Kubernetes and Cloud Native Associate Free Sample Questions

Harbor is a CNCF graduated project that provides a private container registry with integrated vulnerability scanning (like Trivy or Clair). Open Policy Agent (OPA) can be used as a Kubernetes admission controller to enforce policies, such as rejecting pods that attempt to use images from untrusted registries or images with known critical vulnerabilities. This combination directly addresses the requirements.

Jaeger is a CNCF-graduated project for distributed tracing. It allows developers to monitor and troubleshoot transactions in complex distributed systems, like microservices. It visualizes the path of a request as it travels through different services, which is exactly what the team needs to debug the intermittent failures. Prometheus is for metrics, and Fluentd is for logging.

The core principle of pull-based GitOps, as implemented by tools like Flux and Argo CD, is an in-cluster operator (or agent). This operator periodically pulls the state of the Git repository and compares it to the live state of the Kubernetes cluster. If there's a difference (drift), the operator takes action to make the cluster state match the 'source of truth' in Git. This is known as reconciliation.

A Service of type ClusterIP exposes the Service on a cluster-internal IP. This makes the Service reachable only from within the cluster. To expose a Service to the outside world, you must use other Service types like NodePort or LoadBalancer, or an Ingress resource.

The Horizontal Pod Autoscaler (HPA) automatically scales the number of pods in a replication controller, deployment, replica set or stateful set based on observed CPU utilization (or with custom metrics support, on some other application-provided metrics). This is the standard Kubernetes mechanism for scaling out stateless applications based on load.

Kubernetes Secrets are designed specifically for storing and managing sensitive information, such as passwords, OAuth tokens, and ssh keys. They can be mounted as data volumes or exposed as environment variables to a container in a Pod. While they are base64 encoded by default (not encrypted), they are the designated Kubernetes object for handling sensitive data separately from pods and ConfigMaps.

The kubelet, which runs on every worker node, is responsible for managing the lifecycle of pods on that node. It exposes a /metrics endpoint that provides detailed metrics about the node itself and the containers running on it, including container states, restarts, and resource usage. Prometheus is configured to scrape this endpoint on each node to collect these vital metrics for monitoring and alerting.

The Container Network Interface (CNI) is a standard for writing plugins to configure network interfaces for Linux containers. In Kubernetes, the kubelet uses a CNI plugin (like Calico, Flannel, or Cilium) to handle networking tasks when a pod is created or destroyed. This includes assigning an IP address to the pod, setting up routes, and ensuring it can communicate with other pods according to the cluster's networking model.

A Canary Release is a deployment strategy where the new version of an application is gradually rolled out to a small subset of users. Traffic is selectively routed to the new version, allowing teams to monitor its performance and stability in a real production environment. If the new version performs well, traffic is incrementally shifted until all users are on the new version. This matches the described scenario.