Hello everyone and welcome to the cabinet is seek a mock exam 3 solution section.
My name is and policy and this section they will attempt to solve the questions together.
Ok to start off let's click on the example.
And this is the mock exam 3 and this consists of nine quests and total and just like the previous mock
exam.
This is created out of hundred percentage of each year to secure a 74 percent to pass as more kicks
in.
OK so let's start off at the question number one and the first one is create a new service account with
the name TV viewer Grant granted service account access to a list all business and volumes and they
cluster by creating an appropriate cluster all called Peavey view world and cluster all binding called
BBVA were role binding.
Next create a board called Peavey viewer with the image for this answer.
There's a county viewer and the default namespace so global three to four times that we need to do the
first task that has to be accomplished is to create a service account by the name of TV viewer and let's
go to the component as documentation just to see how.
So a second can be configured for a port so if you go to call when it does dock starts configure part
container configure a service icon you'll see a pod description where you can create a service account
name.
So basically in this case we are creating a custom service account and we're using that service account
name to be used when a port has created by default default service account is created for every namespace
but in this case we are creating a custom one.
OK so let's create the PIF if you were a service icon first.
So for those we can use the imperative way quickly I just run 20 and one main first.
So this is a large cluster.
It has four loads in total one monster and three will cannot.
So that's the first task out of the way.
So it does create three for service a second called if you were.
And since I'm not specifying a namespace it'll create it and the default namespace.
The second task is to grab the service account access to list all process and while loops.
So we have to create a cluster rule and the name of it has to be perfectly where all and we have to
create a classroom binding adapting that rules to the service account and that's to be called as a preview
were rule binding.
So let's do that now and we can make use of the imperative we can to create the necessary class or
just copy the name on the question.
There are no typos there.
And the resource in this case as well as processing volumes
and a verb is list then that's highlighted here.
So the container level is created.
And next let's create a classroom binding
again then copy the name from the question
plus serial as the one that we created in the previous step we'll call it from here
and in this case it has to be the service account and sort of a user.
Now there's a trick to this.
We have to specify the namespace as well.
So if I just give you the viewer it'll complain of an error saying that there was a con must be in the
format syntax namespace followed by the name.
So I should add default here and now it should have been created.
There you go.
The next task is to create a path which can make use of the service account and it's the last bit of
this question again to next year.
Create a board called PD viewer with the image.
It is answer the a Concord video.
OK so what does not create a template first.
So now that the the template has been created I'll updated to make use of the service account.
Now let's go back to the quote when it is documentation and as you can see here the the parameter that
we have to add is so I can't so there's a code name
just get rid of these additional parameters which is not needed in this case
and this case you don't have to specify the namespace name and the service account name that will be
taken care by default.
When you create the board depending upon the needs is that it's deployed.
Now let's create the.
The pot is created.
Let's just quickly check whether it's created according to the question.
That's a container.
And you should have a secret name.
And that is created with the name of the service account.
So that's one way to make sure that the question has been attempted correctly.
So whenever a port is created a default service account is associated with it and a token is created
with that specific cause.
So as I can't as a secret and that's the one which is monitored on a port.
So in this case we created the service that can best be viewed and hence you can see the name here reflect
NPV view.
So that's the first question out of the event.
Let's move on to the next one all right let's go to the next question now.
The second question is less the internal IP of all North of the cluster save that also to a file called
slash root slash mode underscore eyepiece answer should be in the format internal IP of master space
until IP of Node 1.
Space Internet IP of Node 2 and space finally IP off no treat all in a single line.
So this is a decent but specific question and this let's jump to the Covenant as documentation and see
a reference example so if you go to the cube CTO cheat sheet page here you'll see a lot of examples
for decent part which is quite handy.
And let's go to the specific one here.
Good.
Excellent I off on those.
So here we are running cube CTO get nodes hyphen adjacent park.
And here for all items status address and for the type x IP let's solve the emphasis.
So in this case specific question we do not have an external IP we have an internal IP so we can replace
this whole X exercise.
But just replacing the excellent IP with internal IP and that should give us the required result.
So let's call Pete.
Before we save it we'll just run it as it is.
And they should return up empty.
So as I said we do not have an excellent IP for this cluster.
So that's straight place that that internal IP is again.
It gives you the safe space separated into IP for all the not so 172 dots empty nodes in a lot sixteen
once 172 or some kind of nineteen twenty four and 28.
So we can redirect the output to that specific file.
Another way to check is because we do not we just have an internal IP.
You can replace me you can remove the entire contents of this switch here
and that should return you the same thing.
Because in this case we only have internal IP should not have any other type of IP so as part of this
arena in the address here.
So even without a specific type that we're searching for internal IP our excellent IP it would select
a new decree Benson let's quickly identify that the answer has been recorded.
So that should be it.
We can mount this question complete and more onto the next question okay.
So let's move on to the third question.
This is an easy one.
This is to create a port called multiple with two containers container one name is Alfa with Image Engine
X container to name as beta but the image Busy Box and it should run a sleep come on for forty eight
hundred seconds and each of the container have environment variables that we need to define for the
port.
Okay so let's go to Daytona.
The easiest way to do this is to make sure that we have a template file first so let's create that
you know that the first container name is alpha and they meet us in the next
directors to profile call us multiple not Emma
that strong edit said things that's needed the name of the container and such should be multiple
not meeting people.
Here are some tremendous
images.
Correct name is also correct.
Turn on the lights here.
This has an environment variable that we need to define the name and it was I was wrong for the name
as name
no.
That's the first container done.
Let's create the second one.
For distance.
Xbox
and beta.
This should be alarming.
Oh come on.
12 seconds can be a little hard to define the word devils.
This one.
And when meant to be defined by his name as name and value as beta.
We double check the books all right.
The name is multiple.
Not needing the labels.
It's not.
That's one of the questions I read more than the container one is.
I'll they may they may change in Exeter in and enlightenment here.
The media will this that's a key value pair with the name.
Which incidentally is also name the value for that as alpha and similarly for container to the name
is beta.
Using the image Xbox running will come on stream for the 800 and the environment similar to the previous
one name as name value as returned to skips.
Let's create this point
from QCT or describe
make sure that two containers have been created and are running since it's two container creating statements
looks again.
So container beta is running.
It's running these sleep.
Come on here.
It has called the environment definition underneath need that some lowly Alpha container is also running
it has got the environment disturbed here.
So that looks good.
Just making sure that the name is right and everything is not running straight.
OK.
So that's the and of.
Let's move onto the next one.
OK so the fourth question we had to create a port called land with inmates this fine said DCP limited
to sleep and memory limit to find it might be.
So this is a resource specific question that we are supposed to set limit.
OK so let's go back to the terminal.
And for those we can make use of one or two new templates that we used before.
So I'm just going to use that
in this copy template that we created for the very first question to a file called landlord Yama.
Again we don't need to use this specific case.
I'm just going to repeat the name Ryan
and you can make it is this fine.
I mean there was a done in this case or just get rid of that and let's jump to the call when it does
documentation to see how limits are configured so if you go to the dogs concepts and how portable resource
limits are we can see an example here where a resource section has been defined but both request and
limits in this case we don't have to specify the request field just ask for limits of interest that
so it's under the container definition here.
And again see you have to create resources and limits
so to seek you
memory should be standard
that should be internet screening at this point.
The has been created as obviously its funding capacity or describe on the board name to make sure it's
being created properly.
And it's an ironic center.
It is a running said the name that's lion the call as line as well.
And here are the resources so limits set to musical to 2 and memories equal to 400.
And my SO THAT'S THIS QUESTION Although David we can move onto the next question.
All right so let's get started with this question number five.
We have deployed a new port called NDP heaven test hyphen one and a service called NDP heaven test hyphen
service income and connections to the service as are not working troubleshoot and fix it create network
policy by the name in grace to end protests that allows incoming connections to the service or port
80 but do not delete any current objects which are deployed.
So this is a network policy related question.
So it looks like a board has already been created which is exposed using a service and looks like the
connections that's the ingress connections to this.
So this is not work.
So let's take that first.
Okay.
So let's take the port.
It's the first
and that is.
So that's created here called us and p test one
and that has a label called us from and B test one and which images a trauma.
So it's funding engine X and that's about it.
Let's check the service.
There has also been created by the name of Peter service
and as you can see that one is actually routing the connection to the port.
But the label run as equal to protest one.
That's the port and we just checked out the dominant part.
And that has one end point which is upon itself and it's running on the container port 80.
Now let's test the connectivity for incoming connections incoming traffic into that particular port
using the service.
So for those we can use a busy box container and test the connectivity using net cat or to let let's
create that port first
let's call it as test and be neutral policy not an image of port Xerox 1 2 8
1 the container to be removed once we're on the tech
that's on our shell station interdependent
so we'll run on net cat command and see if instead we have an W2 for two iterations and we know the
name of these services and p test service and no chance on port 80.
So as you can see here the connection has timed out.
So it looks like the ingress traffic is not working from within the same namespace.
So let's see why that is.
So if we're on QCT I'll get it Paul.
But just a short run import network policy we shouldn't be seeing a default tonight here.
So let's find a quick look up on this network policy and see what it does.
So this is running on the default namespace the name as default denying the port selector as not allowing
the specific traffic to all ports in the same space.
And so it is affecting all ports within the default namespace.
And if you see here a living English traffic monitor it does not allowing any egress traffic so all
ports are isolated for ingress and egress in this case.
But the policy time that is specified is in.
So all incoming connections are blocked.
So in order to fix this and make sure that the NDP service is accessible from for example a the Xbox
port which is also created in the same default namespace we'll have to create another namespace and
permit that particular connection specifically.
So let's do that now.
So let's say the component is documentation first and check what it's got to offer.
So if you go to Google and those are your dog's concepts and network policies here you'll see a lot
of examples for network policy resources as well.
So in this specific case there is a network policy created called test type for network policy and that
is applied to a specific part which is exactly what we need to do here.
We want to make sure that the port call this NDP 77 1 which is x plus where the service is actually
accessible for any ingress traffic.
So we have to apply a port selector here and we have to make sure that the correct labels are contracted
so that it targets the correct port.
And in our case the policy tab should be angry so we will not use egress as shown here.
And for Inglis we'll have to make sure that these connections from all the ports are open and all these
sources are available and it hits a specific port on that specific port.
And we know that it runs on port 80 because it's running an 18 x based image.
So we will configure the port as port 80 the remaining things are not applicable here because we don't
have an air space or an IP block specific race that we want to restrict or allow.
So in our case we would only be using a port selector and this will also be a blank statement because
we wanted to work for all ports.
So we will remove all of these and just specify the ports field here and once that's done we'll test
again to make sure that the connectivity is working Turkey so to begin with.
Let me call free some of the lines from network policy file and then we can create one of our own.
I'm going to call those files and BDO tantalum.
Then again let's make use of Cuba's Excel API versions
and if it check for network that's the current EPA version so it should be networking not case or I'll
which is what is being defined Kanazawa
just make sure the name is created.
As for the question just copied from there.
So the name as it to end pre-test
and on the prospect field may help Port selector
and if you remember correctly labeling for that port is run with the value and p test.
So you can take it from here.
So the port selector definition is complete.
Now we have to specify the policy types
in this case we aren't just going to make use of race
and following that will define the ingress specification.
As I mentioned before we have to make sure that the incoming traffic works from all parts but then the
default namespace so we are not going to specify any of these here.
No from field because it should be from all.
So we will not specify any of these.
The only thing that we have to specify is the port.
We can copy it from here
so that looks all right.
It's applied to the correct port in Greece policy alone and we have specified the port.
Let's create this little policy
that has been created.
Now let's do the same exercises before I'm going to run this temporary port call this test NDP again
and execute into the shell.
Surround the net get against it and see her family.
I definitely got you to copy these so this name from your port should be 80
they now it's accessible it's open.
So that means that the NATO policy that we configured is working properly.
And we didn't have to delete or modify any of the existing objects
which was one of the prerequisites.
So important don't alter any existing objects network policy applied to all sources incoming traffic
from all parts into a policy is using the code because you have specified port 80 and as applied to
the code part because your secret label with the name and b I test F and 1 attack shouldn't be the answer
for this specific question.
Let's move on to the next one.
So let's move on to the next question.
This is question number six.
Dante look a node nodes are one to be unsure.
Do little one stand.
Create a board called Dave from Reuters.
But the image for this Alpine torrential workloads are not scheduled.
This will not finally create a new port called product from readers with the same image but the toleration
to be sure do it on nodes or one.
And here are the specs so the key is in the underscore type value as production and the operators no
should do and we just have to make sure that the nodes no one was tainted and then create a board called
evidence without any toleration and another board called PRISM reduced which has a toleration.
So it should be it can be should do alone with sort of one.
So let's go back to the terminal.
So the first thing to be done as a team though.
CONAN So let's check the environment again so it can still get nodes.
There are three local nodes all of which we have to taint this node sort of 1.
So let's do that right now.
CTO attained Node Node 2 to 1.
And let's take the specification from the question of the Q A LOOP as in we type
zip code to.
And the effect is not should you just copy from your
SO node sort of understated Conan CUPE CTO describe Lord Seattle one group or 13 and you should see
that here.
So Ian Reed type production and the effect is mostly due to that first part of the question which is
completed.
So for the second part of the question we have to create a board called Dave five hundred US and what
the specific can which And we'll see if it's able to start on nodes or what
again
that's a little bit
different this is created.
That's fine.
Kim your kid What's that.
All right.
And there it is as you can see it's running on Node so 3.
So because this does not have a toleration it should not be scheduled on Node 1 at any point of time.
And that's what we will try to do next.
So we'll create a toleration for deprived of much close contest products and readers.
And I told her she should allow it to we should do it on loans that one doesn't mean that it has to
necessarily go there.
So the scheduler might decide to put it elsewhere but it should have the ability to be scheduled on
nodes or what.
So let's create the product from respond next.
So back to the term kid people that we just created called us to override us and redirect that to fraud
hide from predators
that say that this fun
the name should be proud.
I'll remove these sections here which are not needed nonsensically did an expert.
You can see that there is a toleration field here.
Which you can make yourself
so in our case the effect is no schedule.
The key
is let's go back to the press and the key should be in Windows good time.
In one one type
the operator should be equal
make a television seconds we need people and in our case though.
Well we should in production
so let's confirm that everything is contracted correctly.
The name should be brought out from Reuters.
And they may just decide upon and the toleration is for key in municipal type of value as protection
operator as equal and effective is no sugar.
So let's create this partner
it's created
let's run this again.
And in this case the profit is created on NATO too.
So as I said it does not necessarily mean that the old will only be scheduled on NATO one.
It means that it can be scheduled on roads on notes or one because it has got a toleration.
So in any case the scheduler has decided to put this on another note.
But that's OK.
So let's move on to the next question because this one is complete.
OK so this is question number seven and we have to create a port called a chart from Port in the a child
namespace belonging to production environment and front end tier.
So these are labels a made should be read as outlined the use of appropriate labels and create all the
required objects if it's not existing in the system already.
So each our port label red wine production a type of label that from time to.
OK so let's go back to the terminal.
So first thing to check as if there is a namespace called as a char.
So as you can see it does not exist.
So let's create one.
Now it has been created.
Next step is to create a board to clear the screen
me is nature infant born the image is this Alpine contest copied from the question.
You've got two labels to be created and one minute as production
these can be done little commerce oppression and the second one.
But here is equal to front end
and I mess to specify the namespace here so let's leave that part from the default namespace
and recreate it.
Read the current namespace
let's run the cubes until half men.
The namespace H.R. get positive over the labels say to our partners running and we have the correct
label set.
That's an easy question.
When everything has been completed the pot has been labeled with two labels one as environment as equal
to protection.
The other one just here is the front end.
We created the namespace first and then it's using decode made.
So this one does complete.
Let's move on to the next one.
OK so this is the question number eight.
And for this one a cube config file called super dark Q config has been created in Slash.
There is something wrong with the configuration troubleshoot and fix it.
So let's go back to the domino here.
So by default we have a cube config file which is created under the hidden directory called as Dot cube
slash conflict and that's what all our commands use.
So when I run cube CTO get nodes it's basically using the conflict file which is created under the dot
cube that actually
so if I just had this particular file you'll see that the user for this configuration circle in it is
an admin and the cluster which is created as called as coordinator.
So the context name that we're using is when it is hyphen and when article when it is.
And if you scroll up you'll see the details of the cluster.
So for the cluster the server name which is the cube API server is this particular you are L which is
a CTP is the IP address of the master node followed by the cube API.
So we'll put that Atlas on still which is 6 4 4 3 and you know that as DC cert as well.
Now let's go back to the question and it seems that a super dot cube config has been created on this
lateral.
So let's go to a special
and here's the cube config so let's try to run a command using that specific cube conflict crop so cluster
in four different I think kill conflict so that we can override the default cube configuration file
and specify this one.
So as you can see here there is an error that says the connection to the server was refused to do specify
the right host of Court so straightaway you can see that the target's using seems to be incorrect.
Suppose 2 3 7 9 which incidentally is the one which is used by the city but not the cube may a server.
So we have to correct that.
Let's go to the filed
and this is using the same context that Colgan does underscore hyphenate men are commentators as the
context where they use it as coordinator safe and adamant and the cluster as clarinetist.
So here you can correct the board.
Let's change it back to six foot four three.
Remember that four cube config we don't have to apply any changes or create a use create or apply.
But this is a static file and doesn't have to be created.
So the contains within this thread by cube CTA and there's no other action that's needed in this case.
So let's try to run that command again and this time it's able to return all the correct values.
So the problem with that file was incorrect code and we'll fix that.
Anything else to be done.
No it's just fixing the cube config file.
So it's a very simple question.
Let's move on to the next one.
So we have raised the final question after the smoke exam and then we should be done with this so let's
finish this.
We have created a new deployment called into next life and deploy scale the deployment to three replicas
as the replicas increase troubleshoot the issue and fix it.
So the deployment has three replicas that's the end goal.
Let's go back to the terminal and check this deployment.
So we have a deployment called into next deployed
let's try again.
It's updated as about.
So let's try to scale this
so that has been successfully completed.
Let's run the command again
so desired is equal to three and current as one up to date as one available as equal to zero.
So there does definitely seems to be something wrong with this deployment.
Let's try and describe
to describe also say the same thing all the replicas the number of replicas designed as 3 1 updated
1 2 2 0 the
scroll down scale replicas set to enter next deploy and has a poor name and that's just wonder people
said at this point of time.
Let's try to see the pods
as you can see that's the single that's clear all of this deployment and the replica set.
And we do not have two additional ones which were created based on the scale the one that we use.
So now the next logical thing to reject is the control plane component which was on the cube system
namespace
and if you see the status of the control pin incompetence you can see that there was an error for the
controller manager part and immutable Volkoff.
So let's try to investigate the root cause for this failure.
So we know that the control plane competence in this case have been created as a static board.
The easiest way to figure that out is that it's appended by hyphen node name.
In the end of the report and in this case it this is running on the muzzle node.
You can see that cube APL server cube control of manager Coop scheduler and these are all static ports
because they have hyphen master at the end which is the name of our master server.
So let's go to the default static board.
But it is it is equal when it does manifest.
And let's check the contents of this file
that if you look closely and see that the word control nervousness misspelled and sort of seal or anti
r or l there was a one here and that seems to be replicated everywhere.
So the name is controller but then the one and sort of l the command that uses or is also of the same
mistake then and the name and the place
or the image
is the image name is also incorrect.
So let's correct all the places on this file where we have a typo and corrected but by replacing the
one with an N.
So there are two ways you can do that either replace all the mistakes which are there in the file by
editing edit text editor such as we eye or we can use it as said.
So just to make it easier I'm going to use the set.
Come on it's not necessary to run this but makes things a little easier and quicker.
So said I find I substitute
I'm just going to copy this and change it we know that the mistake was the one insert often Al so that
it may just non-farm which is why when we check the status of the control plane compliments I complained
of unable to pull that specific image so I'm going to substitute all incorrect instances of this or
plus train
the file
before I do that.
Let me just quickly check
whether they can see this as strong in five different locations.
One nothing on No Name itself.
The command that it's running and the image which is to maintain because it's not able to pull that
specific image.
So let's run that said come.
As I said you can replace us individually on the file itself.
This just makes it a little quicker.
So that should be done.
Knowledge should be zero.
Let's check the status.
Again
so now looks like it's back running again.
So keep control the manager.
The name is correct and it's running.
Cancer consultant.
So that's good news.
Now let's check our deployment
now as you can see the number of available replicas has increased from one to three.
That's 60 pots
and you can see that about 17 seconds ago two new replicas were also created.
So the issue was with the control manager not running.
So the replica sets were not created because that's controlled by the control manager.
And as soon as we fixed it that's intelligent enough to know that it needs three total replica sets
replicas as it does add configuration.
And it went ahead and created two more.
So that brings us to the end of this exam.
Let's mark this exam is complete
and let the testing begin and hopefully we have attempted everything correctly.
And we should get our results pretty quick
so there you go all the questions have been created and it's OK we have done all the questions correctly
so we've got 100 percent score.
So thank you everyone for joining me on this section and I hope you enjoyed it by.