Mock Exam 3 Step by Step Solutions

This guide provides concise, exam-focused solutions for every question in Mock Exam Three. Each section includes the goal, the quickest commands or manifests to satisfy requirements, verification steps, and troubleshooting tips. Use the official Kubernetes docs as needed for reference. Table of contents

Question 1 — Enable required sysctl settings for kubeadm
Question 2 — Create ServiceAccount, ClusterRole, ClusterRoleBinding, and Pod
Question 3 — Create StorageClass rancher-sc
Question 4 — Create ConfigMap and mount as env vars in a Deployment
Question 5 — Create PriorityClass and assign to Pod
Question 6 — NetworkPolicy to allow incoming port 80 to np-test-1 / service
Question 7 — Taint a node and create pods with/without tolerations
Question 8 — PVC not binding to PV: fix accessMode mismatch
Question 9 — Fix broken kubeconfig
Question 10 — Scale Deployment and fix control-plane controller issue
Question 11 — Create HPA based on custom pods metric
Question 12 — HTTPRoute to split traffic 80/20 between services
Question 13 — Helm: lint, install new chart, uninstall old release
Question 14 — Output the cluster Pod CIDR to a file

Question 1 — Enable required sysctl settings for kubeadm

Goal: Ensure the following kernel parameters are enabled and persistent on all nodes:

net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1

Reference: kubeadm create-cluster guide (Container runtime setup / enabling IPv4 packet forwarding): https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/

Apply the settings (create persistent file and reload sysctl):

# Persist k8s-required sysctl parameters
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

# Apply settings immediately
sudo sysctl --system

# Verify
sysctl net.ipv4.ip_forward
sysctl net.bridge.bridge-nf-call-iptables

If net.bridge.* keys are missing, load the bridge netfilter module:

sudo modprobe br_netfilter
# To persist across reboots:
echo "br_netfilter" | sudo tee /etc/modules-load.d/br_netfilter.conf

Expected output: sysctl --system applies files and shows the two k8s settings. Some unrelated keys may show “permission denied” — these can be ignored if the k8s keys are set.

Always consult the kubeadm documentation during the exam — it’s allowed and very helpful for exact configuration examples.

Question 2 — Create a service account, ClusterRole, ClusterRoleBinding, and Pod

Goal: Provide a service account pvviewer that can list persistentvolumes, then run a Pod using that service account. Imperative commands:

kubectl create serviceaccount pvviewer
kubectl get sa

Create ClusterRole to allow listing PVs:

kubectl create clusterrole pvviewer-role --resource=persistentvolumes --verb=list
kubectl describe clusterrole pvviewer-role

Bind ClusterRole to the service account (ClusterRoleBinding):

kubectl create clusterrolebinding pvviewer-role-binding --clusterrole=pvviewer-role --serviceaccount=default:pvviewer
kubectl describe clusterrolebinding pvviewer-role-binding

Create a Pod that uses the service account (save as question2.yaml):

apiVersion: v1
kind: Pod
metadata:
  name: pvviewer
spec:
  serviceAccountName: pvviewer
  containers:
  - name: pvviewer
    image: redis

Apply and verify:

kubectl apply -f question2.yaml
kubectl get pod pvviewer
kubectl describe pod pvviewer
# Confirm ServiceAccount used by the Pod
kubectl get pod pvviewer -o yaml | grep serviceAccountName

You should see the Pod running and its Service Account set to pvviewer.

Question 3 — Create a StorageClass `rancher-sc`

Goal: Create a StorageClass named rancher-sc using the rancher.io/local-path provisioner with expansion allowed and delayed binding. Manifest (question3.yaml):

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: rancher-sc
provisioner: rancher.io/local-path
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

Apply and verify:

kubectl apply -f question3.yaml
kubectl get storageclass rancher-sc
kubectl describe storageclass rancher-sc

Question 4 — Create ConfigMap and mount as env vars in a Deployment

Goal: Create app-config ConfigMap in namespace cm-namespace with ENV and LOG_LEVEL keys, then make cm-webapp consume them as environment variables. Create the ConfigMap:

kubectl create configmap app-config -n cm-namespace \
  --from-literal=ENV=production \
  --from-literal=LOG_LEVEL=info

kubectl get cm -n cm-namespace
kubectl describe cm app-config -n cm-namespace

Patch or edit the existing Deployment cm-webapp to import all keys using envFrom. Example snippet to add under the container spec (replace <container-name> and <image> if needed):

spec:
  template:
    spec:
      containers:
      - name: <container-name>
        image: <image>
        envFrom:
        - configMapRef:
            name: app-config

After editing, check pods roll out and verify environment variables inside a pod:

kubectl get pod -n cm-namespace
kubectl describe pod -n cm-namespace -l app=cm-webapp
# Exec into the pod to verify env vars:
kubectl exec -n cm-namespace <pod-name> -- env | egrep 'ENV|LOG_LEVEL'

Question 5 — Create PriorityClass and assign to Pod

Goal: Create a PriorityClass named low-priority (value 50000) and ensure Pod lp-pod in namespace low-priority uses it. Create PriorityClass (question5.yaml):

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: 50000
globalDefault: false
description: "Low priority class for test pods"

Apply and verify:

kubectl apply -f question5.yaml
kubectl get priorityclass

Edit the Pod to use the class: extract, modify, and reapply.

kubectl get pod lp-pod -n low-priority -o yaml > question5-pod.yaml
# Edit question5-pod.yaml: set spec.priorityClassName: low-priority
# Remove any numeric "priority" field (server-generated or explicit)
kubectl delete pod lp-pod -n low-priority
kubectl apply -f question5-pod.yaml
kubectl get pod -n low-priority

If a Pod manifest contains an explicit numeric priority: field and you add priorityClassName, the API server may reject it. Remove the numeric priority field—PriorityClass determines the numeric priority.

Question 6 — NetworkPolicy to allow incoming port 80 to np-test-1 / service

Goal: Create a NetworkPolicy ingress-np-test that allows ingress on TCP port 80 to pods labeled run=np-test-1. Check pod labels:

kubectl get pod --show-labels
# Example: np-test-1 may show label: run=np-test-1

NetworkPolicy manifest (question6.yaml):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-np-test
  namespace: default
spec:
  podSelector:
    matchLabels:
      run: np-test-1
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP
      port: 80
    from:
    - podSelector: {}   # allow any pod from the same namespace

Apply and verify:

kubectl apply -f question6.yaml
kubectl get networkpolicy -n default
kubectl describe networkpolicy ingress-np-test -n default

This enables ingress traffic to pods labeled run=np-test-1 on TCP port 80.

Question 7 — Taint a node and create pods with/without tolerations

Goal: Prevent normal pods from scheduling on node01 by tainting it, then create a pod without toleration (dev-redis) and one with toleration (prod-redis) so it lands on node01. Taint the node:

kubectl taint node node01 env_type=production:NoSchedule
kubectl describe node node01 | grep -i taint

Create dev-redis (no toleration — will not schedule on node01):

kubectl run dev-redis --image=redis:alpine --restart=Never
kubectl get pod -o wide

Create prod-redis with toleration (question7.yaml):

apiVersion: v1
kind: Pod
metadata:
  name: prod-redis
spec:
  tolerations:
  - key: env_type
    operator: Equal
    value: production
    effect: NoSchedule
  containers:
  - name: prod-redis
    image: redis:alpine

Apply and confirm scheduling:

kubectl apply -f question7.yaml
kubectl get pod -o wide
# prod-redis should be scheduled on node01, dev-redis on a different node

Question 8 — PVC not binding to PV: fix accessMode mismatch

Goal: Fix a Pending PVC (app-pvc in storage-ns) when the PV (app-pv) is Available by resolving accessMode mismatch (without editing the PV). Inspect:

kubectl get pv
kubectl get pvc -n storage-ns
kubectl get pvc app-pvc -n storage-ns -o yaml
kubectl get pv app-pv -o yaml

Typical root cause: PV uses ReadWriteOnce but PVC requests ReadWriteMany. Fix by changing the PVC to match the PV:

Export PVC to file:

kubectl get pvc app-pvc -n storage-ns -o yaml > question8.yaml

Edit question8.yaml: set spec.accessModes to ReadWriteOnce. Remove status, resourceVersion, uid, and other cluster-managed fields.
Recreate PVC:

kubectl delete pvc app-pvc -n storage-ns
kubectl apply -f question8.yaml
kubectl get pvc -n storage-ns

After applying, app-pvc should show STATUS: Bound to app-pv.

Question 9 — Fix broken kubeconfig

Goal: Fix /root/CKA/super.kubeconfig that points to the wrong API server address (e.g., https://controlplane:9999 causing connection refused). Verify error:

kubectl get nodes --kubeconfig=/root/CKA/super.kubeconfig
# Error: connection refused to controlplane:9999

Inspect kubeconfig and correct the server URL:

cat /root/CKA/super.kubeconfig
# Look for clusters[].cluster.server

Check where kube-apiserver is listening (default port 6443):

sudo netstat -tulnp | grep kube-apiserver
# expect :::6443 LISTEN (or similar)

Edit the kubeconfig (/root/CKA/super.kubeconfig) and update clusters[].cluster.server to the correct https://<hostname>:6443 or the appropriate host:port. After editing:

kubectl get nodes --kubeconfig=/root/CKA/super.kubeconfig
# Should return nodes if server address corrected

Question 10 — Scale Deployment and fix control-plane controller issue

Goal: Scale nginx-deploy to 3 replicas; if ReplicaSet does not scale, ensure the controller manager is running properly. Scale the Deployment:

kubectl scale deploy nginx-deploy --replicas=3
kubectl get deploy nginx-deploy
kubectl get rs
kubectl get pods

If ReplicaSet stays at 1 and does not scale, inspect controllers:

kubectl get pod -n kube-system

If kube-controller-manager static pod is ImagePullBackOff or CrashLoopBackOff, fix the static pod manifest (kubelet manages static pods via files in /etc/kubernetes/manifests/). Example fix steps:

sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml
# Fix typos in image, args, or volumes (e.g., image name misspelled)
# Save -> kubelet restarts the static pod
kubectl get pod -n kube-system

When the controller manager becomes healthy, the Deployment controller will reconcile and scale ReplicaSets/pods to the desired count.

Question 11 — Create HPA based on custom pods metric

Goal: Create an HPA api-hpa in namespace api targeting api-deployment, scaling between 1 and 20 pods using the pods metric requests_per_second with AverageValue 1000. Manifest (question11.yaml):

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
  namespace: api
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-deployment
  minReplicas: 1
  maxReplicas: 20
  metrics:
    - type: Pods
      pods:
        metric:
          name: requests_per_second
        target:
          type: AverageValue
          averageValue: "1000"

Apply and inspect:

kubectl apply -f question11.yaml
kubectl describe hpa api-hpa -n api

Note: The HPA will be created even if no metrics backend provides requests_per_second; it may display unknown in that case.

Question 12 — HTTPRoute to split traffic 80/20 between services

Goal: Create an HTTPRoute that sends 80% of traffic to web-service and 20% to web-service-v2, attached to web-gateway. Manifest (question12.yaml):

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: web-route
  namespace: default
spec:
  parentRefs:
    - name: web-gateway
      namespace: default
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: web-service
          port: 80
          weight: 80
        - name: web-service-v2
          port: 80
          weight: 20

Apply and verify:

kubectl apply -f question12.yaml
kubectl get httproute -n default
kubectl describe httproute web-route -n default

Traffic split will work provided the Gateway implementation supports weighted backendRefs.

Question 13 — Helm: lint, install new chart, uninstall old release

Goal: Lint the chart at /root/new-version, install it, and uninstall the old release webpage-server-01. Lint and install:

helm lint /root/new-version
helm install new-version-release /root/new-version
helm list

Uninstall the old release:

helm uninstall webpage-server-01
helm list

Question 14 — Output the cluster Pod CIDR to a file

Goal: Identify the cluster Pod CIDR (used by the CNI) and write it to /root/pod-cidr.txt. Get Pod CIDR from the node spec (example uses the first node in kubectl get node output):

kubectl get node -o jsonpath='{.items[0].spec.podCIDR}' > /root/pod-cidr.txt
cat /root/pod-cidr.txt
# Example output: 172.17.0.0/24

Or target a specific node:

kubectl get node controlplane -o jsonpath='{.spec.podCIDR}' > /root/pod-cidr.txt
cat /root/pod-cidr.txt

References and further reading

Kubernetes kubeadm create cluster guide: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/
Kubernetes StorageClass docs: https://kubernetes.io/docs/concepts/storage/storage-classes/
Kubernetes NetworkPolicy docs: https://kubernetes.io/docs/concepts/services-networking/network-policies/
Kubernetes Priority and Preemption: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
Helm documentation: https://helm.sh/docs/

That completes the step-by-step solutions for Mock Exam Three.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Mock Exam 3 Step by Step Solutions

Question 1 — Enable required sysctl settings for kubeadm

Question 2 — Create a service account, ClusterRole, ClusterRoleBinding, and Pod

Question 3 — Create a StorageClass `rancher-sc`

Question 4 — Create ConfigMap and mount as env vars in a Deployment

Question 5 — Create PriorityClass and assign to Pod

Question 6 — NetworkPolicy to allow incoming port 80 to np-test-1 / service

Question 7 — Taint a node and create pods with/without tolerations

Question 8 — PVC not binding to PV: fix accessMode mismatch

Question 9 — Fix broken kubeconfig

Question 10 — Scale Deployment and fix control-plane controller issue

Question 11 — Create HPA based on custom pods metric

Question 12 — HTTPRoute to split traffic 80/20 between services

Question 13 — Helm: lint, install new chart, uninstall old release

Question 14 — Output the cluster Pod CIDR to a file

Watch Video

​Question 1 — Enable required sysctl settings for kubeadm

​Question 2 — Create a service account, ClusterRole, ClusterRoleBinding, and Pod

​Question 3 — Create a StorageClass rancher-sc

​Question 4 — Create ConfigMap and mount as env vars in a Deployment

​Question 5 — Create PriorityClass and assign to Pod

​Question 6 — NetworkPolicy to allow incoming port 80 to np-test-1 / service

​Question 7 — Taint a node and create pods with/without tolerations

​Question 8 — PVC not binding to PV: fix accessMode mismatch

​Question 9 — Fix broken kubeconfig

​Question 10 — Scale Deployment and fix control-plane controller issue

​Question 11 — Create HPA based on custom pods metric

​Question 12 — HTTPRoute to split traffic 80/20 between services

​Question 13 — Helm: lint, install new chart, uninstall old release

​Question 14 — Output the cluster Pod CIDR to a file

Watch Video

Question 1 — Enable required sysctl settings for kubeadm

Question 2 — Create a service account, ClusterRole, ClusterRoleBinding, and Pod

Question 3 — Create a StorageClass `rancher-sc`

Question 4 — Create ConfigMap and mount as env vars in a Deployment

Question 5 — Create PriorityClass and assign to Pod

Question 6 — NetworkPolicy to allow incoming port 80 to np-test-1 / service

Question 7 — Taint a node and create pods with/without tolerations

Question 8 — PVC not binding to PV: fix accessMode mismatch

Question 9 — Fix broken kubeconfig

Question 10 — Scale Deployment and fix control-plane controller issue

Question 11 — Create HPA based on custom pods metric

Question 12 — HTTPRoute to split traffic 80/20 between services

Question 13 — Helm: lint, install new chart, uninstall old release

Question 14 — Output the cluster Pod CIDR to a file