Solution:

Solution:

create deploy hello-deploy --image=nginx --dry-run=client -o yaml > hello-deploy.yaml

Update deployment image to  nginx:1.17.4 :                                        kubectl set image deploy/hello-deploy nginx=nginx:1.17.4

Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:

memory request = 128Mi

memory limit = half of the namespace’s maximum memory constraint

You must do this on the correct host.

0) Connect to the correct host

ssh ckad00032

1) Confirm the failing Deployment / Pods

kubectl -n haddock get deploy nosql

kubectl -n haddock get pods -l app=nosql 2 > /dev/null || kubectl -n haddock get pods

If pods are crashing, check why (you’ll likely see OOMKilled):

kubectl -n haddock describe pod < pod-name >

2) Find the maximum memory constraint set for the haddock namespace

In CKAD labs, this is commonly enforced by a LimitRange (max memory per container). Sometimes it can also be a ResourceQuota.

2A) Check LimitRange (most likely)

kubectl -n haddock get limitrange

kubectl -n haddock get limitrange -o yaml

Extract the max memory value quickly:

MAX_MEM=$(kubectl -n haddock get limitrange -o jsonpath= ' {.items[0].spec.limits[0] .max.memory} ' )

echo " Namespace max memory constraint: $MAX_MEM "

2B) If no LimitRange exists, check ResourceQuota

kubectl -n haddock get resourcequota

kubectl -n haddock describe resourcequota

If quota is used, you’re looking for something like limits.memory (but the question wording “maximum memory constraint” usually points to LimitRange max.memory).

3) Compute “half of the max memory constraint”

Run this small snippet to compute HALF in Mi (handles Mi and Gi):

HALF_MEM=$(python3 - < < ' PY '

import os, re

q = os.environ.get( " MAX_MEM " , " " ).strip()

m = re.fullmatch(r " (\d+)(Mi|Gi) " , q)

if not m:

raise SystemExit(f " Cannot parse MAX_MEM= ' {q} ' . Expected like 512Mi or 1Gi. " )

val = int(m.group(1))

unit = m.group(2)

# convert to Mi

mi = val if unit == " Mi " else val * 1024

half_mi = mi // 2

print(f " {half_mi}Mi " )

PY

)

echo " Half of max: $HALF_MEM "

Example: if MAX_MEM=512Mi → HALF_MEM=256Mi

Example: if MAX_MEM=1Gi → HALF_MEM=512Mi

4) Update the nosql Deployment (DO NOT delete it)

First, get the container name (Deployment may have a custom container name):

kubectl -n haddock get deploy nosql -o jsonpath= ' {.spec.template.spec.containers[*].name}{ " \n " } '

Now set resources (this updates the Deployment in-place):

kubectl -n haddock set resources deploy nosql \

--requests=memory=128Mi \

--limits=memory=$HALF_MEM

5) Ensure the update rolls out successfully

kubectl -n haddock rollout status deploy nosql

6) Verify the pod has the right requests/limits

kubectl -n haddock get deploy nosql -o jsonpath= ' {.spec.template.spec.containers[0].resources}{ " \n " } '

kubectl -n haddock get pods

Pick the new pod and confirm:

kubectl -n haddock describe pod < new-pod-name > | sed -n ' /Requests:/,/Limits:/p '

You should see:

Requests: memory 128Mi

Limits: memory < HALF_MEM >

If rollout fails (common cause)

If you accidentally set a limit above the namespace max, pods won’t start. Check events:

kubectl -n haddock describe deploy nosql

kubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20

Solution:

ssh ckad00034c

You’re debugging an Ingress → Service → Deployment chain. The fastest way is:

reproduce the error with the right Host header

check Ingress rules (host/path/backend)

check Service (selector/port/targetPort)

check Endpoints (do we have ready pods?)

fix the manifest(s) under /home/candidate/content-marlin/

apply + re-test

Below are the exact commands + the most common fixes for this exact symptom.

1) Reproduce the failing request correctly

Even if DNS isn’t set up, you can test with a Host header:

curl -i -H " Host: content-marlin.local " http://127.0.0.1/content-marlin

If your ingress controller is not on localhost, find the NodePort/LoadBalancer IP. In these labs it’s often localhost via a local proxy, but if needed:

kubectl get svc -A | egrep -i ' ingress|nginx '

kubectl get nodes -o wide

(But start with the localhost curl above.)

2) Inspect the provided manifests (this is what you must edit)

cd /home/candidate/content-marlin/

ls -l

sed -n ' 1,200p ' *.yaml

Also view what’s currently live in the cluster:

kubectl -n content-marlin get deploy,svc,ingress

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get ingress content-marlin-ingress -o yaml

What to look for in the Ingress:

spec.rules.host should be content-marlin.local

spec.rules.http.paths[].path should match /content-marlin

Backend service name must be your service

Backend service port must match the service port (name or number)

pathType should be Prefix (usually safest)

3) Validate Service → Pod wiring (most common real cause)

3.1 Check service selector and ports

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin describe svc content-marlin-deployment 2 > /dev/null || true

kubectl -n content-marlin describe svc

Identify the service that the Ingress points to (from describe ingress).

Check if the Service selector matches pod labels:

kubectl -n content-marlin get pods --show-labels

kubectl -n content-marlin get svc < SERVICE_NAME > -o jsonpath= ' {.spec.selector}{ " \n " } '

3.2 Check endpoints (this tells you instantly if traffic can reach pods)

kubectl -n content-marlin get endpoints

kubectl -n content-marlin get endpoints < SERVICE_NAME > -o wide

If ENDPOINTS is empty → Service selector doesn’t match Pods OR Pods aren’t Ready.

3.3 If endpoints empty, check pod readiness and labels

kubectl -n content-marlin get pods -o wide

kubectl -n content-marlin describe pod < pod-name >

4) Apply the most likely fix patterns

Fix pattern A: Ingress path needs rewrite

If your app serves / but you route /content-marlin, you often need rewrite.

Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:

path: /content-marlin

pathType: Prefix

annotation: rewrite to / (common for nginx ingress)

Example (typical nginx-ingress):

metadata:

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /

spec:

rules:

- host: content-marlin.local

http:

paths:

- path: /content-marlin

pathType: Prefix

backend:

service:

name: < SERVICE_NAME >

port:

number: 80

If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it’s very often nginx.

Fix pattern B: Ingress points to wrong Service port

If the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port), align them:

Either change Ingress backend port.number

Or change Service spec.ports[].port / targetPort

Fix pattern C: Service selector mismatch (endpoints empty)

If pods have label app=content-marlin but service selector is app=content-marlin-deployment (or vice versa), fix the Service selector to match pod labels.

Service should have:

spec:

selector:

app: < label-that-actually-exists-on-pods >

Fix pattern D: Service targetPort wrong

If container listens on 8080 but service targetPort is 80, fix it:

spec:

ports:

- port: 80

targetPort: 8080

5) Apply the corrected manifests

After editing the YAMLs under /home/candidate/content-marlin/:

kubectl apply -f /home/candidate/content-marlin/

Wait for readiness:

kubectl -n content-marlin rollout status deploy content-marlin-deployment

kubectl -n content-marlin get endpoints

kubectl -n content-marlin describe ingress content-marlin-ingress

6) Re-test the URL

curl -i -H " Host: content-marlin.local " http://127.0.0.1/content-marlin

If you still get errors, also check ingress controller logs/events quickly:

kubectl -n content-marlin get events --sort-by=.lastTimestamp | tail -n 30

kubectl get pods -A | egrep -i ' ingress|nginx '

The fastest way for you to finish in 1 shot

Run these and paste the output (I’ll tell you exactly which line to change and what to change it to):

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin get endpoints -o wide

kubectl -n content-marlin get pods --show-labels

sed -n ' 1,200p ' /home/candidate/content-marlin/*.yaml

But even without pasting, if you follow steps 2–4 above, you’ll find the broken link (Ingress rule, Service port, selector, or rewrite) and fix it cleanly.

Solution:

To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.

First, you will need to create a livenessProbe and a readinessProbe in the pod ' s definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.

Here ' s an example of how you can configure the liveness and readiness probes in the pod definition yaml file:

apiVersion: v1

kind: Pod

metadata:

name: probe-pod

spec:

containers:

- name: probe-pod

image: < image-name >

ports:

- containerPort: 8080

livenessProbe:

httpGet:

path: /healthz

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

readinessProbe:

httpGet:

path: /started

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.

You can use kubectl to create the pod by running the following command:

kubectl apply -f < filename > .yaml

Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.

Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.

The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.