[2026] Pass Linux Foundation CKAD Exam Updated 239 Questions [Q107-Q129]

Rate this post

[2026] Pass Linux Foundation CKAD Exam Updated 239 Questions

Get 2026 Updated Free Linux Foundation CKAD Exam Questions and Answer

What is the difference between Kubernetes and Docker?

Kubernetes is an orchestrator that works with Docker containers. The main components are similar to basic Docker containers. Not difficult to use, but you can’t go deep into it. Dedicated to running Docker containers. You can run your software on it, but you can’t change the core of Kubernetes. The advantage is that you can use everything as-is or integrate with different cloud providers. The reason for this is that Kubernetes is more focused on operations than Docker. Provides very good support for running multi-container orchestrations. It’s easy to install and configure.

You can use it on any cloud provider or locally, and it runs on different operating systems, including Windows. Knowledge of Docker commands or installation is not required. You can use it as a service from DigitalOcean. Kubernetes provides better support for your application. Users can scale up and down your infrastructure according to their needs. You can also define what containers to run on the nodes, which is not the case for Docker. CNCF CKAD Dumps is a simple way to pass this exam. You can make use of it without knowing too much about Docker or Kubernetes. The Kubernetes from Google is fully open source and free for everyone, but you need to buy a license if you want to use it on public clouds.

The CKAD exam is an essential certification for developers who want to advance their careers in the field of Kubernetes application development. CKAD exam is designed to test a developer’s ability to design, build, and deploy Kubernetes applications, and it is recognized by top companies around the world. Linux Foundation Certified Kubernetes Application Developer Exam certification offers a competitive edge to developers, as it validates their skills and expertise in working with Kubernetes, which is one of the most popular container orchestration platforms in the market today.

NO.107 You are building a web application with two microservices: a frontend service (‘frontend’) and a backend service ( ‘ backend’). The frontend service requires access to the backend service, which iS exposed on port 8080 within the Kubernetes cluster. How would you configure an Ingress resource to direct traffic to the correct service based on the hostname, ensuring that the frontend service can access the backend service internally without exposing the backend service to the public internet?

NO.108

Task:
1) Fix any API depreciation issues in the manifest file -/credible-mite/www.yaml so that this application can be deployed on cluster K8s.

2) Deploy the application specified in the updated manifest file -/credible-mite/www.yaml in namespace cobra See the solution below.

NO.109 Exhibit:

Context
A web application requires a specific version of redis to be used as a cache.
Task
Create a pod with the following characteristics, and leave it running when complete:
* The pod must run in the web namespace.
The namespace has already been created
* The name of the pod should be cache
* Use the Ifccncf/redis image with the 3.2 tag
* Expose port 6379

Solution:

NO.110 You have a web application that requires a specific sidecar container to perform certain tasks like logging and monitoring. You need to ensure that this sidecar container iS always running alongside your application pod, even it the main application pod restarts or iS deleted and recreated. How would you achieve this using a DaemonSet in Kubernetes?

NO.111 Context
Anytime a team needs to run a container on Kubernetes they will need to define a pod within which to run the container.
Task
Please complete the following:
* Create a YAML formatted pod manifest
/opt/KDPD00101/podl.yml to create a pod named app1 that runs a container named app1cont using image Ifccncf/arg-output with these command line arguments: -lines 56 -F
* Create the pod with the kubect1 command using the YAML file created in the previous step
* When the pod is running display summary data about the pod in JSON format using the kubect1 command and redirect the output to a file named /opt/KDPD00101/out1.json
* All of the files you need to work with have been created, empty, for your convenience

NO.112 Refer to Exhibit.

Task:
Create a Pod named nginx resources in the existing pod resources namespace.
Specify a single container using nginx:stable image.
Specify a resource request of 300m cpus and 1G1 of memory for the Pod’s container.

NO.113 You are building a Kubernetes application that involves a microservice architecture with multiple pods for each service. One of your services requires a sidecar container to handle logging and monitoring. How would you design the pod structure and define the relationships between the application container and the sidecar container?

NO.114 You are running a web application with multiple services exposed via Kubernetes Ingress. The application has two distinct environments: ‘staging’ and ‘production’ , each with its own set of services and domain names. You need to configure Ingress rules to route traffic to the appropriate services based on the requested hostname and environment. For example, requests to ‘staging.example.com’ should be directed to the staging environment, while requests to ‘example.com’ should go to the production environment. Implement this configuration using Ingress rules.

NO.115 You have a Deployment running a container image for a web application. The application’s configuration files are currently stored within the image itself. you want to move the configuration files to a ConfigMap so that they can be updated independently or the application image. Describe the steps involved in modifying the Deployment and creating a ConfigMap to achieve this separation.

NO.116 Context

Context
A pod is running on the cluster but it is not responding.
Task
The desired behavior is to have Kubemetes restart the pod when an endpoint returns an HTTP 500 on the /healthz endpoint. The service, probe-pod, should never send traffic to the pod while it is failing. Please complete the following:
* The application has an endpoint, /started, that will indicate if it can accept traffic by returning an HTTP 200. If the endpoint returns an HTTP 500, the application has not yet finished initialization.
* The application has another endpoint /healthz that will indicate if the application is still working as expected by returning an HTTP 200. If the endpoint returns an HTTP 500 the application is no longer responsive.
* Configure the probe-pod pod provided to use these endpoints
* The probes should use port 8080

NO.117

Context
A container within the poller pod is hard-coded to connect the nginxsvc service on port 90 . As this port changes to 5050 an additional container needs to be added to the poller pod which adapts the container to connect to this new port. This should be realized as an ambassador container within the pod.
Task
* Update the nginxsvc service to serve on port 5050.
* Add an HAproxy container named haproxy bound to port 90 to the poller pod and deploy the enhanced pod.
Use the image haproxy and inject the configuration located at /opt/KDMC00101/haproxy.cfg, with a ConfigMap named haproxy-config, mounted into the container so that haproxy.cfg is available at
/usr/local/etc/haproxy/haproxy.cfg. Ensure that you update the args of the poller container to connect to localhost instead of nginxsvc so that the connection is correctly proxied to the new service endpoint. You must not modify the port of the endpoint in poller’s args . The spec file used to create the initial poller pod is available in /opt/KDMC00101/poller.yaml See the solution below.

NO.118 You are building a microservices application on Kubernetes, where two services, and ‘service-b’ , need to communicate with each other securely. ‘Service-b’ needs to expose a secure endpoint that is only accessible by ‘service-a’. Describe how you would implement this using Kubernetes resources, including the configuration for the ‘service-b’ endpoint.

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define a Kubernetes Secret:
– Create a Kubernetes secret to store the certificate and key pair for ‘service-W. This secret will be used to secure the communication.
– Example:

2. Configure ‘service-b’ Deployment: – Define a Deployment for ‘service-b’ , specifying a container that uses the secret for TLS. – Ensure that the container has the required dependencies and configuration to use TLS. – Example:

3. Define a Kubernetes Service for ‘service-b’.’ – Create a Service for ‘service-b’ that exposes the secure endpoint on a specific port (e.g., 8443) and uses the LoadBalancer’ type for external access. – Use the ‘targetPort’ field to specify the container port that ‘service-b’ is listening on. – Example:

4. Configure ‘service-a’ Deployment: – Define a Deployment for ‘service-a’, specifying a container that uses the secret for TLS when connecting to service-W. – Example:

5. Update ‘service-a’ Container Configuration: – Within the ‘service-a’ container, ensure the application is configured to use the certificate and key from the mounted volume (‘Ivar/tls/’) for secure communication with ‘service-b’. 6. Verify Secure Communication: – Use ‘kubectl get pods’ to check the status of both ‘service-a’ and ‘service-W pods. – Test the communication between ‘service-a’ and ‘service-b’ by sending requests from the ‘service-a’ pod to the secure endpoint of ‘service-b’. – Verify that the communication is secure and that ‘service-a’ can successfully access the endpoint. Notes: – You may need to adjust the port numbers and image names in the examples to match your specific setup. – Make sure you have the certificate and key in the correct format and base64 encoded before creating the Secret. – You can also use other methods like a Service Account and Role-Based Access Control (RBAC) to restrict access to the secure endpoint, if needed. – This is a simplified example and additional security measures may be required based on your application’s requirements. ,

NO.119 You have a microservice that is deployed in a Kubernetes cluster, and you want to monitor its performance and health using Prometheus and Grafan a. How can you configure Prometneus to scrape metrics from your microservice and create dashboards in Grafana?

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Enable Metrics in Your Microservice:
– Ensure your microservice exposes metrics through an HTTP endpoint using a library like Prometheus Client (for Java), Go metrics, or StatsD.
– Define metrics such as request count, latency, error rate, and other relevant performance indicators.
2. Deploy Prometheus:
– Deploy Prometheus using a ‘Deployment and a ‘Service’
– Configure Prometheus to scrape metrics trom the microservice by adding its endpoint to the ‘scrape_configs’ in the ‘prometheus.yaml’ file.

3. Create a Service for Prometheus to Access the Microservice: – Create a ‘Service’ of type ‘ClusterlP’ that exposes the microservice’s metrics endpoint (usually port 9100). – Ensure Prometheus can reacn this service. 4. Deploy Grafana: – Deploy Gratana using a ‘Deployment’ and a ‘Service’ – Configure Grafana to connect to Prometheus as a data source. 5. Create Dashboards in Grafana: – Use Grafana’s dashboard builder to create custom dashboards that visualize the metrics collected by Prometheus. – Add panels to display graphs, charts, and tables that show the performance and health ot your microservice. 6. Configure Alerts in Grafana: – Configure alerts in Grafana based on specific metrics and thresholds. – Set up notifications to alert you when critical issues arise with the microservice. Note: This approach provides comprehensive monitoring for your microservice. Prometheus scrapes metrics from the microservice, stores them in its time series database, and Grafana visualizes these metrics and provides alerts for potential issues. Example Prometheus Scrape Configuration:

Example Grafana Dashboard: – Create a dashboard with panels that show the following metrics: – Request count per minute – Average request latency – Error rate – CPU and memory usage of the microservice container – Set up alerts to notify you it: – The request count exceeds a certain threshold – The average latency exceeds a certain threshold – The error rate exceeds a certain threshold – The CPU or memory usage exceeds a certain threshold,

NO.120 You are running a web application with a backend service that needs to process daily batch jobs for generating reports. These jobs need to run at a specific time every day. Explain how you would implement these jobs using Kubernetes, ensuring they run reliably and handle potential failures.

NO.121 You are running a microservice-based application on Kubernetes- You want to deploy a new version of one of your microservices, but you need to ensure a smootn rollout without causing downtime. Explain tne steps involved in implementing a blue-green deployment strategy for this microservice.

NO.122 Refer to Exhibit.

Task:
A pod within the Deployment named buffale-deployment and in namespace gorilla is logging errors.
1) Look at the logs identify errors messages.
Find errors, including User “system:serviceaccount:gorilla:default” cannot list resource “deployment” […] in the namespace “gorilla”
2) Update the Deployment buffalo-deployment to resolve the errors in the logs of the Pod.
The buffalo-deployment ‘S manifest can be found at -/prompt/escargot/buffalo-deployment.yaml

NO.123 You are running a Kubernetes cluster with a deployment for a critical application. The application uses sensitive data stored in a secret. To ensure security, you need to implement a policy that prevents the deployment of pods for this application if the secret containing the sensitive data is missing. How would you implement this using Custom Resource Definitions (CRDs) and Admission Webhooks?

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Create a CRD for Secret Validation:
– Define a Custom Resource Definition (CRD) named ‘SecretValidator’ to specify the required secret for the deployment.
– This CRD will have a ‘spec’ section containing the name of the secret.

2. Create a Validation Webhook Configuration: – Create a ValidatingWebhookConfiguration resource. – Define the ‘rules’ to match the ‘SecretValidatoo CRD and ensure that the webhook is triggered for all operations on the CRD. – Specify the ‘failurePolicy’ as ‘Fail’ to prevent pod deployment if the validation fails. – Provide the ‘admissionReviewVersions’ to indicate the supported API versions. – Set the ‘sideEffects’ to ‘None’ as the webhook only performs validation and does not modify the object.

3. Create the Secret Validation Service: – Create a Deployment for a service that will handle the validation webhook requests. – The service should have a container with a code that checks if the required secret exists in the namespace.

4. Implement the Validation Logic in the Service: – In the code of the secret validation service container, you will need to: – Receive the request from the Kubernetes API server. – Retrieve the ‘secretName’ from the ‘SecretValidator’ CRD. – Check if a secret with that name exists in the namespace. – If the secret exists, allow the pod deployment. – If the secret does not exist, deny the pod deployment and return an error message. package main import ( “context” “encoding/json” “fmt” “io/ioutil” “net/http” metavl “k8s.io/apimachinery/pkg/apis/meta/v1” “k8s.io/apimachinery/pkg/runtime” “k8s.io/apimachinery/pkg/runtime/serializer” “k8s.io/apimachinery/pkg/types” “k8s.io/client-go/kubernetes” “k8s.io/client-go/rest” func main() { // Create a Kubernetes clientset config, err := rest. InClusterConfig() if err != nil { panic(err) clientset, err := kubernetes.NewForConfig(config) if err != nil { panic(err) // Create a scheme for decoding the CRD scheme := runtime.NewScheme() codecs := serializer.NewCodecFactory(scheme) deserializer := codecs.UniversalDeserializer() // Start the HTTP server http.HandleFunc(“/validate”, func(w http.ResponseWriter, r http.Request) { // Read the admission review request body body, err := ioutil.ReadAll(r.Body) if err != nil { http.Error(w, fmt.Sprintf(“Error reading body: %v” err), http.StatuslnternalServerError) return } // Unmarshal the admission review request var admissionReview metavl .AdmissionReview , err = deserializer.Decode(body, nil, &admissionReview) if err != nil { http.Error(w, fmt.Sprintf(“Error decoding admission review: %v”, err), http.StatuslnternalServerError) return } // Unmarshal the admission review request var admissionReview metavl .AdmissionReview , err = deserializer.Decode(body, nil, &admissionReview) if err != nil { http.Error(w, fmt.Sprintf(“Error decoding admission review: %v”, err), http.StatuslnternalServerError) return } // Check if the secret exists , err = clientset.CoreV1 ().Secrets(admissionReview.Request.Namespace).Get(context.TODO(), secretValidator.Spec.SecretName, metavl .GetOptions{}) if err nil { // Secret does not exist, deny the request admissionReview.Response = &metavl .AdmissionResponse{ IJID: admissionReview.Request.UlD, Allowed: false, Result: &metavl .Status{ Status: metavl .StatusFailure, Message: fmt.Sprintf(“Secret %s not found in namespace %s”, secretValidator.Spec.SecretName, admissionReview.Request.Namespace), } } } else { // Secret exists, allow the request admissionReview.Response = &metavl .AdmissionResponse{ UID: admissionReview.Request.UlD, Allowed: true, Result: &metavl .Status{ Status: metavl .StatusSuccess, // Marshal the admission review response response, err := json.Marshal(admissionReview) if err nil { http.Error(w, fmt.Sprintf(“Error marshaling admission review: %v”, err), http.StatuslnternalServerError) return } // Write the response to the client w.WriteHeader(http.StatusOK) w.Write(response) }) // Start the HTTP server on port 8443 http.ListenAndServeTLS(“:8443”, “/path/to/cert.pem”, “/path/to/key.pem”, nil) } // Define the SecretValidator CRD type SecretValidator struct { metav1 .TypeMeta metav1 .ObjectMeta Spec SecretValidatorSpec } type SecretValidatorSpec struct {

} 5. Create a SecretValidator Resource: – Create a ‘SecretValidator’ resource in the same namespace as the deployment. – Set the ‘spec.secretName’ to the name of the required secret.

6. Deploy the Application with the Validation: – Ensure that the deployment for the application is in the same namespace as the ‘SecretValidator’ resource. – The deployment should reference the ‘SecretValidator’ resource in its annotations to trigger the validation webhook.

Note: This setup will only work for deployment creation. For other operations (e.g., updates), you need to update the ‘rules’ in the ‘ValidatingWebhookConfiguration’. You can also extend this solution to validate other resources or create more specific validation policies.]

NO.124 You are building a Kubernetes application that requires access to sensitive credentials stored in a Secret. The application should only have access to specific keys within the Secret, and you need to ensure that the Secret is updated without disrupting the application’s functionality. How would you design and implement this functionality using Custom Resource Definitions (CRDs) and Kubernetes resources?

NO.125 You have a Kubernetes application that uses a custom resource definition (CRD) to manage its configuration. The application logs are written to a dedicated container log file. You want to use Kustomize to automate the process of fetching and displaying these logs. How can you achieve this using Kustomize and a custom resource?

NO.126

Given a container that writes a log file in format A and a container that converts log files from format A to format B, create a deployment that runs both containers such that the log files from the first container are converted by the second container, emitting logs in format B.
Task:
* Create a deployment named deployment-xyz in the default namespace, that:
*Includes a primary
lfccncf/busybox:1 container, named logger-dev
*includes a sidecar Ifccncf/fluentd:v0.12 container, named adapter-zen
*Mounts a shared volume /tmp/log on both containers, which does not persist when the pod is deleted
*Instructs the logger-dev
container to run the command

which should output logs to /tmp/log/input.log in plain text format, with example values:

* The adapter-zen sidecar container should read /tmp/log/input.log and output the data to /tmp/log/output.* in Fluentd JSON format. Note that no knowledge of Fluentd is required to complete this task: all you will need to achieve this is to create the ConfigMap from the spec file provided at /opt/KDMC00102/fluentd-configma p.yaml , and mount that ConfigMap to /fluentd/etc in the adapter-zen sidecar container See the solution below.

NO.127 You are designing a container image for a Pytnon application tnat uses a specific version of a Pytnon library C requests’). You want to ensure that this specific library version is always used, regardless of the host system’s installed version. Explain how you would achieve this within your Docket-file.

NO.128 You have a Kustomization file that defines a Deployment with two replicas. You want to configure the deployment to use a different image tag based on the environment it is deployed to- For example, in the ‘dev’ environment, the image tag should be ‘example/nginx:dev’ , while in the ‘prod’ environment, it should be ‘example:nginx:prod’. Describe how to achieve this using Kustomize.

NO.129 You are building a Kubernetes application that requires access to sensitive credentials stored in a Secret. The application should only have access to specific keys within the Secret, and you need to ensure that the Secret is updated without disrupting the application’s functionality. How would you design and implement this functionality using Custom Resource Definitions (CRDs) and Kubernetes resources?