CKAD Dumps With Exact Questions and Answers

ssh ckad00021

Below is the clean, CKAD-friendly way (YAML + apply + verify + manual job).

1) Create the CronJob grep

Create a file (anywhere, e.g. in your home):

cat <<'EOF' > grep-cronjob.yaml

apiVersion: batch/v1

kind: CronJob

metadata:

name: grep

spec:

schedule: "*/30 * * * *"

successfulJobsHistoryLimit: 96

failedJobsHistoryLimit: 192

jobTemplate:

spec:

activeDeadlineSeconds: 8

template:

spec:

restartPolicy: Never

containers:

- name: busybox

image: busybox:stable

command: ["grep", "-i", "nameserver", "/etc/resolv.conf"]

EOF

Apply it:

kubectl apply -f grep-cronjob.yaml

Verify:

kubectl get cronjob grep

kubectl describe cronjob grep

Confirm the key fields quickly:

kubectl get cronjob grep -o jsonpath='{.spec.schedule}{"\n"}{.spec.successfulJobsHistoryLimit}{"\n"}{.spec.failedJobsHistoryLimit}{"\n"}'

kubectl get cronjob grep -o jsonpath='{.spec.jobTemplate.spec.activeDeadlineSeconds}{"\n"}{.spec.jobTemplate.spec.template.spec.restartPolicy}{"\n"}'

2) Manually create and execute the one-off Job grep-test from the CronJob

Create the Job from the CronJob:

kubectl create job --from=cronjob/grep grep-test

Watch it:

kubectl get jobs grep-test

kubectl get pods -l job-name=grep-test

Get logs (most important proof):

POD=$(kubectl get pods -l job-name=grep-test -o jsonpath='{.items[0].metadata.name}')

kubectl logs "$POD"

You should see one or more nameserver ... lines from /etc/resolv.conf.

Solution:

ssh ckad00029

You must modify the existing Deployment store-deployment in namespace grubworm so that its containers:

run as user ID 10000

have Linux capability NET_BIND_SERVICE added

And you’re told to use the manifest file at:

/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looks misspelled; follow it exactly on the host)

1) Inspect the current Deployment and locate the manifest file

kubectl -n grubworm get deploy store-deployment

ls -l /home/candidate/daring-moccasin/

Open the manifest:

sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"

2) Edit the manifest to add SecurityContext

Edit the file:

vi "/home/candidate/daring-moccasin/store-deplovment.vaml"

2.1 Set Pod-level runAsUser = 10000

Under:

spec.template.spec add:

securityContext:

runAsUser: 10000

2.2 Add NET_BIND_SERVICE capability at container-level

Under the container spec (for each container in containers:), add:

securityContext:

capabilities:

add: ["NET_BIND_SERVICE"]

A complete example of what it should look like (mind indentation):

apiVersion: apps/v1

kind: Deployment

metadata:

name: store-deployment

namespace: grubworm

spec:

template:

spec:

securityContext:

runAsUser: 10000

containers:

- name: store

image: someimage

securityContext:

capabilities:

add: ["NET_BIND_SERVICE"]

Important notes:

runAsUser can be set at Pod level (applies to all containers) or per-container. Pod-level is cleanest if all containers should run as 10000.

Capabilities must be set per-container (that’s where Kubernetes supports it).

Save and exit.

3) Apply the updated manifest

kubectl apply -f "/home/candidate/daring-moccasin/store-deplovment.vaml"

4) Ensure the Deployment rolls out

kubectl -n grubworm rollout status deploy store-deployment

5) Verify the settings are in effect

Check the rendered pod template:

kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.securityContext}{"\n"}'

kubectl -n grubworm get deploy store-deployment -o jsonpath='{.spec.template.spec.containers[0].securityContext}{"\n"}'

Verify on a running pod:

kubectl -n grubworm get pods

kubectl -n grubworm describe pod | sed -n '/Security Context:/,/Containers:/p'

kubectl -n grubworm describe pod | sed -n '/Containers:/,/Conditions:/p'

If there are multiple containers

Repeat the container-level securityContext.capabilities.add block for each container under spec.template.spec.containers.