Kubernetes

[Kubernetes] CKA Udemy Lightning Lab - 1 풀이

sooondubu 2025. 10. 1. 17:56

 

 

Certified Kubernetes Administrator (CKA) with Practice Tests - Mumshad Mannambeth
Lightning Lab - 1 풀이


문제 1.

Upgrade the current version of kubernetes from 1.32.0 to 1.33.0 exactly using the kubeadm utility. Make sure that the upgrade is carried out one node at a time starting with the controlplane node. To minimize downtime, the deployment gold-nginx should be rescheduled on an alternate node before upgrading each node. Upgrade controlplane node first and drain node node01 before upgrading it. Pods for gold-nginx should run on the controlplane node subsequently.

 

https://v1-31.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/

마스터 노드 업그레이드

controlplane ~ ➜  k get no
NAME           STATUS   ROLES           AGE   VERSION
controlplane   Ready    control-plane   45m   v1.32.0
node01         Ready    <none>          45m   v1.32.0

controlplane ~ ➜  k drain controlplane --ignore-daemonsets 
node/controlplane cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/canal-wspgh, kube-system/kube-proxy-6kdlt
evicting pod kube-system/coredns-7484cd47db-n6z4f
evicting pod kube-system/calico-kube-controllers-5745477d4d-cmdqn
evicting pod kube-system/coredns-7484cd47db-96tcp
pod/calico-kube-controllers-5745477d4d-cmdqn evicted
pod/coredns-7484cd47db-n6z4f evicted
pod/coredns-7484cd47db-96tcp evicted
node/controlplane drained
controlplane ~ ➜ kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"32", GitVersion:"v1.32.0", GitCommit:"70d3cc986aa8221cd1dfb1121852688902d3bf53", GitTreeState:"clean", BuildDate:"2024-12-11T18:04:20Z", GoVersion:"go1.23.3", Compiler:"gc", Platform:"linux/amd64"}

controlplane ~ ➜  kubelet --version
Kubernetes v1.32.0

controlplane ~ ➜  kubectl version
Client Version: v1.32.0
Kustomize Version: v5.5.0
Server Version: v1.32.0
controlplane ~ ➜  vi /etc/apt/sources.list.d/kubernetes.list 

---

# 버전을 1.33 으로 수정
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.33/deb/ /
controlplane ~ ➜  apt update

controlplane ~ ➜  sudo apt-cache madison kubeadm

   kubeadm | 1.33.5-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.4-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.3-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.2-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.1-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.0-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages

# kubeadm 업그레이드  버전을 바꿔준다
controlplane ~ ➜  sudo apt-mark unhold kubeadm && \
sudo apt-get update && sudo apt-get install -y kubeadm='1.33.0-1.1' && \
sudo apt-mark hold kubeadm
controlplane ~ ➜  kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"33", EmulationMajor:"", EmulationMinor:"", MinCompatibilityMajor:"", MinCompatibilityMinor:"", GitVersion:"v1.33.0", GitCommit:"60a317eadfcb839692a68eab88b2096f4d708f4f", GitTreeState:"clean", BuildDate:"2025-04-23T13:05:48Z", GoVersion:"go1.24.2", Compiler:"gc", Platform:"linux/amd64"}
controlplane ~ ➜  kubeadm upgrade plan
[preflight] Running pre-flight checks.
[upgrade/config] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade/config] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.
[upgrade] Running cluster health checks
[upgrade] Fetching available versions to upgrade to
[upgrade/versions] Cluster version: 1.32.0
[upgrade/versions] kubeadm version: v1.33.0
I1001 07:38:24.398178   42559 version.go:261] remote version is much newer: v1.34.1; falling back to: stable-1.33
[upgrade/versions] Target version: v1.33.5
[upgrade/versions] Latest version in the v1.32 series: v1.32.9

Components that must be upgraded manually after you have upgraded the control plane with 'kubeadm upgrade apply':
COMPONENT   NODE           CURRENT   TARGET
kubelet     controlplane   v1.32.0   v1.33.5
kubelet     node01         v1.32.0   v1.33.5

Upgrade to the latest stable version:

COMPONENT                 NODE           CURRENT    TARGET
kube-apiserver            controlplane   v1.32.0    v1.33.5
kube-controller-manager   controlplane   v1.32.0    v1.33.5
kube-scheduler            controlplane   v1.32.0    v1.33.5
kube-proxy                               1.32.0     v1.33.5
CoreDNS                                  v1.10.1    v1.12.0
etcd                      controlplane   3.5.16-0   3.5.21-0

You can now apply the upgrade by executing the following command:

        kubeadm upgrade apply v1.33.5

Note: Before you can perform this upgrade, you have to update kubeadm to v1.33.5.

_____________________________________________________________________

The table below shows the current state of component configs as understood by this version of kubeadm.
Configs that have a "yes" mark in the "MANUAL UPGRADE REQUIRED" column require manual config upgrade or
resetting to kubeadm defaults before a successful upgrade can be performed. The version to manually
upgrade to is denoted in the "PREFERRED VERSION" column.

API GROUP                 CURRENT VERSION   PREFERRED VERSION   MANUAL UPGRADE REQUIRED
kubeproxy.config.k8s.io   v1alpha1          v1alpha1            no
kubelet.config.k8s.io     v1beta1           v1beta1             no
_____________________________________________________________________
controlplane ~ ➜  kubeadm upgrade apply v1.33.0
[upgrade] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.
[upgrade/preflight] Running preflight checks
        [WARNING SystemVerification]: cgroups v1 support is in maintenance mode, please migrate to cgroups v2
[upgrade] Running cluster health checks
[upgrade/preflight] You have chosen to upgrade the cluster version to "v1.33.0"
[upgrade/versions] Cluster version: v1.32.0
[upgrade/versions] kubeadm version: v1.33.0
[upgrade] Are you sure you want to proceed? [y/N]: y
# ...

controlplane ~ ➜  apt-mark unhold kubelet kubectl && \
apt-get update && apt-get install -y kubelet=1.33.0-1.1 kubectl=1.33.0-1.1 && \
apt-mark hold kubelet kubectl
controlplane ~ ➜  k version
Client Version: v1.33.0
Kustomize Version: v5.6.0
Server Version: v1.33.0

controlplane ~ ➜  kubelet --version
Kubernetes v1.33.0
controlplane ~ ➜  k uncordon controlplane 
node/controlplane uncordoned
controlplane ~ ➜  systemctl daemon-reload
controlplane ~ ➜  systemctl restart kubelet

워커 노드 업그레이드

controlplane ~ ➜  k drain node01 --ignore-daemonsets 

node/node01 already cordoned
Warning: ignoring DaemonSet-managed Pods: kube-system/canal-8d596, kube-system/kube-proxy-rfjwv
evicting pod admin2406/deploy3-774bd65f4c-ctdbs
evicting pod kube-system/coredns-674b8bbfcf-q26s7
evicting pod admin2406/deploy1-5f589444b9-f588c
evicting pod admin2406/deploy2-695cd46565-wjnsx
evicting pod admin2406/deploy4-7b458ddfbc-vdp8v
evicting pod default/gold-nginx-795575c6bc-wp48b
evicting pod kube-system/calico-kube-controllers-5745477d4d-67nvv
evicting pod kube-system/coredns-674b8bbfcf-dh9wb
evicting pod admin2406/deploy5-9dc6bd8d6-qbx7d
I1001 07:47:07.215834   51780 request.go:752] "Waited before sending request" delay="1.035945125s" reason="client-side throttling, not priority and fairness" verb="GET" URL="https://controlplane:6443/api/v1/namespaces/admin2406/pods/deploy5-9dc6bd8d6-qbx7d"
pod/deploy1-5f589444b9-f588c evicted
pod/deploy2-695cd46565-wjnsx evicted
pod/deploy4-7b458ddfbc-vdp8v evicted
pod/deploy5-9dc6bd8d6-qbx7d evicted
pod/calico-kube-controllers-5745477d4d-67nvv evicted
pod/deploy3-774bd65f4c-ctdbs evicted
pod/gold-nginx-795575c6bc-wp48b evicted
pod/coredns-674b8bbfcf-q26s7 evicted
pod/coredns-674b8bbfcf-dh9wb evicted
node/node01 drained
controlplane ~ ➜  ssh node01

vi /etc/apt/sources.list.d/kubernetes.list 

---

# 버전을 1.33 으로 수정
deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.33/deb/ /
node01 ~ ➜  sudo apt-cache madison kubeadm

   kubeadm | 1.33.5-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.4-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.3-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.2-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.1-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
   kubeadm | 1.33.0-1.1 | https://pkgs.k8s.io/core:/stable:/v1.33/deb  Packages
node01 ~ ➜  apt-mark unhold kubeadm && \
apt-get update && apt-get install -y kubeadm=1.33.0-1.1 && \
apt-mark hold kubeadm
node01 ~ ➜  kubeadm upgrade node
[upgrade] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade] Use 'kubeadm init phase upload-config --config your-config-file' to re-upload it.
[upgrade/preflight] Running pre-flight checks
        [WARNING SystemVerification]: cgroups v1 support is in maintenance mode, please migrate to cgroups v2
[upgrade/preflight] Skipping prepull. Not a control plane node.
[upgrade/control-plane] Skipping phase. Not a control plane node.
[upgrade/kubeconfig] Skipping phase. Not a control plane node.
W1001 07:50:40.033322   54011 postupgrade.go:117] Using temporary directory /etc/kubernetes/tmp/kubeadm-kubelet-config1476646155 for kubelet config. To override it set the environment variable KUBEADM_UPGRADE_DRYRUN_DIR
[upgrade] Backing up kubelet config file to /etc/kubernetes/tmp/kubeadm-kubelet-config1476646155/config.yaml
[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
[upgrade/kubelet-config] The kubelet configuration for this node was successfully upgraded!
[upgrade/addon] Skipping the addon/coredns phase. Not a control plane node.
[upgrade/addon] Skipping the addon/kube-proxy phase. Not a control plane node.
node01 ~ ➜  apt-mark unhold kubelet kubectl && \
apt-get update && apt-get install -y kubelet=1.33.0-1.1 kubectl=1.33.0-1.1 && \
apt-mark hold kubelet kubectl
node01 ~ ➜  kubelet --version
Kubernetes v1.33.0

node01 ~ ➜  k version
Client Version: v1.33.0
Kustomize Version: v5.6.0
Error from server (NotFound): the server could not find the requested resource
node01 ~ ➜  systemctl daemon-reload
node01 ~ ➜  systemctl restart kubelet

컨트롤 D 눌러서 controlplane

controlplane ~ ➜ k uncordon node01
node/node01 uncordoned

문제 2.

Print the names of all deployments in the admin2406 namespace in the following format:

DEPLOYMENT CONTAINER_IMAGE READY_REPLICAS NAMESPACE


The data should be sorted by the increasing order of the deployment name.

Example:

DEPLOYMENT CONTAINER_IMAGE READY_REPLICAS NAMESPACE
deploy0 nginx:alpine 1 admin2406

Write the result to the file /opt/admin2406_data.


https://kubernetes.io/docs/reference/kubectl/jsonpath/

controlplane ~ ➜  k get deployments.apps -n admin2406 deploy1 -o json
{
    "apiVersion": "apps/v1",
    "kind": "Deployment",
    "metadata": {
        "annotations": {
            "deployment.kubernetes.io/revision": "1"
        },
        "creationTimestamp": "2025-10-01T08:35:15Z",
        "generation": 1,
        "labels": {
            "app": "deploy1"
        },
        "name": "deploy1",
        "namespace": "admin2406",
        "resourceVersion": "2524",
        "uid": "3944cabc-227c-4fd1-935f-1f42cd84686c"
    },
    "spec": {
        "progressDeadlineSeconds": 600,
        "replicas": 1,
        "revisionHistoryLimit": 10,
        "selector": {
            "matchLabels": {
                "app": "deploy1"
            }
        },
        "strategy": {
            "rollingUpdate": {
                "maxSurge": "25%",
                "maxUnavailable": "25%"
            },
            "type": "RollingUpdate"
        },
        "template": {
            "metadata": {
                "creationTimestamp": null,
                "labels": {
                    "app": "deploy1"
                }
            },
            "spec": {
                "containers": [
                    {
                        "image": "nginx",
                        "imagePullPolicy": "Always",
                        "name": "nginx",
                        "resources": {},
                        "terminationMessagePath": "/dev/termination-log",
                        "terminationMessagePolicy": "File"
                    }
                ],
                "dnsPolicy": "ClusterFirst",
                "restartPolicy": "Always",
                "schedulerName": "default-scheduler",
                "securityContext": {},
                "terminationGracePeriodSeconds": 30
            }
        }
    },
    "status": {
        "availableReplicas": 1,
        "conditions": [
            {
                "lastTransitionTime": "2025-10-01T08:35:20Z",
                "lastUpdateTime": "2025-10-01T08:35:20Z",
                "message": "Deployment has minimum availability.",
                "reason": "MinimumReplicasAvailable",
                "status": "True",
                "type": "Available"
            },
            {
                "lastTransitionTime": "2025-10-01T08:35:15Z",
                "lastUpdateTime": "2025-10-01T08:35:20Z",
                "message": "ReplicaSet \"deploy1-5f589444b9\" has successfully progressed.",
                "reason": "NewReplicaSetAvailable",
                "status": "True",
                "type": "Progressing"
            }
        ],
        "observedGeneration": 1,
        "readyReplicas": 1,
        "replicas": 1,
        "updatedReplicas": 1
    }
}
controlplane ~ ➜  k get deployments.apps -n admin2406 -o custom-columns=\
DEPLOYMENT:.metadata.name,\
CONTAINER_IMAGE:.spec.template.spec.containers[].image,\
READY_REPLICAS:.status.readyReplicas,\
NAMESPACE:.metadata.namespace\
 --sort-by=.metadata.name > /opt/admin2406_data

문제 3.

A kubeconfig file called admin.kubeconfig has been created in /root/CKA. There is something wrong with the configuration. Troubleshoot and fix it.

 

controlplane ~ ➜  k get po --kubeconfig=/root/CKA/admin.kubeconfig
E1001 08:06:25.810970   32361 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://controlplane:4380/api?timeout=32s\": dial tcp 192.168.100.159:4380: connect: connection refused"
E1001 08:06:25.812519   32361 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://controlplane:4380/api?timeout=32s\": dial tcp 192.168.100.159:4380: connect: connection refused"
E1001 08:06:25.814062   32361 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://controlplane:4380/api?timeout=32s\": dial tcp 192.168.100.159:4380: connect: connection refused"
E1001 08:06:25.815620   32361 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://controlplane:4380/api?timeout=32s\": dial tcp 192.168.100.159:4380: connect: connection refused"
E1001 08:06:25.817072   32361 memcache.go:265] "Unhandled Error" err="couldn't get current server API group list: Get \"https://controlplane:4380/api?timeout=32s\": dial tcp 192.168.100.159:4380: connect: connection refused"
The connection to the server controlplane:4380 was refused - did you specify the right host or port?
controlplane ~ ➜  vi /root/CKA/admin.kubeconfig 

-------

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS3MHpOVEE1TWprd056TXlNek5hTUJVeApFekFSQmdO
    server: https://controlplane:4380   # 6443 으로 수정!!!
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
controlplane ~ ➜  k get po --kubeconfig=/root/CKA/admin.kubeconfig
NAME                          READY   STATUS    RESTARTS   AGE
gold-nginx-795575c6bc-xwds7   1/1     Running   0          3m57s

문제 4.

Create a new deployment called nginx-deploy, with image nginx:1.16 and 1 replica.
Next, upgrade the deployment to version 1.17 using rolling update and add the annotation message
Updated nginx image to 1.17.

 

controlplane ~ ➜  k create deployment nginx-deploy --image=nginx:1.16 --replicas=1
deployment.apps/nginx-deploy created

controlplane ~ ➜  k get deployments.apps nginx-deploy 
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
nginx-deploy   1/1     1            1           6s
controlplane ~ ➜  k set image deployments nginx-deploy nginx=nginx:1.17
deployment.apps/nginx-deploy image updated
controlplane ~ ➜  k get po nginx-deploy-6c879966f8-vm2k5  -o yaml | grep image
  - image: nginx:1.17
    imagePullPolicy: IfNotPresent
    image: docker.io/library/nginx:1.17
    imageID: docker.io/library/nginx@sha256:6fff55753e3b34e36e24e37039ee9eae1fe38a6420d8ae16ef37c92d1eb26699

문제 5.

A new deployment called alpha-mysql has been deployed in the alpha namespace. However, the pods are not running. Troubleshoot and fix the issue. The deployment should make use of the persistent volume alpha-pv to be mounted at /var/lib/mysql and should use the environment variable MYSQL_ALLOW_EMPTY_PASSWORD=1 to make use of an empty root password.

Important: Do not alter the persistent volume.

 

controlplane ~ ➜  k describe deployments.apps -n alpha alpha-mysql 
Name:                   alpha-mysql
Namespace:              alpha

# ...
ClaimName:     mysql-alpha-pvc    

Events:
  Type    Reason             Age    From                   Message
  ----    ------             ----   ----                   -------
  Normal  ScalingReplicaSet  8m40s  deployment-controller  Scaled up replica set alpha-mysql-85765c4c56 from 0 to 1
controlplane ~ ➜  k get pv -n alpha 
NAME       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS      CLAIM   STORAGECLASS   VOLUMEATTRIBUTESCLASS   REASON   AGE
alpha-pv   1Gi        RWO            Retain           Available           slow           <unset>                          10m

controlplane ~ ➜  k get pvc -n alpha 
NAME          STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
alpha-claim   Pending                                      slow-storage   <unset>                 10m
controlplane ~ ➜  k get pv -n alpha alpha-pv -o yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"PersistentVolume","metadata":{"annotations":{},"name":"alpha-pv"},"spec":{"accessModes":["ReadWriteOnce"],"capacity":{"storage":"1Gi"},"hostPath":{"path":"/opt/pv-1"},"storageClassName":"slow"}}
  creationTimestamp: "2025-10-01T08:03:52Z"
  finalizers:
  - kubernetes.io/pv-protection
  name: alpha-pv
  resourceVersion: "3214"
  uid: c5ef4f9d-27a4-4fd8-a726-5f9f5d046d94
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 1Gi
  hostPath:
    path: /opt/pv-1
    type: ""
  persistentVolumeReclaimPolicy: Retain
  storageClassName: slow        # 이름 확인 !!!
  volumeMode: Filesystem
status:
  lastPhaseTransitionTime: "2025-10-01T08:03:52Z"
  phase: Available
controlplane ~ ➜  vi a.yaml

--------

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-alpha-pvc
  namespace: alpha
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
  storageClassName: slow
controlplane ~ ➜  k get po -n alpha 
NAME                           READY   STATUS    RESTARTS   AGE
alpha-mysql-85765c4c56-49lsm   1/1     Running   0          26m

문제 6.

Take the backup of ETCD at the location /opt/etcd-backup.db on the controlplane node.


https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#volume-snapshot

controlplane ~ ➜  ls /etc/kubernetes/pki/
apiserver.crt              apiserver.key                 ca.crt  front-proxy-ca.crt      front-proxy-client.key
apiserver-etcd-client.crt  apiserver-kubelet-client.crt  ca.key  front-proxy-ca.key      sa.key
apiserver-etcd-client.key  apiserver-kubelet-client.key  etcd    front-proxy-client.crt  sa.pub
controlplane ~ ➜  ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/etcd-backup.db
Snapshot saved at /opt/etcd-backup.db
controlplane ~ ➜  ls /opt/
cni  containerd  etcd-backup.db  kubeadm-config.yaml

문제 7.

Create a pod called secret-1401 in the admin1401 namespace using the busybox image. The container within the pod should be called secret-admin and should sleep for 4800 seconds.

The container should mount a read-only secret volume called secret-volume at the path /etc/secret-volume. The secret being mounted has already been created for you and is called dotfile-secret.

 

apiVersion: v1
kind: Pod
metadata:
  name: secret-1401
  namespace: admin1401
  labels:
    run: secret-1401
spec:
  containers:
  - name: secret-admin
    image: busybox
    command:
    - sleep
    args:
    - "4800"
    volumeMounts:
    - name: secret-volume
      mountPath: "/etc/secret-volume"
      readOnly: true
  volumes:
  - name: secret-volume
    secret:
      secretName: dotfile-secret
controlplane ~ ➜  k create -f b.yaml 
pod/secret-1401 created

controlplane ~ ➜  

controlplane ~ ➜  k get po
NAME                          READY   STATUS    RESTARTS   AGE
gold-nginx-795575c6bc-bpg95   1/1     Running   0          15m