CKAD Linux Foundation Certified Kubernetes Application Developer (CKAD) Program Free Practice Exam Questions (2026 Updated)

Solution:

ssh ckad00025

You need to expose the existing app “web-app” externally at:

Host: external.sterling-bengal.local

Path: / (and anything starting with /) → route to web-app

In CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.

1) Find where web-app Service lives (namespace + port)

kubectl get svc -A | grep -w web-app

You’ll get something like:

web-app ClusterIP ... /TCP

Set the namespace:

NS=

Check the service port(s):

kubectl -n $NS get svc web-app -o yaml

Note the service port number (commonly 80).

Also verify it has endpoints (so it actually routes to pods):

kubectl -n $NS get endpoints web-app -o wide

If endpoints are empty, the Service selector doesn’t match pods — tell me and I’ll give the exact fix. But usually it’s fine.

2) Create the Ingress to route / to web-app

Create a manifest (use the service port you saw; I’ll assume 80 below):

cat <<'EOF' > web-app-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: web-app-ingress

spec:

rules:

- host: external.sterling-bengal.local

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: web-app

port:

number: 80

EOF

Apply it:

kubectl -n $NS apply -f web-app-ingress.yaml

Verify:

kubectl -n $NS get ingress web-app-ingress

kubectl -n $NS describe ingress web-app-ingress

If your Service port is not 80, change number: 80 to the correct value and re-apply.

3) Test external reachability (as instructed)

Run exactly:

curl -i http://external.sterling-bengal.local/

If curl still fails (quick checks)

A) Is there an ingress controller running?

kubectl get pods -A | egrep -i 'ingress|nginx'

kubectl get svc -A | egrep -i 'ingress|nginx'

B) Does Ingress show an address?

kubectl -n $NS get ingress web-app-ingress -o wide

C) Do we have endpoints?

kubectl -n $NS get endpoints web-app -o wide

Solution:

To deploy the counter pod to the cluster using the provided YAML spec file, you can use the kubectl apply command. The apply command creates and updates resources in a cluster.

kubectl apply -f /opt/KDOB00201/counter.yaml

This command will create the pod in the cluster. You can use the kubectl get pods command to check the status of the pod and ensure that it is running.

kubectl get pods

To retrieve all currently available application logs from the running pod and store them in the file /opt/KDOB0020l/log_Output.txt, you can use the kubectl logs command. The logs command retrieves logs from a container in a pod.

kubectl logs -f > /opt/KDOB0020l/log_Output.txt

Replace with the name of the pod.

You can also use -f option to stream the logs.

kubectl logs -f > /opt/KDOB0020l/log_Output.txt &

This command will retrieve the logs from the pod and write them to the /opt/KDOB0020l/log_Output.txt file.

Please note that the above command will retrieve all logs from the pod, including previous logs. If you want to retrieve only the new logs that are generated after running the command, you can add the --since flag to the kubectl logs command and specify a duration, for example --since=24h for logs generated in the last 24 hours.

Also, please note that, if the pod has multiple containers, you need to specify the container name using -c option.

kubectl logs -f -c > /opt/KDOB0020l/log_Output.txt

The above command will redirect the logs of the specified container to the file.

Solution:

Solution:

Solution:

Solution:

Solution:

Solution:

ssh ckad00023

You need two outcomes in moose:

At most 10 Pods total (across both Deployments).

About 20% of chipmunk-service traffic goes to canary-chipmunk-deployment.

In Kubernetes Services, traffic distribution is (roughly) proportional to the number of ready endpoints behind the Service. So the standard canary trick is:

total endpoints = 10

canary endpoints = 2

current endpoints = 8That gives ~20% to canary.

1) Inspect what exists

kubectl -n moose get deploy

kubectl -n moose get svc chipmunk-service -o wide

kubectl -n moose describe svc chipmunk-service

Get the Service selector (important):

kubectl -n moose get svc chipmunk-service -o jsonpath='{.spec.selector}{"\n"}'

Check current replicas:

kubectl -n moose get deploy current-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}'

kubectl -n moose get deploy canary-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}'

List pods + labels (to confirm both Deployments’ pods match the Service selector):

kubectl -n moose get pods --show-labels

2) Ensure both Deployments are behind the Service

This is the key: the pods from BOTH deployments must match the Service selector.

If the Service selector is something like app=chipmunk, then both Deployments’ pod templates must include app: chipmunk.

If one Deployment doesn’t match, patch its pod template labels to match the selector.

2A) Example: selector is app=chipmunk

(Only do this if you see the Service selector contains app=chipmunk and one of the deployments is missing it.)

kubectl -n moose patch deploy current-chipmunk-deployment \

-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'

kubectl -n moose patch deploy canary-chipmunk-deployment \

-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'

Wait for rollouts if patches triggered new ReplicaSets:

kubectl -n moose rollout status deploy current-chipmunk-deployment

kubectl -n moose rollout status deploy canary-chipmunk-deployment

Verify endpoints now include pods from both deployments:

kubectl -n moose get endpoints chipmunk-service -o wide

3) Set replicas to enforce “max 10 pods” and “20% canary”

Set:

current = 8

canary = 2Total = 10.

kubectl -n moose scale deploy current-chipmunk-deployment --replicas=8

kubectl -n moose scale deploy canary-chipmunk-deployment --replicas=2

Wait until ready:

kubectl -n moose rollout status deploy current-chipmunk-deployment

kubectl -n moose rollout status deploy canary-chipmunk-deployment

Confirm total pods is 10 (or less) and all are Running/Ready:

kubectl -n moose get pods

kubectl -n moose get pods | tail -n +2 | wc -l

Confirm endpoints count matches 10:

kubectl -n moose get endpoints chipmunk-service -o jsonpath='{.subsets[*].addresses[*].ip}' | wc -w

4) Test load balancing via NodePort 30000

Run several times:

for i in $(seq 1 30); do curl -s http://localhost:30000/; echo; done

You should see canary responses appear roughly ~20% of the time (not exact every run).

If you want a clearer signal, check which pods are endpoints and ensure 2 belong to canary and 8 to current:

kubectl -n moose get pods -l app=chipmunk -o wide

kubectl -n moose get endpoints chipmunk-service -o wide

To allow a pod to send and receive traffic only to and from specific pods, you can use network policies in Kubernetes.

First, you will need to create a network policy that defines the allowed traffic. You can create a network policy yaml file with the following rules:

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

name: newpod-network-policy

namespace: default

spec:

podSelector:

matchLabels:

app: kdsn00201-newpod

ingress:

- from:

- podSelector:

matchLabels:

app: web

- podSelector:

matchLabels:

app: storage

This policy will only allow incoming traffic to the pod with the label app=kdsn00201-newpod from pods with the label app=web or app=storage. If you have different labels on your web and storage pods please update the matchLabels accordingly.

Once you have created the network policy, you can apply it to the cluster by running the following command:

kubectl apply -f .yaml

This will apply the network policy to the cluster, and the newpod will only be able to send and receive traffic to and from the web and storage pods.

Please note that, NetworkPolicy resource is not available by default, you need to enable the NetworkPolicy feature on your Kubernetes cluster. This feature is enabled by default on some clusters and must be explicitly enabled on others. You can check if NetworkPolicy is available by running the command kubectl api-versions | grep networking

Also, you need to ensure that the pods that you want to allow traffic to and from are running on the same namespace.

Solution:

Solution:

To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.

First, you will need to create a livenessProbe and a readinessProbe in the pod's definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.

Here's an example of how you can configure the liveness and readiness probes in the pod definition yaml file:

apiVersion: v1

kind: Pod

metadata:

name: probe-pod

spec:

containers:

- name: probe-pod

image:

ports:

- containerPort: 8080

livenessProbe:

httpGet:

path: /healthz

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

readinessProbe:

httpGet:

path: /started

port: 8080

initialDelaySeconds: 15

periodSeconds: 10

failureThreshold: 3

The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.

You can use kubectl to create the pod by running the following command:

kubectl apply -f <filename>.yaml

Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.

Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.

The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.