Kubernetes Certified Cloud Practitioner > Kubernetes Deep Dive > Flashcards

Kubernetes Deep Dive Flashcards

(45 cards)

Study These Flashcards
1
Q

What is the Kubernetes API? What is the Admission Contoller?

A

Primary interface for users and system components, RESTful API

The Admission Controller enforces policies and modifies resources. It enforces quotas, sets defaults, validates configurations, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How can CRD’s be used to extend the Kubernetes API?

A

Define new resource types (CRDs) which extend existing Kubernetes resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you list resource types in a cluster?

A

kubectl api-resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the use of the –authorization-mode?

A

The –authorization-mode flag is used to specify the method(s) for controlling access and permissions within Kubernetes

If not set, the default is AlwaysAllow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the main three stages a request will pass through on its journey via the API server?

A
  1. Authentication: such as an API key or Token
  2. Authorization: are these permissions allowed (relates to the –authorization-mode
  3. Admission Controller
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

For how long must Kubernetes behaviours function after their announced deprecation?

A

No less than 1 year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which Kubernetes API version is considered to be “high risk” and may be moved out of use without warning?

A

Alpha

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which Kubernetes API version is generally considered “safe” to use despite not being recommended for production due to possible breaking changes?

A

Beta

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which Kubernetes API version is typically disabled by default and has a support window of approximately 9 months before deprecation?

A

Beta

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Stable (GA) Kubernetes APIs?

A

Enabled by default and backwards-compatible within a major version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the role and purpose of RBAC in Kubernetes?

A

To regulate access to resources in a Kubernetes cluster, enforce policy-based access for users, groups, and Service Accounts, and enhance security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the Kubernetes Certificate Authority?

A

A trusted entity used by the K8s cluster for creating and verifying certificates.

It is a core component of K8s and our KubeConfig file will reference the public key of the CA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Users, Groups, and Service Accounts in K8s?

A

Users: individuals or applications that interact with the K8s cluster. Not managed by K8s

Groups: also managed outside of K8s. Represents multiple users. When permissions are give to a group all users in the group will be given the permissions

ServiceAccounts: Used by applications running in K8s. They are K8s objects managed by K8s. They are tied to a specific namespace.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What ServiceAccount is a pod assigned if none is given?

A

`default1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does the kubeconfig file contain?

A

Cluster details and user information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the command kubectl auth can-i * * check?

A

If the user has permissions to perform an action on a resource such as :

kubectl auth can-i get pods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How are permissions assigned to a user in Kubernetes using RBAC?

A

Via the user’s membership or group membership assigned by a ClusterRoleBinding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Kubernetes Scheduler and its role?

A

The scheduler schedules applications in the form of pods to run on nodes.

When a pod is created the scheduled will check available resources and identify the best node to run on and assign the pod to the node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the use of nodeName and nodeSelector? What mechanism of labels does the nodeSelector make use of?

Study These Flashcards
A

nodeName and nodeSelector are used to control where pods are scheduled within a cluster.

nodeName directly specifies the name of a particular node on which a pod should be scheduled

nodeSelector allows you to schedule pods to nodes that possess specific labels.

20
Q

What are the main operations performed by the scheduler?

Study These Flashcards
A

Filtering, scoring, and binding

21
Q

What is ephemeral storage? What is persistent storage?

Study These Flashcards
A

Ephemeral storage does not survive restarts and is used as required. It is discarded after use.
Ex: EmptyDir

Persistent storage survives restarts and the removal of the container

22
Q

What are some examples of CNCF Graduated Storage Solutions

Study These Flashcards
A

Rook

Ceph - provides object, block, and file storage

Longhorn

OpenEBS

23
Q

What are Retain Policies?

Study These Flashcards
A

Retain - data kept until the volume is manually deleted

Delete - underlying storage is deleted along with the volume

24
Q

In Kubernetes, what is the significance of setting a volume’s emptyDir.medium to Memory?

Study These Flashcards
A

Configures the volume as a high-performance cache area

25
What is the purpose of StatefulSets?
A workload API that manages stateful applications where: - Each ReplicaSet has its own ID - The pod names are randomized - Deployments are stateless - Each pod creates its own PVC
26
What are the differences / similarities between StatefulSets and Deployments
StatefulSets provide a sticky identity for each pod meaning every pod has a unique and persistent identity that is maintained even if the pod is restarted or rescheduled
27
What is the StatefulSet relation / dependency on Services for naming
A StatefulSet uses a serviceName to define a headless service for network identity
28
What are Network Policies? What does it mean that they are cumulative?
Used to limit access to other pods, namespaces, and/or IP blocks. They are cumulative meaning that if you apply multiple policies to a set of pods, they are added together.
29
What are Pod Disruption Budgets?
A Pod Disruption Budget (PDB) is a Kubernetes resource that limits the number of pods for an application that can be down simultaneously during voluntary disruptions, ensuring a minimum level of availability.
30
Which Kubernetes command is used to make a node un-schedulable?
kubectl cordon
31
What is the difference between PDBs and replicas in Kubernetes?
Replicas ensure availability during normal operations while PDBs protect during disruptions
32
What are some of the Security Tools and their function including Falco and Open Policy Agent
Falco is a runtime security tool for detecting threats in real-time OPA is a general-purpose policy engine for enforcing policies across a software stack
33
What is Kubescape? How is it used in relation to NSA and CISA standards?
Kubescape is an open-source security platform that scans Kubernetes clusters and configurations for vulnerabilities and misconfigurations against frameworks like the NSA-CISA guidelines.
34
What is OpenID Connect (OIDC)? What is its purpose?
OpenID Connect (OIDC) is an identity and access management protocol built on top of OAuth 2.0 that allows users to log in to an application by verifying their identity with an identity provider, such as Google or Microsoft. Its purpose is to provide a secure, standardized way for applications to authenticate users without having to manage their passwords
35
What are PodSecurityPolicies? What do they do?
Pod Security Policies manage Clusters and Namespaces at runtime
36
What are the 4 C's of Cloud Native Security?
Code Container Cluster Cloud
37
In the Kubernetes security context example, what is the outcome of setting allowPrivilegeEscalation: false in the container's security context?
Prevents the escalation of privileges in containers
38
What happens when a node stops reporting?
It first becomes NotReady Existing workloads may keep running on the Node if the circumstances permit After ~5 minutes, the Node Controller evicts Pods and reschedules them onto healthy nodes A kubectl describe on the Node, will show this Node Ready Status as Unknown
39
What is Kubernetes Garbage Collection?
Kubernetes uses GC to automatically clean up a wide range of resource types, including: Terminated Pods Completed Jobs Objects without an owner reference (orphaned objects) Unused containers and images Dynamically provisioned PersistentVolumes (with ReclaimPolicy: Delete) Expired CertificateSigningRequests (CSRs) Deleted Nodes (in scenarios managed by a cloud controller or similar addon) Node Lease objects
40
What are Kubernetes probes?
Liveness Probe The kubelet checks if the container is still alive. 👉 If it fails, the kubelet restarts the container. Readiness Probe The kubelet checks if the container is ready to serve traffic. 👉 If it fails, the kubelet tells the API server to remove the Pod from Service endpoints (but does not restart it). Startup Probe The kubelet checks if the application inside the container has successfully started. 👉 While this probe is running, liveness and readiness checks are paused. Once it succeeds, the other probes take over.
41
What is Helm? What is required for its plugin installation?
A package management tool to simplify the management of Kubernetes applications git is required
42
What is the purpose of Service Meshes? What are the main components, Proxy and Data Plane?
Service Meshes allow for efficient, reliable, and secure communication. They are useful as the scale and complexity of your app grows. The "data plane" is responsible for handling traffic between services while the "control plane" manages and configures the behaviour of proxies in the data plane. The "data plane" commonly uses the sidecar pattern
43
What are some common open source offerings for service meshes?
- Traefik Mesh - Istio - Linkerd
44
What is one of the key security features provided by a Service Mesh?
Mutual TLS
45
What is the role of the SMI?
SMI = Service Mesh Interface It is a specification that defines a common interface or service meshes, allowing for different implementations.
Kubernetes Certified Cloud Practitioner
flashcards
Decks in class (7)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions