I85PREP
⌘ K
CKAD study materials
CKAD study resources

CKAD practice questions

One question at a time. Build your CKAD understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application Design and Build

Which workload resource is designed for a task that runs to completion and is considered finished once its pod exits successfully?

  1. Deployment
  2. Job Correct answer.
  3. StatefulSet
  4. DaemonSet

Explanation

A Job creates pods that run until they terminate successfully, and the controller tracks successful completions against the desired `completions` count. The other workload controllers continuously recreate pods so that a process keeps running.

Question 2Application Design and Build

Which Dockerfile instruction does the `command` field of a container in a Pod spec override?

  1. CMD
  2. EXPOSE
  3. ENTRYPOINT Correct answer.
  4. RUN

Explanation

Kubernetes maps the container `command` field onto the image ENTRYPOINT and the `args` field onto CMD. The two overrides are independent, so setting one leaves the other in place.

Question 3Application Design and Build

Which volume type is created when a pod is scheduled to a node and deleted permanently when that pod is removed?

  1. configMap
  2. emptyDir Correct answer.
  3. persistentVolumeClaim
  4. hostPath

Explanation

An emptyDir volume is created when the pod is assigned to a node and removed when the pod is deleted; it survives container restarts within the pod's lifetime. The other volume types are backed by node storage or by API objects that outlive the pod.

Question 4Application Design and Build

Which command creates a ConfigMap named app-config holding a single key `mode` with value `prod`?

  1. kubectl create secret generic app-config --from-literal=mode=prod --dry-run=client
  2. kubectl create configmap app-config --from-literal=mode:prod
  3. kubectl create configmap app-config --from-file=mode=prod
  4. kubectl create configmap app-config --from-literal=mode=prod Correct answer.

Explanation

`--from-literal` adds one key/value pair and requires an `=` between key and value. `--from-file` instead reads a file whose contents become the value.

Question 5Application Design and Build

Which restartPolicy values are valid inside the pod template of a Job?

  1. Always, OnFailure, or Never
  2. Never only
  3. OnFailure or Never Correct answer.
  4. Always or OnFailure

Explanation

A Job's pod template must specify OnFailure or Never, because Always would restart a finished container forever and the Job could never complete. OnFailure restarts the container in place, while Never leaves the failed pod for inspection.

Question 6Application Design and Build

A Pod specifies `image: nginx:latest` and omits imagePullPolicy. Which policy does Kubernetes apply?

  1. IfNotPresent
  2. Always Correct answer.
  3. Missing
  4. Never

Explanation

When the tag is `latest` or no tag is given, the default imagePullPolicy is Always. Any other explicit tag defaults to IfNotPresent, and the stored object always has a concrete policy.

Question 7Application Design and Build

Two containers in the same Pod reach each other over localhost. Which resource do they share to make this possible?

  1. The container runtime socket
  2. The process namespace by default
  3. The network namespace Correct answer.
  4. The container filesystem

Explanation

All containers in a pod share one network namespace, which means a single IP address and a shared port space, so they can communicate over localhost. Filesystems stay isolated per container, and PID namespaces are shared only when shareProcessNamespace is enabled.

Question 8Application Design and Build

A CronJob uses the schedule `*/5 * * * *`. How often does it create a Job?

  1. Every five minutes Correct answer.
  2. Every five hours
  3. Five times per day
  4. On the fifth day of each month

Explanation

A cron expression has five fields: minute, hour, day of month, month, and day of week. The `*/5` in the minute field means every fifth minute of every hour.

Question 9Application Design and Build

A Pod defines two init containers and one app container. In what order do the containers run?

  1. They run in list order, then the app container starts Correct answer.
  2. The app container starts first and the init containers modify it afterwards
  3. Init containers all start together, then the app container starts
  4. All three start at the same time

Explanation

Init containers run one at a time in the order they appear in the spec, and each must exit successfully before the next begins. Only after all of them complete does kubelet start the app containers.

Question 10Application Design and Build

A Job sets `completions: 6` and `parallelism: 2`. How does the Job controller behave?

  1. It runs only one pod at a time and counts six attempts before failing the Job
  2. At most two run at once; pods are created until six succeed Correct answer.
  3. It runs two pods total and treats six as a retry limit
  4. It runs six pods at once and stops after two succeed

Explanation

`completions` is the number of successful pod completions required, and `parallelism` caps how many pods may run at the same time. The controller keeps creating pods as running ones finish until the completion count is reached.

Question 11Application Design and Build

Which concurrencyPolicy prevents a CronJob from starting a new Job while the previous one is still running?

  1. Serialize
  2. Forbid Correct answer.
  3. Replace
  4. Allow

Explanation

`Forbid` skips the new run when the previous Job has not completed. `Allow` is the default and permits overlap, while `Replace` cancels the running Job and starts a new one.

Question 12Application Design and Build

Which env entry injects the single key `LOG_LEVEL` from the ConfigMap `app-config` into a container?

  1. valueFrom: secretKeyRef: {name: app-config, key: LOG_LEVEL, optional: false}
  2. valueFrom: fieldRef: {fieldPath: LOG_LEVEL}
  3. valueFrom: configMapRef: {name: app-config, key: LOG_LEVEL}
  4. valueFrom: configMapKeyRef: {name: app-config, key: LOG_LEVEL} Correct answer.

Explanation

`configMapKeyRef` selects one key from a ConfigMap and maps it to one environment variable. To import every key at once you would instead use `envFrom` with `configMapRef`, which does not take a key.

Question 13Application Design and Build

A Secret is mounted into a container as a volume. How does the data appear on the container filesystem?

  1. As symlinks resolving directly to the API server
  2. As decoded plaintext, one file per key Correct answer.
  3. As a single JSON document containing all keys
  4. As base64-encoded text exactly as stored in the Secret

Explanation

When kubelet mounts a Secret volume it writes each key as an individual file containing the decoded value. Base64 encoding applies only to how the data is represented in the API object and in YAML.

Question 14Application Design and Build

A volumeMount sets `subPath: app.conf`. What is the effect?

  1. The whole volume is mounted read-only
  2. Only that file is mounted; other files in the directory stay visible Correct answer.
  3. The volume contents are copied into the container image layer
  4. The path resolves against the container working directory outside the volume

Explanation

`subPath` mounts a single file or directory from inside the volume instead of the volume root. Because it does not mount over the whole directory, files already present there, such as configs baked into the image, remain accessible.

Question 15Application Design and Build

What does the accessMode ReadWriteOnce mean for a PersistentVolumeClaim?

  1. It can be mounted read-write by a single node Correct answer.
  2. Many nodes can mount it read-write simultaneously
  3. Many pods on many nodes can mount it read-only
  4. It can be mounted by exactly one pod in the cluster

Explanation

ReadWriteOnce is enforced per node: several pods on the same node may use the volume, but no second node may mount it read-write. ReadWriteMany allows multi-node read-write and ReadOnlyMany allows multi-node read-only access.

Question 16Application Design and Build

A container image runs as UID 0 and the pod sets `securityContext.runAsNonRoot: true`. What happens?

  1. The setting is ignored whenever the image declares USER root at build time
  2. The pod is admitted but the container runs read-only
  3. The container fails to start because the image user is root Correct answer.
  4. The runtime silently switches the process to UID 1000

Explanation

`runAsNonRoot: true` makes kubelet verify the effective UID and refuse to start the container if it resolves to 0. You satisfy the check by setting `runAsUser` to a non-zero value or by using a non-root USER in the image.

Question 17Application Design and Build

A container has a memory limit of 256Mi and a CPU limit of 500m. What happens when it exceeds each limit?

  1. The container is killed for both CPU and memory overuse
  2. Memory overuse causes OOM termination; CPU overuse is throttled Correct answer.
  3. CPU overuse kills the container while memory overuse is only throttled by the cgroup
  4. Both limits only throttle the container and never kill it

Explanation

Memory is an incompressible resource, so exceeding the memory limit triggers the OOM killer and the container restarts per its restart policy. CPU is compressible, so the cgroup throttles the container rather than terminating it.

Question 18Application Design and Build

What is the main benefit of a multi-stage Dockerfile?

  1. It builds several target images at once from one single Dockerfile
  2. Build tools stay in an early stage, so the final image is minimal Correct answer.
  3. It runs all stages in parallel inside one container to save build time
  4. It removes the need for a container registry

Explanation

Each FROM starts a new stage, and COPY --from copies only the required artifacts into the final stage. Compilers, sources, and caches remain in earlier stages, which shrinks the shipped image and reduces its attack surface.

Question 19Application Design and Build

What is an ephemeral container used for?

  1. Replacing a crashed container while keeping its image
  2. Adding a permanent sidecar to a running Deployment
  3. Reserving resources for a future restart
  4. Debugging a running Pod without editing its spec Correct answer.

Explanation

Ephemeral containers are appended to `ephemeralContainers` at runtime, typically through `kubectl debug`, to inspect an existing pod. They may not specify resources or ports, they are not restarted, and they cannot be removed once added.

Question 20Application Design and Build

An image defines `ENTRYPOINT ["/bin/server"]` and `CMD ["--port=8080"]`. A Pod sets only `args: ["--port=9090"]`. What command runs?

  1. /bin/server --port=9090 Correct answer.
  2. --port=9090 as the entrypoint
  3. /bin/server --port=8080
  4. Nothing runs because both fields must be set together

Explanation

`command` overrides ENTRYPOINT and `args` overrides CMD, and the two overrides are independent of each other. Setting only args keeps the image entrypoint and replaces only the default arguments.

Question 21Application Design and Build

A Job uses `completionMode: Indexed` with `completions: 3`. How can each pod learn which shard it should process?

  1. From the annotation batch.kubernetes.io/job-completion-index Correct answer.
  2. From an environment variable named JOB_INDEX that the Job controller injects
  3. From the status conditions of the Job object
  4. From the container image tag used by the pod

Explanation

In Indexed mode the controller stamps each pod with the annotation `batch.kubernetes.io/job-completion-index`, valued from 0 to completions-1, and gives it a matching hostname. Workloads read that index to partition work deterministically.

Question 22Application Design and Build

A Job sets `activeDeadlineSeconds: 60`. What is the result if the Job is still running after 60 seconds?

  1. The Job is paused and resumes automatically once cluster resources free up
  2. The pods are restarted once with a doubled timeout
  3. Its running pods are terminated and the Job is marked as failed Correct answer.
  4. Only the newest pod is deleted and the Job continues

Explanation

`activeDeadlineSeconds` is measured from the Job's start time, and when it elapses the controller terminates active pods. The Job is then recorded as Failed with reason DeadlineExceeded.

Question 23Application Design and Build

A ConfigMap is consumed both as an environment variable and as a mounted volume, then edited with kubectl. What do the running containers see?

  1. The file updates after a kubelet sync; the env var keeps its old value Correct answer.
  2. Neither updates until the pod is restarted
  3. The env var updates but the mounted file does not
  4. Both the environment variable and the mounted file update within a few seconds

Explanation

Kubelet periodically re-syncs mounted ConfigMap volumes, so file contents eventually reflect an edit, unless subPath or an immutable ConfigMap is used. Environment variables are resolved only at container start and need a container restart to change.

Question 24Application Design and Build

A Pod stays Pending and its events indicate the PersistentVolumeClaim cannot be bound. Which cause fits that symptom?

  1. The volume is mounted using subPath inside the container
  2. The PVC asks for a StorageClass with no provisioner and no PV matches Correct answer.
  3. The Pod's ServiceAccount is missing from its namespace, so the volume cannot attach
  4. The Pod's imagePullPolicy is set to Always

Explanation

A pod cannot be scheduled until every PVC it references is Bound. If the requested class has no working provisioner and no existing PV matches the size, access mode, and class, the claim stays Pending and the pod follows.

Question 25Application Design and Build

A Job sets `backoffLimit: 4` and its pod template uses `restartPolicy: OnFailure`. The container keeps failing. How are retries handled?

  1. Each container restart counts as a failure; the Job fails when four are exceeded Correct answer.
  2. Each restart doubles the allowed failures for that individual pod
  3. The limit applies only to CronJob-created Jobs and not to plain Jobs
  4. Restarts are unlimited because the pod is never replaced by the controller

Explanation

With OnFailure the same pod is kept and its container is restarted, and each failed attempt counts toward backoffLimit. Once the limit is exceeded the Job controller marks the Job Failed and stops creating further pods.

Question 26Application Design and Build

A Pod mounts an emptyDir volume at /cache and a container writes files there. What happens to that data when the Pod is deleted?

  1. The volume must be released by a PersistentVolume before it can be reused.
  2. The data is deleted when the Pod is removed from the node. Correct answer.
  3. The volume persists until the node is rebooted.
  4. The data is retained on the node and reattached to a new Pod with the same name.

Explanation

An emptyDir is created when a Pod is scheduled to a node and exists only for the lifetime of that Pod on that node. When the Pod is removed, the directory and its contents are deleted. It is therefore suitable for scratch space and for sharing files between containers of the same Pod, not for durable storage.

Question 27Application Design and Build

Which statement describes what annotations are for, as opposed to labels?

  1. They are projected into containers as environment variables at startup.
  2. They store non-identifying metadata that selectors cannot use for matching. Correct answer.
  3. They are indexed and can be referenced in Service and ReplicaSet selectors.
  4. They must use DNS-label syntax and are limited to 63 characters.

Explanation

Annotations carry arbitrary, non-identifying metadata such as build IDs, contact information, or tool configuration. Unlike labels, they are not indexed and therefore cannot be used in label selectors to select objects. Both labels and annotations are key/value maps, but only labels participate in selection.

Question 28Application Design and Build

Which description matches the sidecar pattern in a multi-container Pod?

  1. A container that runs alongside the app container and adds functionality such as log shipping or proxying. Correct answer.
  2. A container that runs to completion before the app containers start.
  3. A container that is scheduled exactly once per node in the cluster.
  4. A container that runs only after all app containers have exited.

Explanation

The sidecar pattern adds a helper container that runs concurrently with the main container and extends it without changing its code, for example a log forwarder or a local proxy. Because both containers share the Pod's network namespace and can share volumes, the sidecar can interact closely with the app. Containers that run to completion before the app are init containers.

Question 29Application Design and Build

What is the effect of placing a .dockerignore file at the root of the build context?

  1. It keeps the listed paths out of the build context that is sent to the builder. Correct answer.
  2. It removes the listed paths from the final image after the build completes.
  3. It marks the listed paths read-only inside the running container.
  4. It skips any COPY instruction in the Dockerfile that references the listed paths.

Explanation

A .dockerignore file excludes the listed patterns from the context that the client sends to the builder (or daemon). Excluding large or sensitive files such as node_modules, .git, or local .env files speeds up the build and prevents accidental inclusion. It does not change how COPY instructions themselves are written.

Question 30Application Design and Build

A Pod's app container talks to a proxy container on localhost, and that proxy forwards the traffic to an external database whose address the app never knows. Which multi-container pattern is this?

  1. Init container
  2. Ephemeral container
  3. Adapter
  4. Ambassador Correct answer.

Explanation

The ambassador pattern places a proxy between the app and an external service so the app connects to a stable local address while the proxy handles discovery, routing, or TLS. The app stays unaware of the real backend address. Adapter instead transforms the app's output or interface into a shape other systems expect.

Question 31Application Design and Build

A container reads the main container's raw log file from a shared volume and rewrites it into the JSON schema the cluster's log pipeline requires. Which pattern does this container implement?

  1. Adapter Correct answer.
  2. Ambassador
  3. Ephemeral container
  4. Init container

Explanation

The adapter pattern converts or exposes the main container's output through a standardized interface so external consumers see a uniform format. Here the standardized interface is the JSON log schema the pipeline expects. The ambassador pattern instead proxies network traffic to remote services.

Question 32Application Design and Build

An image declares ENTRYPOINT ["/app/start.sh"] and CMD ["--verbose"]. A Pod spec sets command: ["/app/debug.sh"] but sets no args. What runs in the container?

  1. /app/start.sh runs with no arguments.
  2. The container fails to start because command conflicts with ENTRYPOINT.
  3. /app/start.sh runs with /app/debug.sh appended as an argument.
  4. /app/debug.sh runs with --verbose as its argument. Correct answer.

Explanation

The Pod's command field replaces the image's ENTRYPOINT, and the args field replaces the image's CMD. When only command is set, the image's CMD is still used as the arguments to that command. So the container executes /app/debug.sh with --verbose.

Question 33Application Design and Build

A Deployment named web runs a container named nginx with image nginx:1.24. Which command changes only that container to nginx:1.25 and rolls out the change?

  1. kubectl set image deployment/web nginx=nginx:1.25 Correct answer.
  2. kubectl apply image deployment/web --container=nginx --image=nginx:1.25
  3. kubectl set image deployment/web nginx:1.25
  4. kubectl edit image deployment/web nginx=nginx:1.25

Explanation

The kubectl set image syntax is resource/name container=image, so the container name and the new image are joined by an equals sign. Updating the Pod template this way triggers the Deployment's rolling update strategy. There is no 'kubectl edit image' or 'kubectl apply image' subcommand.

Question 34Application Design and Build

A label selector contains matchExpressions with key tier, operator In, and values [frontend, backend]. Which objects does it select?

  1. Objects whose tier label equals either frontend or backend. Correct answer.
  2. Objects whose tier label differs from frontend and from backend.
  3. Objects that carry both frontend and backend as values of the tier label.
  4. Objects that do not carry the tier label.

Explanation

The In operator is a set-based requirement that matches when the label's value is a member of the listed set. Because a label has a single value, an object matches if that value is frontend or backend. matchLabels is the simpler equality form, while matchExpressions adds set-based operators such as In, NotIn, and Exists.

Question 35Application Design and Build

A ConfigMap is mounted as a volume and the volumeMount does not set defaultMode. What permissions are applied to the mounted files?

  1. 0755
  2. 0777
  3. 0600
  4. 0644 Correct answer.

Explanation

When defaultMode is omitted on a ConfigMap volume, Kubernetes applies mode 0644, meaning the owner can read and write and others can read. The mode is expressed in decimal in the YAML but corresponds to the octal permission 0644. Setting defaultMode lets you tighten or loosen this per volume.

Question 36Application Design and Build

A Pod sets securityContext.runAsUser: 1000, and one of its containers sets securityContext.runAsUser: 2000. Under which UID does that container's process run?

  1. 1000
  2. The Pod is rejected because both levels set runAsUser.
  3. 2000 Correct answer.
  4. 0

Explanation

Pod-level security settings provide defaults that individual containers can override. When a container declares its own securityContext value, that value takes precedence for that container only. Setting the field at both levels is valid and the other containers still inherit 1000.

Question 37Application Design and Build

A Job has ttlSecondsAfterFinished set to 100. What is the effect of this field?

  1. Its Pods are deleted 100 seconds after each Pod starts.
  2. Failed Pods are retried for at most 100 seconds.
  3. The Job is suspended for 100 seconds after every failed Pod.
  4. The Job and its Pods are deleted 100 seconds after the Job finishes. Correct answer.

Explanation

ttlSecondsAfterFinished asks the TTL controller to clean up a finished Job, along with its Pods and status, once the given number of seconds has elapsed since completion. It applies after the Job reaches a terminal state, not to individual Pod lifetimes. Deleting the Job also removes its object from the API, so its logs and status disappear with it.

Question 38Application Design and Build

A container has a memory limit of 128Mi and writes 200Mi of data into an emptyDir volume declared with medium: Memory. What is the likely outcome?

  1. The container is OOM-killed because the tmpfs pages count against its memory limit. Correct answer.
  2. The data spills over to node disk once the memory limit is reached.
  3. The Pod's memory limit is raised automatically to accommodate the volume.
  4. The writes fail with a no-space error and the container keeps running.

Explanation

A memory-backed emptyDir is a tmpfs mount whose pages are charged to the memory cgroup of the containers that write to it. Exceeding the container's memory limit therefore triggers the OOM killer rather than a disk-full error. To avoid this, size the limit to cover both the application's heap and the volume contents, or use a disk-backed emptyDir with a sizeLimit.

Question 39Application Design and Build

Why does an image built with the shell form ENTRYPOINT ./server shut down less gracefully than one built with ENTRYPOINT ["./server"]?

  1. The shell form blocks the image from running with a read-only root filesystem.
  2. The binary runs as a child of /bin/sh -c, so it does not receive SIGTERM directly. Correct answer.
  3. The shell form disables the exec-style probes performed by the kubelet.
  4. The shell form prevents the process from writing to stdout, so container logs are lost.

Explanation

The exec form runs the binary as PID 1 in the container, so the kubelet's SIGTERM reaches it and it can run its own shutdown logic. The shell form wraps the command in /bin/sh -c, making the shell PID 1 while the real server is a child that may never see the signal. The process then has to wait for the grace period to expire and is killed with SIGKILL.

Question 40Application Design and Build

In a Node.js Dockerfile, why should COPY package*.json ./ and RUN npm ci appear before COPY . .?

  1. COPY instructions may not reference the same directory twice in one Dockerfile.
  2. It lets the dependency install layer come from cache when only source files change. Correct answer.
  3. RUN instructions must always precede COPY instructions in a Dockerfile.
  4. It keeps the node_modules directory out of the final image.

Explanation

Each instruction creates a layer that Docker caches and reuses while the inputs are unchanged. Copying only the dependency manifests first means the install layer is invalidated only when those manifests change, so ordinary source edits rebuild from the copy step onward. This shortens rebuild times considerably for dependency-heavy projects.

Question 41Application Deployment

Which command blocks until a Deployment's rolling update finishes and exits with an error if the rollout fails?

  1. kubectl get deployment web -o yaml
  2. kubectl rollout history deployment/web
  3. kubectl rollout status deployment/web Correct answer.
  4. kubectl describe deployment web

Explanation

kubectl rollout status watches the rollout in progress, waiting until it completes and returning a non-zero exit code when it stalls or fails. This makes it the standard command for gating a deployment in CI or a script.

Question 42Application Deployment

A Deployment has 10 replicas with maxSurge: 25% and maxUnavailable: 20%. What is the largest number of Pods that can exist at the same time during a rolling update?

  1. 15 Pods
  2. 12 Pods
  3. 13 Pods Correct answer.
  4. 14 Pods

Explanation

maxSurge is a percentage of the desired replica count and rounds up, so 25% of 10 becomes 3 extra Pods. maxUnavailable rounds down, so 20% of 10 becomes 2. The peak Pod count is replicas plus maxSurge, which is 13.

Question 43Application Deployment

A Deployment currently sits at revision 5. You run kubectl rollout undo deployment/web --to-revision=3. What is the result?

  1. Only the Deployment's metadata is reverted; the running Pods are left untouched.
  2. The Deployment is paused at revision 3 until you resume the rollout manually.
  3. Revision 3's Pod template is applied and stored as a new, higher revision number. Correct answer.
  4. Revisions 4 and 5 are deleted and revision 3 remains the newest revision.

Explanation

Rolling back to a specific revision copies that revision's Pod template into the Deployment spec and the controller records the change as a new revision. The rolled-back-to entry is removed from the history so the numbering stays unique, and a normal rolling update runs to replace the Pods.

Question 44Application Deployment

Which Deployment field limits how many old ReplicaSets are retained so that earlier revisions remain available for rollback?

  1. maxSurge
  2. progressDeadlineSeconds
  3. revisionHistoryLimit Correct answer.
  4. minReadySeconds

Explanation

revisionHistoryLimit sets how many superseded ReplicaSets the Deployment controller keeps, and each retained ReplicaSet corresponds to a revision you can roll back to. Its default is 10, and setting it to 0 discards the ability to roll back.

Question 45Application Deployment

A Deployment is configured with strategy type Recreate. What happens to the existing Pods when the Pod template changes?

  1. New Pods are created first and old Pods are removed only once the new ones are ready.
  2. The old Pods keep running and the new Pods are created in a separate ReplicaSet that stays at zero.
  3. Old and new Pods run side by side, each receiving an equal share of traffic.
  4. All existing Pods are terminated before any new Pods are created. Correct answer.

Explanation

The Recreate strategy tears the old ReplicaSet down to zero before bringing the new one up, so there is a period with no running Pods. It is used when two versions cannot safely coexist, for example when they share an incompatible persistent volume.

Question 46Application Deployment

Which command changes the replica count of an existing Deployment named web to 5 without editing YAML?

  1. kubectl edit deployment/web --replicas=5
  2. kubectl scale deployment/web --replicas=5 Correct answer.
  3. kubectl scale deployment web --count=5
  4. kubectl set replicas deployment/web 5

Explanation

kubectl scale takes a resource and a --replicas flag that sets the desired replica count directly. It patches only spec.replicas, leaving the Pod template untouched and therefore creating no new revision.

Question 47Application Deployment

Which command installs the chart in the local directory ./mychart as release myrel in namespace prod, creating the namespace if it does not exist?

  1. helm install myrel ./mychart --namespace prod --create-namespace Correct answer.
  2. helm install ./mychart myrel --namespace prod
  3. helm deploy myrel ./mychart --namespace prod --create
  4. helm upgrade myrel ./mychart --namespace prod --install

Explanation

helm install takes the release name first and the chart reference second, and requires --create-namespace to create a namespace that does not already exist. Without that flag the install fails if the namespace is missing.

Question 48Application Deployment

A Helm release named myrel has revisions 1, 2, and 3, and revision 2 is the last known good state. Which command restores revision 2 in the cluster?

  1. helm rollback myrel 2 Correct answer.
  2. helm revert myrel --revision 2
  3. helm undo myrel 2
  4. helm upgrade myrel --rollback 2

Explanation

helm rollback takes the release name and an optional revision number and redeploys the manifests from that revision. The rollback itself is recorded as a new revision rather than deleting history.

Question 49Application Deployment

Which file must be present in a directory for kubectl apply -k to treat that directory as a Kustomize root?

  1. Kustomization
  2. kustomize.yaml
  3. values.yaml
  4. kustomization.yaml Correct answer.

Explanation

kubectl -k looks for a file named exactly kustomization.yaml (or kustomization.yml or Kustomization) in the given directory; that file declares the resources and the transformations to apply. values.yaml is a Helm convention, not a Kustomize one.

Question 50Application Deployment

An overlay's kustomization.yaml contains an images entry with name: nginx, newName: registry.local/nginx, and newTag: 1.25. What does this produce?

  1. The nginx image is pinned to its digest and the tag is discarded.
  2. An image pull secret is generated for registry.local so nginx:1.25 can be fetched.
  3. Container images named nginx in the referenced resources become registry.local/nginx:1.25. Correct answer.
  4. A new container named registry.local/nginx is added to every Pod spec.

Explanation

The images transformer matches container image names in the resources being built and replaces them with the new name, tag, or digest given in the overlay. The base files stay unchanged, which is the point of keeping image versions in the overlay.