution:

Solution:

ssh ckad00034c

You’re debugging an Ingress → Service → Deployment chain. The fastest way is:

reproduce the error with the right Host header

check Ingress rules (host/path/backend)

check Service (selector/port/targetPort)

check Endpoints (do we have ready pods?)

fix the manifest(s) under /home/candidate/content-marlin/

apply + re-test

Below are the exact commands + the most common fixes for this exact symptom.

1) Reproduce the failing request correctly

Even if DNS isn’t set up, you can test with a Host header:

curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlin

If your ingress controller is not on localhost, find the NodePort/LoadBalancer IP. In these labs it’s often localhost via a local proxy, but if needed:

kubectl get svc -A | egrep -i 'ingress|nginx'

kubectl get nodes -o wide

(But start with the localhost curl above.)

2) Inspect the provided manifests (this is what you must edit)

cd /home/candidate/content-marlin/

ls -l

sed -n '1,200p' *.yaml

Also view what’s currently live in the cluster:

kubectl -n content-marlin get deploy,svc,ingress

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get ingress content-marlin-ingress -o yaml

What to look for in the Ingress:

spec.rules.host should be content-marlin.local

spec.rules.http.paths[].path should match /content-marlin

Backend service name must be your service

Backend service port must match the service port (name or number)

pathType should be Prefix (usually safest)

3) Validate Service → Pod wiring (most common real cause)

3.1 Check service selector and ports

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin describe svc content-marlin-deployment 2>/dev/null || true

kubectl -n content-marlin describe svc

Identify the service that the Ingress points to (from describe ingress).

Check if the Service selector matches pod labels:

kubectl -n content-marlin get pods --show-labels

kubectl -n content-marlin get svc -o jsonpath='{.spec.selector}{"\n"}'

3.2 Check endpoints (this tells you instantly if traffic can reach pods)

kubectl -n content-marlin get endpoints

kubectl -n content-marlin get endpoints -o wide

If ENDPOINTS is empty → Service selector doesn’t match Pods OR Pods aren’t Ready.

3.3 If endpoints empty, check pod readiness and labels

kubectl -n content-marlin get pods -o wide

kubectl -n content-marlin describe pod

4) Apply the most likely fix patterns

Fix pattern A: Ingress path needs rewrite

If your app serves / but you route /content-marlin, you often need rewrite.

Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:

path: /content-marlin

pathType: Prefix

annotation: rewrite to / (common for nginx ingress)

Example (typical nginx-ingress):

metadata:

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /

spec:

rules:

- host: content-marlin.local

http:

paths:

- path: /content-marlin

pathType: Prefix

backend:

service:

name:

port:

number: 80

If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it’s very often nginx.

Fix pattern B: Ingress points to wrong Service port

If the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port), align them:

Either change Ingress backend port.number

Or change Service spec.ports[].port / targetPort

Fix pattern C: Service selector mismatch (endpoints empty)

If pods have label app=content-marlin but service selector is app=content-marlin-deployment (or vice versa), fix the Service selector to match pod labels.

Service should have:

spec:

selector:

app:

Fix pattern D: Service targetPort wrong

If container listens on 8080 but service targetPort is 80, fix it:

spec:

ports:

- port: 80

targetPort: 8080

5) Apply the corrected manifests

After editing the YAMLs under /home/candidate/content-marlin/:

kubectl apply -f /home/candidate/content-marlin/

Wait for readiness:

kubectl -n content-marlin rollout status deploy content-marlin-deployment

kubectl -n content-marlin get endpoints

kubectl -n content-marlin describe ingress content-marlin-ingress

6) Re-test the URL

curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlin

If you still get errors, also check ingress controller logs/events quickly:

kubectl -n content-marlin get events --sort-by=.lastTimestamp | tail -n 30

kubectl get pods -A | egrep -i 'ingress|nginx'

The fastest way for you to finish in 1 shot

Run these and paste the output (I’ll tell you exactly which line to change and what to change it to):

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin get endpoints -o wide

kubectl -n content-marlin get pods --show-labels

sed -n '1,200p' /home/candidate/content-marlin/*.yaml

But even without pasting, if you follow steps 2–4 above, you’ll find the broken link (Ingress rule, Service port, selector, or rewrite) and fix it cleanly.

Solution:

To allow a pod to send and receive traffic only to and from specific pods, you can use network policies in Kubernetes.

First, you will need to create a network policy that defines the allowed traffic. You can create a network policy yaml file with the following rules:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: newpod-network-policy

namespace: default

spec:

podSelector:

matchLabels:

app: kdsn00201-newpod

ingress:

- from:

- podSelector:

matchLabels:

app: web

- podSelector:

matchLabels:

app: storage

This policy will only allow incoming traffic to the pod with the label app=kdsn00201-newpod from pods with the label app=web or app=storage. If you have different labels on your web and storage pods please update the matchLabels accordingly.

Once you have created the network policy, you can apply it to the cluster by running the following command:

kubectl apply -f .yaml

This will apply the network policy to the cluster, and the newpod will only be able to send and receive traffic to and from the web and storage pods.

Please note that, NetworkPolicy resource is not available by default, you need to enable the NetworkPolicy feature on your Kubernetes cluster. This feature is enabled by default on some clusters and must be explicitly enabled on others. You can check if NetworkPolicy is available by running the command kubectl api-versions | grep networking

Also, you need to ensure that the pods that you want to allow traffic to and from are running on the same namespace.

ssh ckad00028

You’re seeing RBAC errors like:

User "system:serviceaccount:gorilla:default" cannot list resource "pods" … in namespace "gorilla"

That means the Pod is running as the default ServiceAccount and needs permission to list pods (and possibly also get/watch).

You must fix it by updating the Deployment (via its manifest file) and giving it the proper RBAC.

1) Confirm the error in logs

kubectl -n gorilla get deploy honeybee-deployment

kubectl -n gorilla logs deploy/honeybee-deployment --tail=200

If it’s CrashLooping and you need previous logs:

POD=$(kubectl -n gorilla get pods -l app=honeybee -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || kubectl -n gorilla get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n gorilla logs "$POD" --previous --tail=200

You should see the “cannot list resource pods” line.

2) Create a dedicated ServiceAccount for the app

(Using a dedicated SA is standard practice; the task wants you to “resolve the errors”.)

kubectl -n gorilla create serviceaccount honeybee-sa

kubectl -n gorilla get sa honeybee-sa

3) Create RBAC: Role + RoleBinding (namespaced)

This will allow listing pods in namespace gorilla.

cat <<'EOF' > honeybee-rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: honeybee-pod-reader

namespace: gorilla

rules:

- apiGroups: [""]

resources: ["pods"]

verbs: ["get", "list", "watch"]

---

apiVersion: rbac.authorization.k8s.io/v1

kind: RoleBinding

metadata:

name: honeybee-pod-reader-binding

namespace: gorilla

subjects:

- kind: ServiceAccount

name: honeybee-sa

namespace: gorilla

roleRef:

apiGroup: rbac.authorization.k8s.io

kind: Role

name: honeybee-pod-reader

EOF

Apply it:

kubectl apply -f honeybee-rbac.yaml

Quick verification (optional but very useful):

kubectl auth can-i list pods -n gorilla --as=system:serviceaccount:gorilla:honeybee-sa

Should return yes.

4) Update the Deployment manifest to use the new ServiceAccount

The manifest is at:

/home/candidate/prompt-escargot/honey bee-deployment.yaml

Because there’s a space in the filename, quote it.

4.1 Edit the file

cd /home/candidate/prompt-escargot

ls -l

vi "honey bee-deployment.yaml"

In the Deployment YAML, add (or set) this under:

spec.template.spec:

serviceAccountName: honeybee-sa

Example location:

spec:

template:

spec:

serviceAccountName: honeybee-sa

containers:

- name: ...

Save and exit.

4.2 Apply the updated manifest

kubectl apply -f "/home/candidate/prompt-escargot/honey bee-deployment.yaml"

5) Ensure rollout succeeds and errors are gone

kubectl -n gorilla rollout status deploy honeybee-deployment

kubectl -n gorilla logs deploy/honeybee-deployment --tail=200

Also confirm the pods now run with the right ServiceAccount:

kubectl -n gorilla get pods -o jsonpath='{range .items[*]}{.metadata.name}{" sa="}{.spec.serviceAccountName}{"\n"}{end}'

You should no longer see the RBAC “cannot list pods” errors.

Solution:

To update the nginxsvc service to serve on port 5050, you will need to edit the service's definition yaml file. You can use the kubectl edit command to edit the service in place.

kubectl edit svc nginxsvc

This will open the service definition yaml file in your default editor. Change the targetPort of the service to 5050 and save the file.

To add an HAproxy container named haproxy bound to port 90 to the poller pod, you will need to edit the pod's definition yaml file located at /opt/KDMC00101/poller.yaml.

You can add a new container to the pod's definition yaml file, with the following configuration:

containers:

- name: haproxy

image: haproxy

ports:

- containerPort: 90

volumeMounts:

- name: haproxy-config

mountPath: /usr/local/etc/haproxy/haproxy.cfg

subPath: haproxy.cfg

args: ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]

This will add the HAproxy container to the pod and configure it to listen on port 90. It will also mount the ConfigMap haproxy-config to the container, so that haproxy.cfg is available at /usr/local/etc/haproxy/haproxy.cfg.

To inject the configuration located at /opt/KDMC00101/haproxy.cfg to the container, you will need to create a ConfigMap using the following command:

kubectl create configmap haproxy-config --from-file=/opt/KDMC00101/haproxy.cfg

You will also need to update the args of the poller container so that it connects to localhost instead of nginxsvc. You can do this by editing the pod's definition yaml file and changing the args field to args: ["poller","--host=localhost"].

Once you have made these changes, you can deploy the updated pod to the cluster by running the following command:

kubectl apply -f /opt/KDMC00101/poller.yaml

This will deploy the enhanced pod with the HAproxy container to the cluster. The HAproxy container will listen on port 90 and proxy connections to the nginxsvc service on port 5050. The poller container will connect to localhost instead of nginxsvc, so that the connection is correctly proxied to the new service endpoint.

Please note that, this is a basic example and you may need to tweak the haproxy.cfg file and the args based on your use case.

Solution:

ssh ckad00043

You have two deliverables here:

Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).

Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).

Below is the exact CKAD-style workflow.

1) Find the missing RBAC permissions (use logs + events)

1.1 Identify the pods for the Deployment

kubectl -n cute-panda get deploy scraper

kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods

Pick one pod name and check logs:

kubectl -n cute-panda logs deploy/scraper --tail=100

If the pod is crashlooping and logs are short:

POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n cute-panda logs "$POD" --previous --tail=200

1.2 Look specifically for “Forbidden” lines

Most apps print errors like:

... is forbidden: User "system:serviceaccount:cute-panda:default" cannot list resource "pods" in API group "" in the namespace "cute-panda"

or cannot get resource "configmaps"...

or cannot watch ...

If you don’t see it in logs, check events:

kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 30

1.3 Extract verb/resource/apiGroup from the error

From a typical Kubernetes RBAC “forbidden” message, capture:

verb: get/list/watch/create/update/patch/delete

resource: pods, configmaps, secrets, deployments, etc.

apiGroup: "" (core), apps, batch, etc.

namespace: cute-panda (this is a namespaced permission if it’s a Role)

You may have multiple “cannot …” lines → you need to allow all of them.

2) Create the ServiceAccount scraper (required by the task)

kubectl -n cute-panda create serviceaccount scraper

kubectl -n cute-panda get sa scraper

3) Create the RBAC objects to grant the needed permissions

The task says “A Deployment needs specific RBAC permissions” — in CKAD, that usually means: Role + RoleBinding (namespaced) bound to your new ServiceAccount.

3.1 Create a Role (template you fill from the log output)

Create scraper-role.yaml:

cat <<'EOF' > scraper-role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: scraper-role

namespace: cute-panda

rules:

# EXAMPLE ONLY: replace these rules with what your logs show

- apiGroups: [""]

resources: ["pods"]

verbs: ["get","list","watch"]

EOF

Apply it:

kubectl apply -f scraper-role.yaml

3.2 Bind the Role to the ServiceAccount

kubectl -n cute-panda create rolebinding scraper-rb \

--role=scraper-role \

--serviceaccount=cute-panda:scraper

Verify:

kubectl -n cute-panda get role scraper-role

kubectl -n cute-panda get rolebinding scraper-rb -o yaml

4) Update the Deployment to use the new ServiceAccount (so it actually works)

Check current SA (likely default):

kubectl -n cute-panda get deploy scraper -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'

Patch it to use scraper:

kubectl -n cute-panda patch deploy scraper -p '{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'

Rollout:

kubectl -n cute-panda rollout status deploy scraper

Re-check logs to confirm RBAC errors are gone:

kubectl -n cute-panda logs deploy/scraper --tail=100

Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:

memory request = 128Mi

memory limit = half of the namespace’s maximum memory constraint

You must do this on the correct host.

0) Connect to the correct host

ssh ckad00032

1) Confirm the failing Deployment / Pods

kubectl -n haddock get deploy nosql

kubectl -n haddock get pods -l app=nosql 2>/dev/null || kubectl -n haddock get pods

If pods are crashing, check why (you’ll likely see OOMKilled):

kubectl -n haddock describe pod

2) Find the maximum memory constraint set for the haddock namespace

In CKAD labs, this is commonly enforced by a LimitRange (max memory per container). Sometimes it can also be a ResourceQuota.

2A) Check LimitRange (most likely)

kubectl -n haddock get limitrange

kubectl -n haddock get limitrange -o yaml

Extract the max memory value quickly:

MAX_MEM=$(kubectl -n haddock get limitrange -o jsonpath='{.items[0].spec.limits[0].max.memory}')

echo "Namespace max memory constraint: $MAX_MEM"

2B) If no LimitRange exists, check ResourceQuota

kubectl -n haddock get resourcequota

kubectl -n haddock describe resourcequota

If quota is used, you’re looking for something like limits.memory (but the question wording “maximum memory constraint” usually points to LimitRange max.memory).

3) Compute “half of the max memory constraint”

Run this small snippet to compute HALF in Mi (handles Mi and Gi):

HALF_MEM=$(python3 - <<'PY'

import os, re

q = os.environ.get("MAX_MEM","").strip()

m = re.fullmatch(r"(\d+)(Mi|Gi)", q)

if not m:

raise SystemExit(f"Cannot parse MAX_MEM='{q}'. Expected like 512Mi or 1Gi.")

val = int(m.group(1))

unit = m.group(2)

# convert to Mi

mi = val if unit == "Mi" else val * 1024

half_mi = mi // 2

print(f"{half_mi}Mi")

PY

)

echo "Half of max: $HALF_MEM"

Example: if MAX_MEM=512Mi → HALF_MEM=256Mi

Example: if MAX_MEM=1Gi → HALF_MEM=512Mi

4) Update the nosql Deployment (DO NOT delete it)

First, get the container name (Deployment may have a custom container name):

kubectl -n haddock get deploy nosql -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'

Now set resources (this updates the Deployment in-place):

kubectl -n haddock set resources deploy nosql \

--requests=memory=128Mi \

--limits=memory=$HALF_MEM

5) Ensure the update rolls out successfully

kubectl -n haddock rollout status deploy nosql

6) Verify the pod has the right requests/limits

kubectl -n haddock get deploy nosql -o jsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'

kubectl -n haddock get pods

Pick the new pod and confirm:

kubectl -n haddock describe pod | sed -n '/Requests:/,/Limits:/p'

You should see:

Requests: memory 128Mi

Limits: memory

If rollout fails (common cause)

If you accidentally set a limit above the namespace max, pods won’t start. Check events:

kubectl -n haddock describe deploy nosql

kubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20