Mock Exam 2 Step by Step Solutions

This guide provides concise, actionable solutions for each question in Mock Exam 2. Each section includes the requirements, ready-to-apply manifests or commands, verification steps, and important notes to help you reproduce and verify results in your Kubernetes clusters. Table of Contents

Question 1 — Create a default local StorageClass
Question 2 — Deployment with sidecar log agent (shared volume)
Question 3 — Create Ingress to route to service
Question 4 — Create deployment and perform rolling image update
Question 5 — Create user John via CSR and grant Role permissions
Question 6 — Create nginx pod, ClusterIP service and test DNS resolution
Question 7 — Create a static pod on cluster1-node01
Question 8 — Create Horizontal Pod Autoscaler (HPA)
Question 9 — Troubleshoot cluster where kubectl fails (kubelet inactive)
Question 10 — Modify existing Gateway to use TLS (HTTPS)
Question 11 — Find and uninstall Helm release using vulnerable image
Question 12 — Apply most restrictive NetworkPolicy to allow only front-end -> back-end
Question 13 — Fix a failing Deployment due to ResourceQuota
Question 14 — Install Calico and configure CIDR 172.17.0.0/16, verify pod communication

Useful references

Kubernetes StorageClass: https://kubernetes.io/docs/concepts/storage/storage-classes/
Kubernetes Ingress: https://kubernetes.io/docs/concepts/services-networking/ingress/
Kubernetes RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
Kubernetes HPA: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
Gateway API: https://gateway-api.sigs.k8s.io/
Calico installation: https://docs.projectcalico.org/getting-started/kubernetes/

This document preserves the applied manifests and order of operations so you can copy/paste the shown YAML or commands. Replace placeholders such as <pod-name> or file names with your values as needed.

Summary of resources by question

Question	Primary Resource(s)	Key Command Examples
1	StorageClass	`kubectl apply -f question1.yaml`
2	Deployment, Namespace	`kubectl apply -f question2.yaml`
3	Ingress, Namespace	`kubectl apply -f question3.yaml`
4	Deployment (rolling update)	`kubectl set image deployment/nginx-deploy nginx=nginx:1.17`
5	CertificateSigningRequest, Role, RoleBinding	`kubectl certificate approve john-developer`
6	Pod, Service	`kubectl run nginx-resolver --image=nginx --restart=Never`
7	Static Pod (file on node)	Place manifest under `/etc/kubernetes/manifests/` on node
8	HorizontalPodAutoscaler	`kubectl apply -f webapp-hpa.yaml`
9	Systemd/kubelet troubleshooting	`sudo systemctl start kubelet`
10	Gateway (Gateway API)	`kubectl apply -f question10.yaml`
11	Helm release removal	`helm get manifest <release> -n <ns> \| grep -i "kodekloud/webapp-color:v1"`
12	NetworkPolicy	`kubectl apply -f net-pol-3.yaml`
13	Deployment & ResourceQuota adjustments	`kubectl edit deployment backend-api`
14	Calico installation & IPPool CIDR	`kubectl apply -f custom-resources.yaml`

Question 1 — Create a default local StorageClass

Requirements:

StorageClass name: local-sc.
Default StorageClass.
Static/local provisioner (kubernetes.io/no-provisioner).
Enable allowVolumeExpansion: true.
volumeBindingMode: WaitForFirstConsumer.

Manifest (apply on control plane node cluster1-controlplane):

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-sc
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"
provisioner: kubernetes.io/no-provisioner
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
parameters: {}

Commands:

# On cluster1-controlplane: create question1.yaml with the manifest above then:
kubectl apply -f question1.yaml

# Expected:
# storageclass.storage.k8s.io/local-sc created

kubernetes.io/no-provisioner indicates manual (static) provisioning. Marking the StorageClass as default uses the storageclass.kubernetes.io/is-default-class: "true" annotation.

Question 2 — Deployment with sidecar log agent (shared volume)

Requirements:

Deployment logging-deployment in namespace logging-ns.
1 replica.
Main container app-container (busybox:1.28) writes to /var/log/app/app.log.
Sidecar log-agent tails the same log file.
Shared volume: emptyDir.

Deployment manifest (ready to apply as question2.yaml):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: logging-deployment
  namespace: logging-ns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app-logger
  template:
    metadata:
      labels:
        app: app-logger
    spec:
      volumes:
        - name: log-volume
          emptyDir: {}
      containers:
        - name: app-container
          image: busybox:1.28
          command:
            - sh
            - -c
            - |
              mkdir -p /var/log/app
              while true; do
                echo "Log entry" >> /var/log/app/app.log
                sleep 5
              done
          volumeMounts:
            - name: log-volume
              mountPath: /var/log/app
        - name: log-agent
          image: busybox:1.28
          command:
            - sh
            - -c
            - tail -f /var/log/app/app.log
          volumeMounts:
            - name: log-volume
              mountPath: /var/log/app

Apply and verify:

kubectl create namespace logging-ns
kubectl apply -f question2.yaml

# Verify pod exists
kubectl get pods -n logging-ns

# View log-agent output
kubectl logs <pod-name> -c log-agent -n logging-ns
# Follow logs:
kubectl logs <pod-name> -c log-agent -n logging-ns -f

Expected: app-container appends lines; log-agent tails and outputs them to its stdout.

Question 3 — Create Ingress to route to service

Requirements:

Deployment webapp-deploy in ingress-ns exists.
Service: webapp-svc.
Ingress: webapp-ingress in ingress-ns.
IngressClass: nginx.
Host: kodekloud-ingress.app.
Path / with pathType: Prefix.
Backend service webapp-svc port 80.

Ingress manifest (question3.yaml):

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  namespace: ingress-ns
spec:
  ingressClassName: nginx
  rules:
    - host: kodekloud-ingress.app
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webapp-svc
                port:
                  number: 80

Apply and test:

kubectl create namespace ingress-ns
kubectl apply -f question3.yaml
kubectl get ingress -n ingress-ns

# From a client that resolves kodekloud-ingress.app to the ingress IP:
curl -s http://kodekloud-ingress.app/

Note: Ensure DNS or /etc/hosts resolves kodekloud-ingress.app to the ingress controller external IP.

Question 4 — Create deployment and do a rolling image update

Requirements:

Create deployment nginx-deploy with nginx:1.16.
Update to nginx:1.17 using rolling update.

Commands:

kubectl create deployment nginx-deploy --image=nginx:1.16 --dry-run=client -o yaml > question4.yaml
kubectl apply -f question4.yaml

kubectl get deploy nginx-deploy
kubectl rollout history deployment nginx-deploy

# Rolling update
kubectl set image deployment/nginx-deploy nginx=nginx:1.17

# Verify revision history and rollout status
kubectl rollout history deployment nginx-deploy
kubectl rollout status deployment/nginx-deploy
kubectl rollout history deployment nginx-deploy --revision=2

Notes: The default strategy is RollingUpdate, so no additional configuration is required.

Question 5 — Create user John via CSR and grant Role permissions

Goal:

Create CSR john-developer from john.csr, approve it, extract certificate.
Create Role developer in development namespace granting pod CRUD verbs.
Bind the user john via RoleBinding.

Generate CSR object

Base64-encode the CSR (single line) and substitute into the manifest request: field.

# Base64 encode CSR
base64 -w0 john.csr
# Copy output and replace <BASE64_CSR> in the manifest below

CSR manifest (question5-csr.yaml):

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: john-developer
spec:
  signerName: kubernetes.io/kube-apiserver-client
  request: <BASE64_CSR>
  usages:
    - digital signature
    - key encipherment
    - client auth

Apply, approve, and extract the issued cert:

kubectl apply -f question5-csr.yaml
kubectl get csr john-developer
kubectl certificate approve john-developer

# Get issued certificate (base64) and decode to john.crt
kubectl get csr john-developer -o jsonpath='{.status.certificate}' | base64 -d > john.crt

Keep the private key secure. The CSR alone does not include the private key. Use the signed certificate john.crt with the private key to configure kubectl contexts for user john.

Role and RoleBinding (save as question5-rbac.yaml):

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
  namespace: development
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "list", "get", "update", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: john-developer-role-binding
  namespace: development
subjects:
  - kind: User
    name: john
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

Apply and verify:

kubectl create namespace development
kubectl apply -f question5-rbac.yaml

# Test impersonation permission
kubectl auth can-i create pods --as=john -n development   # expected: yes
kubectl auth can-i create pods --as=john -n default     # expected: no

Note: The username in the CSR determines the principal to use in RoleBinding subjects.

Question 6 — Create nginx pod, ClusterIP service and test DNS resolution

Requirements:

Pod nginx-resolver using nginx image.
Service nginx-resolver-service of type ClusterIP.
From an ephemeral busybox pod, nslookup the service and pod DNS names and save outputs.

Create pod and service:

kubectl run nginx-resolver --image=nginx --restart=Never
kubectl expose pod nginx-resolver --name=nginx-resolver-service --port=80 --target-port=80 --type=ClusterIP
kubectl get svc nginx-resolver-service

DNS lookups using ephemeral busybox pods:

# Lookup service and save output to nginx.svc (local file on client)
kubectl run test-nslookup --image=busybox:1.28 --rm -it --restart=Never -- nslookup nginx-resolver-service > nginx.svc

# Get pod IP and do pod-FQDN lookup
POD_IP=$(kubectl get pod nginx-resolver -o jsonpath='{.status.podIP}')
# Convert IP to dash format for pod DNS: e.g., 172.17.1.18 -> 172-17-1-18
IP_DASH=$(echo $POD_IP | tr '.' '-')
kubectl run test-nslookup2 --image=busybox:1.28 --rm -it --restart=Never -- nslookup ${IP_DASH}.default.pod.cluster.local > nginx.pod

Notes:

Service DNS: nginx-resolver-service.default.svc.cluster.local.
Pod DNS: <ip-with-dashes>.<namespace>.pod.cluster.local.

Question 7 — Create a static pod on cluster1-node01

Requirements:

Static pod named nginx-critical on cluster1-node01.
Kubelet monitors /etc/kubernetes/manifests.

Steps:

Generate static pod manifest locally:

kubectl run nginx-critical --image=nginx --restart=Never --dry-run=client -o yaml > static.yaml

SSH into cluster1-node01 and place manifest:

# on cluster1-node01
sudo mv static.yaml /etc/kubernetes/manifests/static.yaml
# kubelet watches this path and will create the static pod automatically

Verify from control plane:

kubectl get pod -o wide
# Static pod will appear and have the NODE column set to cluster1-node01

Notes:

Kubelet creates static pods locally and registers them with the API server. Names may include the node suffix in the control plane view.

Question 8 — Create Horizontal Pod Autoscaler (HPA)

Requirements:

HPA backend-hpa for Deployment backend-deployment in namespace backend.
minReplicas: 3, maxReplicas: 15.
Scale on average memory utilization 65%.
Use autoscaling/v2.

HPA manifest (webapp-hpa.yaml):

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: backend-hpa
  namespace: backend
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: backend-deployment
  minReplicas: 3
  maxReplicas: 15
  metrics:
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 65

Apply and verify:

kubectl create namespace backend
kubectl apply -f webapp-hpa.yaml
kubectl describe hpa backend-hpa -n backend

Note: Metrics Server must be installed and running for the HPA to collect memory metrics.

Question 9 — Troubleshoot cluster where kubectl fails (kubelet inactive)

Scenario:

kubectl reports connection refused to API server (e.g., dial tcp <api-server-ip>:6443: connect: connection refused).

Troubleshooting steps (on the control plane node):

Confirm the API server is unreachable:

kubectl get nodes
# Observed error: connection refused to API server

Check kubelet status and system containers:

sudo systemctl status kubelet

# If kubelet is inactive, start and enable it
sudo systemctl start kubelet
sudo systemctl enable kubelet

Verify control plane static pods are created by kubelet:

crictl ps -a | grep kube-apiserver
kubectl get pods -n kube-system
kubectl get nodes

Explanation: On clusters using static pods for control plane components, kubelet must be running to create the API server container. If kubelet is down, the API server won’t be present and kubectl cannot connect.

Question 10 — Modify existing Gateway to use TLS (HTTPS)

Requirements:

On cluster1-node1, edit Gateway web-gateway in namespace cka5673.
Listener should use port 443, protocol HTTPS, hostname kodekloud.com.
TLS certificate from Secret kodekloud-tls.

Steps:

kubectl get gateway -n cka5673 -o yaml > question10.yaml
# Edit question10.yaml:
# - change spec.listeners to use port: 443, protocol: HTTPS, hostname: kodekloud.com
# - configure TLS using certificateRefs or secret references per your Gateway API version

Example snippet to update (Gateway API gateway.networking.k8s.io/v1 style):

spec:
  gatewayClassName: kodekloud
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      hostname: kodekloud.com
      tls:
        certificateRefs:
          - name: kodekloud-tls
      allowedRoutes:
        namespaces:
          from: Same

Apply:

kubectl create namespace cka5673
kubectl apply -f question10.yaml
kubectl get gateway -n cka5673

The exact TLS field might vary by Gateway implementation/version (tls.certificateRefs vs tls.secretRef or similar). Always inspect the cluster’s Gateway API documentation or the CRD to confirm the correct field.

Question 11 — Find and uninstall Helm release using vulnerable image

Goal:

Detect Helm release that deployed image kodekloud/webapp-color:v1 and uninstall it.

Steps:

# List all releases in all namespaces
helm list -A

# Search release manifests for the vulnerable image
helm get manifest <release-name> -n <namespace> | grep -i "kodekloud/webapp-color:v1"

# Once you find the release, uninstall it
helm uninstall <release-name> -n <namespace>
# Example:
# helm uninstall atlanta-page-apd -n atlanta-page-04

Notes:

Use helm get manifest and grep to search across releases for specific images or resources. Uninstalling the Helm release removes associated resources.

Question 12 — Apply most restrictive NetworkPolicy to allow only front-end -> back-end

Requirement:

Allow ingress to backend pods only from the frontend namespace; deny database namespace traffic.
Do not delete existing policies; apply the one that is most restrictive while meeting the requirements.

Selected policy (most restrictive) — net-pol-3 in backend namespace:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: net-policy-3
  namespace: backend
spec:
  podSelector: {}
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend
      ports:
        - protocol: TCP
          port: 80

Apply:

kubectl apply -f net-pol-3.yaml

Explanation: This policy only allows ingress on TCP/80 from namespaces labeled name: frontend, effectively denying traffic from other namespaces (including database).

Question 13 — Fix a failing Deployment due to ResourceQuota

Scenario:

Deployment backend-api desired 3 replicas but pods fail due to ResourceQuota (exceeded quota: cpu-mem-quota).

Troubleshooting and fix:

Inspect the deployment, ReplicaSet, and ResourceQuota:

kubectl describe deployment backend-api
kubectl describe rs backend-api-<rs-suffix>
kubectl describe resourcequota cpu-mem-quota

Events indicate requests.memory exceeded the quota (e.g., used 256Mi, hard 300Mi).

Adjust pod resource requests.memory (reduce) in the deployment spec:

kubectl edit deployment backend-api
# Modify spec.template.spec.containers[].resources.requests.memory to a lower value (e.g., 90Mi)

Optionally delete the failing ReplicaSet so a new one is created from the updated template:

kubectl delete rs backend-api-6b6454f5cf
# Kubernetes will create a new ReplicaSet using the updated deployment template
kubectl get deployment backend-api
# Expect READY 3/3 when resolved

Notes:

If you cannot change pod requests, request an increase to the ResourceQuota (if permitted).
The root cause was exceeding namespace resource quotas; lowering requests allows scheduling within the quota limit.

Question 14 — Install Calico and configure CIDR 172.17.0.0/16, verify pod communication

Requirements:

Deploy Calico CNI and set Pod CIDR to 172.17.0.0/16.
Verify pod-to-pod communication via pod IPs.

Steps (on cluster4):

Download upstream Calico manifests and modify IPPool CIDR:

curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.29.2/manifests/custom-resources.yaml

# Edit custom-resources.yaml:
# Set spec.calicoNetwork.ipPools[0].cidr: "172.17.0.0/16" in the Installation/IPPools resource

Apply Calico manifests:

kubectl apply -f custom-resources.yaml

Deploy a test nginx pod and verify connectivity:

kubectl run web-app --image=nginx --restart=Never
kubectl get pod web-app -o wide

POD_IP=$(kubectl get pod web-app -o jsonpath='{.status.podIP}')

kubectl run test --rm -it --image=jrecord/nettools --restart=Never -- curl http://${POD_IP}/
# Expect nginx welcome page HTML in response

Notes:

Ensure the Calico IPPool is configured before pods are assigned IPs if you require a specific Pod CIDR.
After successful CNI installation and IPPool configuration, pods should be reachable by pod IP across the cluster.

This completes the step-by-step solutions for Mock Exam 2. Refer to the linked Kubernetes docs and respective project pages for additional details and implementation nuances.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Mock Exam 2 Step by Step Solutions

Summary of resources by question

Question 1 — Create a default local StorageClass

Question 2 — Deployment with sidecar log agent (shared volume)

Question 3 — Create Ingress to route to service

Question 4 — Create deployment and do a rolling image update

Question 5 — Create user John via CSR and grant Role permissions

Question 6 — Create nginx pod, ClusterIP service and test DNS resolution

Question 7 — Create a static pod on cluster1-node01

Question 8 — Create Horizontal Pod Autoscaler (HPA)

Question 9 — Troubleshoot cluster where kubectl fails (kubelet inactive)

Question 10 — Modify existing Gateway to use TLS (HTTPS)

Question 11 — Find and uninstall Helm release using vulnerable image

Question 12 — Apply most restrictive NetworkPolicy to allow only front-end -> back-end

Question 13 — Fix a failing Deployment due to ResourceQuota

Question 14 — Install Calico and configure CIDR 172.17.0.0/16, verify pod communication

Watch Video

Practice Lab

​Summary of resources by question

​Question 1 — Create a default local StorageClass

​Question 2 — Deployment with sidecar log agent (shared volume)

​Question 3 — Create Ingress to route to service

​Question 4 — Create deployment and do a rolling image update

​Question 5 — Create user John via CSR and grant Role permissions

​Question 6 — Create nginx pod, ClusterIP service and test DNS resolution

​Question 7 — Create a static pod on cluster1-node01

​Question 8 — Create Horizontal Pod Autoscaler (HPA)

​Question 9 — Troubleshoot cluster where kubectl fails (kubelet inactive)

​Question 10 — Modify existing Gateway to use TLS (HTTPS)

​Question 11 — Find and uninstall Helm release using vulnerable image

​Question 12 — Apply most restrictive NetworkPolicy to allow only front-end -> back-end

​Question 13 — Fix a failing Deployment due to ResourceQuota

​Question 14 — Install Calico and configure CIDR 172.17.0.0/16, verify pod communication

Watch Video

Practice Lab

Summary of resources by question

Question 1 — Create a default local StorageClass

Question 2 — Deployment with sidecar log agent (shared volume)

Question 3 — Create Ingress to route to service

Question 4 — Create deployment and do a rolling image update

Question 5 — Create user John via CSR and grant Role permissions

Question 6 — Create nginx pod, ClusterIP service and test DNS resolution

Question 7 — Create a static pod on cluster1-node01

Question 8 — Create Horizontal Pod Autoscaler (HPA)

Question 9 — Troubleshoot cluster where kubectl fails (kubelet inactive)

Question 10 — Modify existing Gateway to use TLS (HTTPS)

Question 11 — Find and uninstall Helm release using vulnerable image

Question 12 — Apply most restrictive NetworkPolicy to allow only front-end -> back-end

Question 13 — Fix a failing Deployment due to ResourceQuota

Question 14 — Install Calico and configure CIDR 172.17.0.0/16, verify pod communication