Linux Foundation CKAD Certified Kubernetes Application Developer (CKAD) Program Exam Practice Test

Solution:

Solution:

Solution:

Solution:

Solution:

To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.

First, you will need to create a livenessProbe and a readinessProbe in the pod's definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.

Here's an example of how you can configure the liveness and readiness probes in the pod definition yaml file:

apiVersion: v1

kind: Pod

metadata:

name: probe-pod

spec:

containers:

- name: probe-pod

image:

ports:

- containerPort: 8080

livenessProbe:

httpGet:

path: /healthz

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

readinessProbe:

httpGet:

path: /started

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.

You can use kubectl to create the pod by running the following command:

kubectl apply -f .yaml

Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.

Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.

The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.

ssh ckad00018

You cannot create/modify/delete any NetworkPolicy.

So the only way to make the existing policies “take effect” is to ensure the right Pods have the labels/selectors those policies expect.

The task: in namespace charming-macaw, configure things so the target Pod can send + receive traffic ONLY to/from Pods front and db.

1) Inspect what NetworkPolicies already exist (don’t change them)

kubectl -n charming-macaw get netpol

kubectl -n charming-macaw get netpol -o wide

Dump them to see the selectors they use:

kubectl -n charming-macaw get netpol -o yaml

You are looking for policies that:

select the restricted pod via spec.podSelector

and allow ingress/egress only with selectors that match front and db

often there’s also a “default deny” policy.

2) Identify the Pods and their current labels

kubectl -n charming-macaw get pods -o wide

kubectl -n charming-macaw get pods --show-labels

Specifically inspect labels for front and db:

kubectl -n charming-macaw get pod front --show-labels

kubectl -n charming-macaw get pod db --show-labels

(If they’re Deployments instead of single Pods, do:)

kubectl -n charming-macaw get deploy --show-labels

kubectl -n charming-macaw get pods -l app=front --show-labels

kubectl -n charming-macaw get pods -l app=db --show-labels

3) Figure out which pod is “the Pod” to restrict

Usually there’s a third pod (e.g., backend, api, app) besides front and db.

List pods again and identify the “other” one:

kubectl -n charming-macaw get pods

Let’s assume the pod to restrict is called app (replace as needed):

TARGET=

4) Match the existing NetworkPolicy selectors by labeling pods (allowed)

Because you can’t edit NetworkPolicies, you must make labels on Pods (or their controllers) match the policies’ selectors.

4.1 Determine the label required on the TARGET pod

From the YAML, find the policy that selects the restricted pod, e.g.:

spec:

podSelector:

matchLabels:

role: restricted

Extract podSelector from each policy quickly:

kubectl -n charming-macaw get netpol -o jsonpath='{range .items[*]}{.metadata.name}{" => "}{.spec.podSelector}{"\n"}{end}'

Pick the selector that is meant for the restricted pod, then apply it to the TARGET pod (example: role=restricted):

kubectl -n charming-macaw label pod $TARGET role=restricted --overwrite

Best practice (if the pod is managed by a Deployment): label the Deployment template instead, so it persists.

Find the owner:

kubectl -n charming-macaw get pod $TARGET -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.metadata.ownerReferences[0].name}{"\n"}'

If it’s a ReplicaSet, find its Deployment:

RS=$(kubectl -n charming-macaw get pod $TARGET -o jsonpath='{.metadata.ownerReferences[0].name}')

kubectl -n charming-macaw get rs $RS -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.metadata.ownerReferences[0].name}{"\n"}'

Then label the Deployment (example):

kubectl -n charming-macaw label deploy role=restricted --overwrite

4.2 Ensure front and db match what the allow-rules reference

Look inside the allow policy ingress.from / egress.to. You might see something like:

from:

- podSelector:

matchLabels:

name: front

- podSelector:

matchLabels:

name: db

So you must ensure:

front pod has name=front

db pod has name=db

Apply labels (examples—use what the policy expects):

kubectl -n charming-macaw label pod front name=front --overwrite

kubectl -n charming-macaw label pod db name=db --overwrite

Again, if they’re Deployments, label the Deployment instead:

kubectl -n charming-macaw label deploy front name=front --overwrite

kubectl -n charming-macaw label deploy db name=db --overwrite

5) Verify the NetworkPolicies now “select” the right pods

Check which labels each pod has now:

kubectl -n charming-macaw get pods --show-labels

Confirm the restricted pod matches the NetPol podSelector:

kubectl -n charming-macaw get netpol -o jsonpath='{.spec.podSelector}{"\n"}'

kubectl -n charming-macaw get pod $TARGET --show-labels

6) Functional verification (quick network tests)

Exec into the restricted pod and try to reach:

front ✅ allowed

db ✅ allowed

anything else ❌ blocked

If busybox has wget:

kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://front 2 >/dev/null || true'

kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- http://db 2 >/dev/null || true'

Test something that should be blocked (example: kubernetes service DNS name):

kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- https://kubernetes.default.svc 2 >/dev/null || echo "blocked"'

Also test inbound (from front to target, and from db to target) if the target listens on a port; otherwise inbound testing may be limited.

What you’re doing conceptually

Existing NetPols are already correct.

Your job is to make pod labels match the NetPol selectors so:

default deny applies to the target

allow rules apply only between target ↔ front and target ↔ db

Solution:

Solution:

Solution:

Solution:

Solution:

Solution:

Solution:

To update the nginxsvc service to serve on port 5050, you will need to edit the service's definition yaml file. You can use the kubectl edit command to edit the service in place.

kubectl edit svc nginxsvc

This will open the service definition yaml file in your default editor. Change the targetPort of the service to 5050 and save the file.

To add an HAproxy container named haproxy bound to port 90 to the poller pod, you will need to edit the pod's definition yaml file located at /opt/KDMC00101/poller.yaml.

You can add a new container to the pod's definition yaml file, with the following configuration:

containers:

- name: haproxy

image: haproxy

ports:

- containerPort: 90

volumeMounts:

- name: haproxy-config

mountPath: /usr/local/etc/haproxy/haproxy.cfg

subPath: haproxy.cfg

args: ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]

This will add the HAproxy container to the pod and configure it to listen on port 90. It will also mount the ConfigMap haproxy-config to the container, so that haproxy.cfg is available at /usr/local/etc/haproxy/haproxy.cfg.

To inject the configuration located at /opt/KDMC00101/haproxy.cfg to the container, you will need to create a ConfigMap using the following command:

kubectl create configmap haproxy-config --from-file=/opt/KDMC00101/haproxy.cfg

You will also need to update the args of the poller container so that it connects to localhost instead of nginxsvc. You can do this by editing the pod's definition yaml file and changing the args field to args: ["poller","--host=localhost"].

Once you have made these changes, you can deploy the updated pod to the cluster by running the following command:

kubectl apply -f /opt/KDMC00101/poller.yaml

This will deploy the enhanced pod with the HAproxy container to the cluster. The HAproxy container will listen on port 90 and proxy connections to the nginxsvc service on port 5050. The poller container will connect to localhost instead of nginxsvc, so that the connection is correctly proxied to the new service endpoint.

Please note that, this is a basic example and you may need to tweak the haproxy.cfg file and the args based on your use case.

Solution: