매달, 우리는 1000명 이상의 사람들이 시험 준비를 잘하고 시험을 잘 통과할 수 있도록 도와줍니다.
Certified Kubernetes Application Developer 온라인 연습
최종 업데이트 시간: 2026년06월29일
당신은 온라인 연습 문제를 통해 The Linux Foundation CKAD 시험지식에 대해 자신이 어떻게 알고 있는지 파악한 후 시험 참가 신청 여부를 결정할 수 있다.
시험을 100% 합격하고 시험 준비 시간을 35% 절약하기를 바라며 CKAD 덤프 (최신 실제 시험 문제)를 사용 선택하여 현재 최신 33개의 시험 문제와 답을 포함하십시오.
정답: ssh ckad00029
You must modify the existing Deployment store-deployment in namespace grubworm so that its containers:
run as user ID 10000
have Linux capability NET_BIND_SERVICE added
And you’re told to use the manifest file at:
/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looks misspelled;
follow it exactly on the host)
1) Inspect the current Deployment and locate the manifest file kubectl -n grubworm get deploy store-deployment ls -l /home/candidate/daring-moccasin / Open the manifest:
sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"
2) Edit the manifest to add SecurityContext vi "/home/candidate/daring-moccasin/store-deplovment.vaml"
정답: ssh ckad00023
You need two outcomes in moose:
At most 10 Pods total (across both Deployments).
About 20% of chipmunk-service traffic goes to canary-chipmunk-deployment.
In Kubernetes Services, traffic distribution is (roughly) proportional to the number of ready endpoints behind the Service .
So the standard canary trick is:
total endpoints = 10
canary endpoints = 2
current endpoints = 8
That gives ~20% to canary.
1) Inspect what exists kubectl -n moose get deploy kubectl -n moose get svc chipmunk-service -o wide kubectl -n moose describe svc chipmunk-service Get the Service selector (important):
kubectl -n moose get svc chipmunk-service -o jsonpath='{.spec.selector}{"\n"}' Check current replicas:
kubectl -n moose get deploy current-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}' kubectl -n moose get deploy canary-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}' List pods + labels (to confirm both Deployments’ pods match the Service selector):
kubectl -n moose get pods --show-labels
2) Ensure both Deployments are behind the Service
This is the key: the pods from BOTH deployments must match the Service selector.
If the Service selector is something like app=chipmunk, then both Deployments’ pod templates must include app: chipmunk.
If one Deployment doesn’t match, patch its pod template labels to match the selector.
2A) Example: selector is app=chipmunk
(Only do this if you see the Service selector contains app=chipmunk and one of the deployments is missing it.)
kubectl -n moose patch deploy current-chipmunk-deployment \
-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'
kubectl -n moose patch deploy canary-chipmunk-deployment \
-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'
Wait for rollouts if patches triggered new ReplicaSets: kubectl -n moose rollout status deploy current-chipmunk-deployment kubectl -n moose rollout status deploy canary-chipmunk-deployment Verify endpoints now include pods from both deployments: kubectl -n moose get endpoints chipmunk-service -o wide
3) Set replicas to enforce “max 10 pods” and “20% canary” Set:
current = 8
canary = 2
Total = 10.
kubectl -n moose scale deploy current-chipmunk-deployment --replicas=8
kubectl -n moose scale deploy canary-chipmunk-deployment --replicas=2
Wait until ready:
kubectl -n moose rollout status deploy current-chipmunk-deployment kubectl -n moose rollout status deploy canary-chipmunk-deployment
Confirm total pods is 10 (or less) and all are Running/Ready:
kubectl -n moose get pods kubectl -n moose get pods | tail -n +2 | wc -l
Confirm endpoints count matches 10:
kubectl -n moose get endpoints chipmunk-service -o jsonpath='{.subsets[*].addresses[*].ip}' | wc -w
4) Test load balancing via NodePort 30000 Run several times:
for i in $(seq 1 30); do curl -s http://localhost:30000/; echo; done
You should see canary responses appear roughly ~20% of the time (not exact every run).
If you want a clearer signal, check which pods are endpoints and ensure 2 belong to canary and 8 to current:
kubectl -n moose get pods -l app=chipmunk -o wide kubectl -n moose get endpoints chipmunk-service -o wide
정답: ssh ckad00026
Your job is to edit /home/candidate/credible-mite/web.yaml so it uses APIs supported on Kubernetes 1.29+, then deploy it into namespace garfish.
Because I can’t see your file from here, the most reliable exam approach is:
run a server-side dry-run to reveal the exact deprecated/removed APIs and schema errors edit the manifest to the modern API versions/fields re-run dry-run until it passes apply for real and verify rollout
1) Go to the manifest and run a server-side dry-run cd /home/candidate/credible-mite ls -l sed -n '1,200p' web.yaml
Make sure the namespace exists:
kubectl get ns garfish || kubectl create ns garfish
Now run a server-side dry-run (this catches removed APIs on the cluster): kubectl apply -n garfish -f web.yaml --dry-run=server
Whatever errors you get here tell you exactly what to fix.
2) Fix the common v1.15 → v1.29 API deprecations Edit the file:
vi web.yaml
Below are the most common objects from older manifests and how to update them for 1.29+.
A) Deployments / DaemonSets / StatefulSets Old (v1.15 often used):
extensions/v1beta1 or apps/v1beta1 or apps/v1beta2 New:
apiVersion: apps/v1
Also in apps/v1, .spec.selector is required and must match the pod template labels .
Example conversion:
apiVersion: apps/v1
kind: Deployment metadata: name: web spec:
replicas: 2 selector: matchLabels:
app: web template: metadata:
labels:
app: web spec:
containers:
- name: web image: nginx
Key rule:
spec.selector.matchLabels must exactly match spec.template.metadata.labels (at least for the keys you select on).
B) Ingress Old:
apiVersion: extensions/v1beta1 (or networking.k8s.io/v1beta1) New:
apiVersion: networking.k8s.io/v1 Required changes: spec.rules.http.paths[].pathType is required (usually Prefix)
backend format changes from serviceName/servicePort to service.name/service.port.number (or
.name for named ports)
Old backend:
backend:
serviceName: web servicePort: 80
New backend:
backend:
service:
name: web port:
number: 80
Full path example:
apiVersion: networking.k8s.io/v1
kind: Ingress metadata:
name: web spec:
rules:
- host: example.local http:
paths:
- path: /
pathType: Prefix backend: service:
name: web port: number: 80
C) CronJob Old:
apiVersion: batch/v1beta1 New:
apiVersion: batch/v1
Most fields stay the same; just update apiVersion.
D) PodDisruptionBudget Old: policy/v1beta1
New:
policy/v1
spec.selector/minAvailable/maxUnavailable remain, but apiVersion changes.
E) RBAC
Usually already:
rbac.authorization.k8s.io/v1 (this is fine)
F) Removed APIs you must delete/replace
If you see these in a v1.15-era manifest, they are removed in modern clusters:
PodSecurityPolicy (policy/v1beta1) is removed. You cannot deploy it on 1.29+. Remove it from the manifest (or replace with whatever your environment uses, but for CKAD tasks you usually delete PSP sections from the file).
Some old admission/alpha resources also removed.
If dry-run complains “no matches for kind … in version …”, that’s your cue.
3) Re-run dry-run until it succeeds After you edit:
kubectl apply -n garfish -f web.yaml --dry-run=server Keep iterating until there are no errors.
4) Deploy for real kubectl apply -n garfish -f /home/candidate/credible-mite/web.yaml
5) Verify everything in namespace garfish List what was created:
kubectl -n garfish get all kubectl -n garfish get ingress 2>/dev/null || true If there is a Deployment, verify rollout: kubectl -n garfish get deploy kubectl -n garfish rollout status deploy --all Check pods/events if something fails: kubectl -n garfish get pods -o wide kubectl -n garfish describe pod <pod-name>
kubectl -n garfish get events --sort-by=.lastTimestamp | tail -n 30
정답: Understood ― I’ll redo Question 13 without using any ✅(or similar) icons.
ssh ckad00033
This task is only about building and exporting a container image.
You must not push it, run it, or consume it in any way.
You may use any image builder. Below are clean, correct solutions. Use one of them.
Option A: Using Docker
1) Go to the Dockerfile location cd /home/candidate/build ls -l Dockerfile
2) Build the image
Image name: macaque
Tag: 1.2
docker build -t macaque:1.2.
Verify:
docker images | grep macaque
3) Export the image to a tar file Docker image format is acceptable.
docker save macaque:1.2 -o /home/candidate/macaque-1.2.tar Verify the file exists:
ls -lh /home/candidate/macaque-1.2.tar Do not load or run the image.
Option B: Using Podman (rootless alternative)
1) Build the image cd /home/candidate/build podman build -t macaque:1.2.
Verify:
podman images | grep macaque
2) Export the image podman save macaque:1.2 -o /home/candidate/macaque-1.2.tar
Verify:
ls -lh /home/candidate/macaque-1.2.tar
Option C: Using Buildah (OCI format)
cd /home/candidate/build buildah bud -t macaque:1.2.
buildah push macaque:1.2 oci-archive:/home/candidate/macaque-1.2.tar
정답: ssh ckad00028
You’re seeing RBAC errors like:
User "system: serviceaccount: gorilla: default" cannot list resource "pods" … in namespace "gorilla"
That means the Pod is running as the default ServiceAccount and needs permission to list pods (and possibly also get/watch).
You must fix it by updating the Deployment (via its manifest file) and giving it the proper RBAC.
1) Confirm the error in logs kubectl -n gorilla get deploy honeybee-deployment kubectl -n gorilla logs deploy/honeybee-deployment --tail=200
If it’s CrashLooping and you need previous logs:
POD=$(kubectl -n gorilla get pods -l app=honeybee -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || kubectl -n gorilla get pods -o jsonpath='{.items[0].metadata.name}')
kubectl -n gorilla logs "$POD" --previous --tail=200
You should see the “cannot list resource pods” line.
2) Create a dedicated ServiceAccount for the app
(Using a dedicated SA is standard practice; the task wants you to “resolve the errors”.) kubectl -n gorilla create serviceaccount honeybee-sa kubectl -n gorilla get sa honeybee-sa
3) Create RBAC: Role + RoleBinding (namespaced) This will allow listing pods in namespace gorilla. cat <<'EOF' > honeybee-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1
kind: Role metadata:
name: honeybee-pod-reader namespace: gorilla rules:
- apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding metadata:
name: honeybee-pod-reader-binding namespace: gorilla subjects:
- kind: ServiceAccount name: honeybee-sa namespace: gorilla roleRef:
apiGroup: rbac.authorization.k8s.io kind: Role name: honeybee-pod-reader
EOF
Apply it:
kubectl apply -f honeybee-rbac.yaml
Quick verification (optional but very useful):
kubectl auth can-i list pods -n gorilla --as=system: serviceaccount: gorilla: honeybee-sa Should return yes.
4) Update the Deployment manifest to use the new ServiceAccount The manifest is at:
/home/candidate/prompt-escargot/honey bee-deployment.yaml Because there’s a space in the filename, quote it.
정답: ssh ckad00018
You cannot create/modify/delete any NetworkPolicy.
So the only way to make the existing policies “take effect” is to ensure the right Pods have the labels/selectors those policies expect.
The task: in namespace charming-macaw, configure things so the target Pod can send + receive traffic ONLY to/from Pods front and db.
1) Inspect what NetworkPolicies already exist (don’t change them) kubectl -n charming-macaw get netpol kubectl -n charming-macaw get netpol -o wide Dump them to see the selectors they use: kubectl -n charming-macaw get netpol -o yaml You are looking for policies that:
select the restricted pod via spec.podSelector and allow ingress/egress only with selectors that match front and db often there’s also a “default deny” policy.
2) Identify the Pods and their current labels kubectl -n charming-macaw get pods -o wide kubectl -n charming-macaw get pods --show-labels
Specifically inspect labels for front and db: kubectl -n charming-macaw get pod front --show-labels kubectl -n charming-macaw get pod db --show-labels (If they’re Deployments instead of single Pods, do:) kubectl -n charming-macaw get deploy --show-labels kubectl -n charming-macaw get pods -l app=front --show-labels kubectl -n charming-macaw get pods -l app=db --show-labels
3) Figure out which pod is “the Pod” to restrict
Usually there’s a third pod (e.g., backend, api, app) besides front and db.
List pods again and identify the “other” one:
kubectl -n charming-macaw get pods
Let’s assume the pod to restrict is called app (replace as needed):
TARGET=<pod-to-restrict>
4) Match the existing NetworkPolicy selectors by labeling pods (allowed)
Because you can’t edit NetworkPolicies, you must make labels on Pods (or their controllers) match the policies’ selectors.
정답: ssh ckad00043
You have two deliverables here:
Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).
Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).
Below is the exact CKAD-style workflow.
1) Find the missing RBAC permissions (use logs + events)
정답: ssh ckad00025
You need to expose the existing app “web-app” externally at:
Host: external.sterling-bengal.local
Path: / (and anything starting with /) → route to web-app
In CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.
1) Find where web-app Service lives (namespace + port) kubectl get svc -A | grep -w web-app
You’ll get something like:
<NAMESPACE> web-app ClusterIP ... <PORT>/TCP
Set the namespace:
NS=<NAMESPACE>
Check the service port(s):
kubectl -n $NS get svc web-app -o yaml
Note the service port number (commonly 80).
Also verify it has endpoints (so it actually routes to pods):
kubectl -n $NS get endpoints web-app -o wide
If endpoints are empty, the Service selector doesn’t match pods ― tell me and I’ll give the exact fix.
But usually it’s fine.
2) Create the Ingress to route / to web-app
Create a manifest (use the service port you saw; I’ll assume 80 below):
cat <<'EOF' > web-app-ingress.yaml apiVersion: networking.k8s.io/v1
kind: Ingress metadata:
name: web-app-ingress spec:
rules:
- host: external.sterling-bengal.local http:
paths:
- path: /
pathType: Prefix backend: service:
name: web-app port:
number: 80
EOF
Apply it:
kubectl -n $NS apply -f web-app-ingress.yaml
Verify:
kubectl -n $NS get ingress web-app-ingress kubectl -n $NS describe ingress web-app-ingress
If your Service port is not 80, change number: 80 to the correct value and re-apply.
3) Test external reachability (as instructed) Run exactly:
curl -i http://external.sterling-bengal.local/
If curl still fails (quick checks)
A) Is there an ingress controller running? kubectl get pods -A | egrep -i 'ingress|nginx' kubectl get svc -A | egrep -i 'ingress|nginx'
B) Does Ingress show an address?
kubectl -n $NS get ingress web-app-ingress -o wide
C) Do we have endpoints?
kubectl -n $NS get endpoints web-app -o wide
정답: ssh ckad00034c
You’re debugging an Ingress → Service → Deployment chain .
The fastest way is:
reproduce the error with the right Host header check Ingress rules (host/path/backend)
check Service (selector/port/targetPort)
check Endpoints (do we have ready pods?)
fix the manifest(s) under /home/candidate/content-marlin / apply + re-test
Below are the exact commands + the most common fixes for this exact symptom.
1) Reproduce the failing request correctly
Even if DNS isn’t set up, you can test with a Host header:
curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlin
If your ingress controller is not on localhost, find the NodePort/LoadBalancer IP .
In these labs it’s often localhost via a local proxy, but if needed:
kubectl get svc -A | egrep -i 'ingress|nginx'
kubectl get nodes -o wide
(But start with the localhost curl above.)
2) Inspect the provided manifests (this is what you must edit) cd /home/candidate/content-marlin/
ls -l sed -n '1,200p' *.yaml
Also view what’s currently live in the cluster: kubectl -n content-marlin get deploy, svc, ingress kubectl -n content-marlin describe ingress content-marlin-ingress kubectl -n content-marlin get ingress content-marlin-ingress -o yaml
What to look for in the Ingress: spec.rules.host should be content-marlin.local spec.rules.http.paths[].path should match /content-marlin Backend service name must be your service
Backend service port must match the service port (name or number)
pathType should be Prefix (usually safest)
3) Validate Service → Pod wiring (most common real cause)
정답: ssh ckad00021
Below is the clean, CKAD-friendly way (YAML + apply + verify + manual job).
1) Create the CronJob grep
Create a file (anywhere, e.g. in your home):
cat <<'EOF' > grep-cronjob.yaml apiVersion: batch/v1
kind: CronJob metadata:
name: grep spec:
schedule: "*/30 * * * *"
successfulJobsHistoryLimit: 96
failedJobsHistoryLimit: 192
jobTemplate:
spec:
activeDeadlineSeconds: 8
template:
spec:
restartPolicy: Never containers:
- name: busybox image: busybox: stable command: ["grep", "-i", "nameserver", "/etc/resolv.conf"]
EOF
Apply it:
kubectl apply -f grep-cronjob.yaml
Verify:
kubectl get cronjob grep kubectl describe cronjob grep
Confirm the key fields quickly:
kubectl get cronjob grep -o jsonpath='{.spec.schedule}{"\n"}{.spec.successfulJobsHistoryLimit}{"\n"}{.spec.failedJobsHistoryLimi t}{"\n"}'
kubectl get cronjob grep -o jsonpath='{.spec.jobTemplate.spec.activeDeadlineSeconds}{"\n"}{.spec.jobTemplate.spec.template.s pec.restartPolicy}{"\n"}'
2) Manually create and execute the one-off Job grep-test from the CronJob Create the Job from the CronJob:
kubectl create job --from=cronjob/grep grep-test Watch it:
kubectl get jobs grep-test kubectl get pods -l job-name=grep-test Get logs (most important proof):
POD=$(kubectl get pods -l job-name=grep-test -o jsonpath='{.items[0].metadata.name}') kubectl logs "$POD"
You should see one or more nameserver ... lines from /etc/resolv.conf.
정답: Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:
memory request = 128Mi memory limit = half of the namespace’s maximum memory constraint You must do this on the correct host.
0) Connect to the correct host ssh ckad00032
1) Confirm the failing Deployment / Pods kubectl -n haddock get deploy nosql kubectl -n haddock get pods -l app=nosql 2>/dev/null || kubectl -n haddock get pods If pods are crashing, check why (you’ll likely see OOMKilled):
kubectl -n haddock describe pod <pod-name>
2) Find the maximum memory constraint set for the haddock namespace
In CKAD labs, this is commonly enforced by a LimitRange (max memory per container). Sometimes it can also be a ResourceQuota.
2A) Check LimitRange (most likely)
kubectl -n haddock get limitrange kubectl -n haddock get limitrange -o yaml
Extract the max memory value quickly:
MAX_MEM=$(kubectl -n haddock get limitrange -o jsonpath='{.items[0].spec.limits[0].max.memory}')
echo "Namespace max memory constraint: $MAX_MEM"
2B) If no LimitRange exists, check ResourceQuota kubectl -n haddock get resourcequota kubectl -n haddock describe resourcequota
If quota is used, you’re looking for something like limits.memory (but the question wording “maximum memory constraint” usually points to LimitRange max.memory).
3) Compute “half of the max memory constraint”
Run this small snippet to compute HALF in Mi (handles Mi and Gi):
HALF_MEM=$(python3 - <<'PY'
import os, re q = os.environ.get("MAX_MEM","").strip() m = re.fullmatch(r"(\d+)(Mi|Gi)", q)
if not m:
raise SystemExit(f"Cannot parse MAX_MEM='{q}'. Expected like 512Mi or 1Gi.") val = int(m.group(1))
unit = m.group(2)
# convert to Mi mi = val if unit == "Mi" else val * 1024 half_mi = mi / / 2 print(f"{half_mi}Mi")
PY
)
echo "Half of max: $HALF_MEM"
Example: if MAX_MEM=512Mi → HALF_MEM=256Mi
Example: if MAX_MEM=1Gi → HALF_MEM=512Mi
4) Update the nosql Deployment (DO NOT delete it)
First, get the container name (Deployment may have a custom container name):
kubectl -n haddock get deploy nosql -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'
Now set resources (this updates the Deployment in-place):
kubectl -n haddock set resources deploy nosql \
--requests=memory=128Mi \
--limits=memory=$HALF_MEM
5) Ensure the update rolls out successfully kubectl -n haddock rollout status deploy nosql
6) Verify the pod has the right requests/limits kubectl -n haddock get deploy nosql -o jsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'
kubectl -n haddock get pods
Pick the new pod and confirm:
kubectl -n haddock describe pod <new-pod-name> | sed -n '/Requests:/,/Limits:/p'
You should see:
Requests: memory 128Mi
Limits: memory <HALF_MEM>
If rollout fails (common cause)
If you accidentally set a limit above the namespace max, pods won’t start .
Check events:
kubectl -n haddock describe deploy nosql kubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20
정답: Do this on ckad00027 and edit the given manifest file (that’s what the task expects).
0) Connect to correct host ssh ckad00027
1) Open the manifest and identify the container + port cd /home/candidate/spicy-pikachu ls -l sed -n '1,200p' app-deployment.yaml
Confirm the container port is 8081 in the YAML (usually under ports:).
2) Edit the YAML to add a readinessProbe
Edit the file:
vi app-deployment.yaml
Inside the Deployment, locate:
spec:
template:
spec:
containers:
- name: ...
image: ...
Add this under the container (same indentation level as image, ports, etc.):
readinessProbe:
httpGet:
path: /healthz port: 8081
initialDelaySeconds: 6
periodSeconds: 3
Notes:
Use port: 8081 (because the app runs on 8081).
Ensure indentation is correct (2 spaces per level commonly).
Save and exit.
3) Apply the updated manifest kubectl apply -f /home/candidate/spicy-pikachu/app-deployment.yaml
4) Ensure the Deployment rolls out successfully kubectl -n prod rollout status deploy app-deployment
5) Verify the readiness probe is set
Check the probe from the live object:
kubectl -n prod get deploy app-deployment -o jsonpath='{.spec.template.spec.containers[0].readinessProbe}{"\n"}'
And confirm pods are becoming Ready:
kubectl -n prod get pods -l app=app-deployment
If the label selector differs, just:
kubectl -n prod get pods kubectl -n prod describe pod <pod-name> | sed -n '/Readiness:/,/Conditions:/p'
That completes the task: readiness probe on /healthz, initialDelaySeconds: 6, periodSeconds: 3.
정답: 0) SSH to the correct host ssh ckad00044 (Optional sanity)
kubectl config current-context kubectl get ns | grep rapid-goat
1) Inspect the Deployment and current container name kubectl -n rapid-goat get deploy busybox kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'
kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[*].image}{"\n"}'
Note the current container name (likely something like busybox). We need to rename it to musl.
2) Edit the Deployment (best for renaming container) Renaming a container is easiest with edit:
kubectl -n rapid-goat edit deploy busybox In the editor, find:
spec:
template:
spec:
containers:
- name: <old-name>
image: <old-image>
Change it to:
- name: musl image: busybox: musl
Save and exit.
3) Ensure the rollout happens and completes kubectl -n rapid-goat rollout status deploy busybox
4) Verify the new Pod template is correct Check the Deployment template:
kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[0].name}{"\n"}{.spec.template.spec.containers[0].image}
{"\n"}'
Check running Pods and the image actually used:
kubectl -n rapid-goat get pods -o wide
POD=$(kubectl -n rapid-goat get pods -l app=busybox -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
If you don’t have that label selector, just pick a pod name from kubectl get pods and:
kubectl -n rapid-goat describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'
정답: Below are the exact steps/commands you can run.
1) Locate the Deployment and its namespace kubectl get deploy -A | grep nginx-resources
You should see output like:
<namespace> nginx-resources ...
Set a variable (replace <NS> with what you see):
NS=<NS>
Confirm replicas:
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'
2) Check if there is a ResourceQuota in that namespace kubectl -n $NS get resourcequota kubectl -n $NS describe resourcequota
If there is a quota, note these fields (common ones): requests.cpu requests.memory limits.cpu limits.memory
3) Decide requests/limits for the Deployment (example values)
If the question (in your environment) provides specific values, use those.
If it doesn’t, a typical safe pair is:
requests: cpu: 100m, memory: 128Mi limits: cpu: 200m, memory: 256Mi
I’ll proceed with these example values. If your lab specifies different numbers, just swap them in.
4) Update the existing Deployment (DO NOT DELETE) Option A (fastest): kubectl set resources
Assuming the container name is the first container (we’ll detect it):
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'
If it prints a single container name, set it like this: kubectl -n $NS set resources deploy nginx-resources \ --requests=cpu=100m, memory=128Mi \ --limits=cpu=200m, memory=256Mi
Verify the Deployment now has resources kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.template.spec.containers[0].resources}{"\n"}'
5) Compute the total resources requested by the Deployment Get replicas:
REPLICAS=$(kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}') echo $REPLICAS
6) Ensure the namespace quota matches (or exceeds) those totals
This is the part the question warns about: if the quota is too low, the Deployment update will fail to roll out.
정답: Below is an exam-style, step-by-step solution (commands + verification). Follow exactly on host ckad000.
0) Connect to the right host ssh ckad000
(Optional but good sanity check) kubectl config current-context kubectl get ns
1) Inspect the existing Deployment (to know its labels/ports) kubectl -n prod get deploy nginx-deployment kubectl -n prod get deploy nginx-deployment -o wide
Check what labels the Pod template already has (important for the Service selector):
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}'
Check container ports (so we expose the correct targetPort):
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.spec.containers[0].ports}{"\n"}'
If ports output is empty, it’s still often nginx on 80, but the safest is to confirm by describing a pod later.
2) Update Deployment to 2 replicas Fastest:
kubectl -n prod scale deploy nginx-deployment --replicas=2 Verify:
kubectl -n prod get deploy nginx-deployment
3) Add label role=webFrontEnd to the Pod (Pod template label)
You must add it under:
spec.template.metadata.labels
Use a patch (quick + safe):
kubectl -n prod patch deploy nginx-deployment \
-p '{"spec":{"template":{"metadata":{"labels":{"role":"webFrontEnd"}}}}}'
Verify the Deployment template now includes it:
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}'
Now verify the running Pods have the label (important!):
kubectl -n prod get pods --show-labels
If the label doesn’t show on pods immediately, wait for rollout:
kubectl -n prod rollout status deploy nginx-deployment kubectl -n prod get pods --show-labels
4) Create a NodePort Service rover exposing the Deployment’s Pods