The NKPA course addresses resource contention in Kubernetes clusters, where one application (e.g., ApplicationB) consumes excessive resources, impacting others (e.g., ApplicationA). To mitigate this, the course recommends implementing Quotas and Limit Ranges.

Resource Quotas restrict the total amount of CPU, memory, and other resources a namespace can consume, ensuring fair resource allocation across teams.

Limit Ranges set minimum and maximum resource limits for individual pods and containers within a namespace, preventing any single application from monopolizing resources.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To prevent resource contention in NKP clusters, apply Resource Quotas to limit namespace resource usage and Limit Ranges to enforce pod and container resource boundaries.” For example, the administrator can create a ResourceQuota to cap ApplicationB’s namespace resource usage and a LimitRange to restrict its pod resource requests/limits, ensuring ApplicationA has sufficient resources.

Incorrect Options:

B. Setting up Network Policies: Network Policies control network traffic, not resource usage.

C. Configuring RBAC: RBAC manages access permissions, not resource allocation.

D. Implementing Continuous Deployment (CD): CD automates deployments but does not address resource contention.

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the --to-registry option, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools like Packer to build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is to rerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

The exhibit shows an NKP UI message stating “No insights identified,” indicating that NKP Insights, the platform’s predictive analytics and observability feature, is not active. The NKPA course explains that NKP Insights is a platform application that provides anomaly detection and alerting for Kubernetes clusters but requires deployment and configuration to generate insights.

The correct approach (Option C) involves two steps:

Create a persistent volume claim (PVC) and assign it to nkp-insights: NKP Insights requires persistent storage to save logs, metrics, and historical data for analysis. The course specifies that a PVC must be created to provide this storage, ensuring the application can retain data for generating insights.

Install nkp-insights with nkp create appdeployment nkp-insights --app nkp-insights-1.2.2 --workspace kommander-workspace: This command deploys the NKP Insights application across all clusters in the specified workspace (kommander-workspace). The --app flag specifies the application version, and the deployment ensures that insights are generated for all clusters in the workspace.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To enable NKP Insights, create a PersistentVolumeClaim for storage and deploy the application using nkp create appdeployment nkp-insights --app --workspace to begin generating insights across clusters.” This aligns with the need to control alerts across all company clusters, as NKP Insights provides centralized observability.

Incorrect Options:

A. Acquire the NKP Insights Add-on license: NKP Insights is a platform application included in higher-tier licenses (e.g., NKP Ultimate), not a separate add-on. The course does not indicate a separate license requirement.

B. Install nkp-insights in every cluster with kubectl apply: This method is manual and inefficient. NKP’s appdeployment command automates deployment across all clusters in a workspace.

In an air-gapped NKP environment with no Internet access, a bastion host is a critical component for secure management. The NKPA course defines the primary purpose of a bastion host as providing a secure point for creating and operating NKP clusters. The bastion host acts as a jump server, allowing administrators to securely access the isolated environment, manage cluster deployments, and perform operations like cluster creation, scaling, and upgrades without exposing the environment to external threats.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In a dark site NKP deployment, a bastion host serves as a secure entry point for administrators to create, manage, and operate NKP clusters, ensuring isolation from external networks.” The bastion host is configured with SSH keys and tools like the NKP CLI to facilitate secure interactions with the cluster infrastructure.

Incorrect Options:

A. To store and manage sensitive data: The bastion host is not a storage system; its role is access and management, not data storage.

C. To serve as a load balancer: A bastion host does not perform load balancing; that role is handled by Kubernetes components like MetalLB or cloud-native load balancers.

D. To act as a firewall: While a bastion host enhances security, it is not a firewall. Firewalls are separate components in the network architecture.

The NKPA 6.10 documentation and Nutanix Best Practices recommend using workspaces to segment cluster deployments and their associated infrastructure providers, as well as to manage access control through RBAC. The typical workflow is:

Create an NKP workspace dedicated to the R&D environment.

Create an infrastructure provider (e.g., vSphere, AHV) scoped to that workspace.

Create an NKP group for the R&D team and assign admin roles to this group within the workspace.

Deploy workload clusters in this workspace, leveraging the scoped infrastructure provider.

This ensures that:

The R&D team has full administrative control over their resources.

Clusters and infrastructure are logically isolated in the R&D workspace.

RBAC policies are applied cleanly within the workspace context.

As outlined in the NKPA 6.10 documentation, Goss is used to validate that an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”