Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a P0dSecurityP01icy:
- Create a PodSecurityPolicy YAML configuration file:

2. Apply the PodSecurityPolicy: - Apply the PodSecurityPolicy configuration to your Kubernetes cluster: basn kubectl apply -f restricted-pod-policy-yaml 3. Bind the Policy to ServiceAccount: - Create a RoleBinding or ClusterRoleBinding to bind the PodSecurityPolicy to a specific ServiceAccount or all users. - For example, to bind it to a ServiceAccount:

4. Test tne Policy: - Create a pod using the ServiceAccount that has the PodSecurityPolicy applied. - Verify that tne pod cannot access host resources or use unauthorized capabilities.

Correct Answer:

See the Explanation below for complete solution.
Explanation:
ssh ckad00018
You cannot create/modify/delete any NetworkPolicy.
So the only way to make the existing policies "take effect" is to ensure the right Pods have the labels
/selectors those policies expect.
The task: in namespace charming-macaw, configure things so the target Pod can send + receive traffic ONLY to/from Pods front and db.
1) Inspect what NetworkPolicies already exist (don't change them)
kubectl -n charming-macaw get netpol
kubectl -n charming-macaw get netpol -o wide
Dump them to see the selectors they use:
kubectl -n charming-macaw get netpol -o yaml
You are looking for policies that:
* select the restricted pod via spec.podSelector
* and allow ingress/egress only with selectors that match front and db
* often there's also a "default deny" policy.
2) Identify the Pods and their current labels
kubectl -n charming-macaw get pods -o wide
kubectl -n charming-macaw get pods --show-labels
Specifically inspect labels for front and db:
kubectl -n charming-macaw get pod front --show-labels
kubectl -n charming-macaw get pod db --show-labels
(If they're Deployments instead of single Pods, do:)
kubectl -n charming-macaw get deploy --show-labels
kubectl -n charming-macaw get pods -l app=front --show-labels
kubectl -n charming-macaw get pods -l app=db --show-labels
3) Figure out which pod is "the Pod" to restrict
Usually there's a third pod (e.g., backend, api, app) besides front and db.
List pods again and identify the "other" one:
kubectl -n charming-macaw get pods
Let's assume the pod to restrict is called app (replace as needed):
TARGET=<pod-to-restrict>
4) Match the existing NetworkPolicy selectors by labeling pods (allowed) Because you can't edit NetworkPolicies, you must make labels on Pods (or their controllers) match the policies' selectors.
4.1 Determine the label required on the TARGET pod
From the YAML, find the policy that selects the restricted pod, e.g.:
spec:
podSelector:
matchLabels:
role: restricted
Extract podSelector from each policy quickly:
kubectl -n charming-macaw get netpol -o jsonpath='{range .items[*]}{.metadata.name}{" => "}{.spec.
podSelector}{"\n"}{end}'
Pick the selector that is meant for the restricted pod, then apply it to the TARGET pod (example:
role=restricted):
kubectl -n charming-macaw label pod $TARGET role=restricted --overwrite Best practice (if the pod is managed by a Deployment): label the Deployment template instead, so it persists.
Find the owner:
kubectl -n charming-macaw get pod $TARGET -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.
metadata.ownerReferences[0].name}{"\n"}'
If it's a ReplicaSet, find its Deployment:
RS=$(kubectl -n charming-macaw get pod $TARGET -o jsonpath='{.metadata.ownerReferences[0].name}') kubectl -n charming-macaw get rs $RS -o jsonpath='{.metadata.ownerReferences[0].kind}{" "}{.metadata.
ownerReferences[0].name}{"\n"}'
Then label the Deployment (example):
kubectl -n charming-macaw label deploy <DEPLOYMENT_NAME> role=restricted --overwrite
4.2 Ensure front and db match what the allow-rules reference
Look inside the allow policy ingress.from / egress.to. You might see something like:
from:
- podSelector:
matchLabels:
name: front
- podSelector:
matchLabels:
name: db
So you must ensure:
* front pod has name=front
* db pod has name=db
Apply labels (examples-use what the policy expects):
kubectl -n charming-macaw label pod front name=front --overwrite
kubectl -n charming-macaw label pod db name=db --overwrite
Again, if they're Deployments, label the Deployment instead:
kubectl -n charming-macaw label deploy front name=front --overwrite
kubectl -n charming-macaw label deploy db name=db --overwrite
5) Verify the NetworkPolicies now "select" the right pods
Check which labels each pod has now:
kubectl -n charming-macaw get pods --show-labels
Confirm the restricted pod matches the NetPol podSelector:
kubectl -n charming-macaw get netpol <POLICY_NAME> -o jsonpath='{.spec.podSelector}{"\n"}' kubectl -n charming-macaw get pod $TARGET --show-labels
6) Functional verification (quick network tests)
Exec into the restricted pod and try to reach:
* front # allowed
* db # allowed
* anything else # blocked
If busybox has wget:
kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget
-qO- http://front 2
>/dev/null || true'
kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget
-qO- http://db 2
>/dev/null || true'
Test something that should be blocked (example: kubernetes service DNS name):
kubectl -n charming-macaw exec -it $TARGET -- sh -c 'wget -qO- https://kubernetes.default.svc 2>/dev/null
|| echo "blocked"'
Also test inbound (from front to target, and from db to target) if the target listens on a port; otherwise inbound testing may be limited.
What you're doing conceptually
* Existing NetPols are already correct.
* Your job is to make pod labels match the NetPol selectors so:
* default deny applies to the target
* allow rules apply only between target # front and target # db

Correct Answer:

See the solution below.
Explanation:
Solution:
To have Kubernetes automatically restart a pod when an endpoint returns an HTTP 500 on the /healthz endpoint, you will need to configure liveness and readiness probes on the pod.
First, you will need to create a livenessProbe and a readinessProbe in the pod's definition yaml file. The livenessProbe will check the /healthz endpoint, and if it returns an HTTP 500, the pod will be restarted. The readinessProbe will check the /started endpoint, and if it returns an HTTP 500, the pod will not receive traffic.
Here's an example of how you can configure the liveness and readiness probes in the pod definition yaml file:
apiVersion: v1
kind: Pod
metadata:
name: probe-pod
spec:
containers:
- name: probe-pod
image: <image-name>
ports:
- containerPort: 8080
livenessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 15
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /started
port: 8080
initialDelaySeconds: 15
periodSeconds: 10
failureThreshold: 3
The httpGet specifies the endpoint to check and the port to use. The initialDelaySeconds is the amount of time the pod will wait before starting the probe. periodSeconds is the amount of time between each probe check, and the failureThreshold is the number of failed probes before the pod is considered unresponsive.
You can use kubectl to create the pod by running the following command:
kubectl apply -f <filename>.yaml
Once the pod is created, Kubernetes will start monitoring it using the configured liveness and readiness probes. If the /healthz endpoint returns an HTTP 500, the pod will be restarted. If the /started endpoint returns an HTTP 500, the pod will not receive traffic.
Please note that if the failure threshold is set to 3, it means that if the probe fails 3 times consecutively it will be considered as a failure.
The above configuration assumes that the application is running on port 8080 and the endpoints are available on the same port.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Update the Deployment YAMLI
- Update the 'replicas' to 3.
- Define 'maxiJnavailable: 1 ' and 'maxSurge: O' in the 'strategy-rollingupdate' section to control the rolling update process.
- Use a 'readiness probe' within your container definition to ensure that the pod is considered ready only when tne database is successfully started and connected.
- Configure a 'strategy-type' to 'RollingUpdate' to trigger a rolling update when the deployment is updated.

2. Create the Deployment: - Apply the updated YAML file using 'kubectl apply -f database-deployment-yamp 3. Verify the Deployment - Check the status of the deployment using 'kubectl get deployments database-deployment to confirm the rollout and updated replica count. 4. Trigger the Automatic Update: - Pusn a new image to the Docker Hub repository. 5. Monitor the Deployment - Use 'kubectl get pods -l to monitor the pod updates during the rolling update process. You will observe that only one pod is terminated at a time. The readiness probe will ensure that a new pod is only considered ready when it's successfully connected to the database. 6. Check for Successful Update: - Once the deployment is complete, use 'kubectl describe deployment database-deployment to see that the 'updatedReplicas' field matches the 'replicas' field, indicating a successful update.,

Correct Answer:

Below is an exam-style, step-by-step solution (commands + verification). Follow exactly on host ckad000.
0) Connect to the right host
ssh ckad000
(Optional but good sanity check)
kubectl config current-context
kubectl get ns
1) Inspect the existing Deployment (to know its labels/ports)
kubectl -n prod get deploy nginx-deployment
kubectl -n prod get deploy nginx-deployment -o wide
Check what labels the Pod template already has (important for the Service selector):
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}' Check container ports (so we expose the correct targetPort):
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.spec.containers[0].ports}{"\n"}' If ports output is empty, it's still often nginx on 80, but the safest is to confirm by describing a pod later.
2) Update Deployment to 2 replicas
Fastest:
kubectl -n prod scale deploy nginx-deployment --replicas=2
Verify:
kubectl -n prod get deploy nginx-deployment
3) Add label role=webFrontEnd to the Pod (Pod template label)
You must add it under:
spec.template.metadata.labels
Use a patch (quick + safe):
kubectl -n prod patch deploy nginx-deployment \
-p '{"spec":{"template":{"metadata":{"labels":{"role":"webFrontEnd"}}}}}' Verify the Deployment template now includes it:
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.metadata.labels}{"\n"}' Now verify the running Pods have the label (important!):
kubectl -n prod get pods --show-labels
If the label doesn't show on pods immediately, wait for rollout:
kubectl -n prod rollout status deploy nginx-deployment
kubectl -n prod get pods --show-labels
4) Create a NodePort Service rover exposing the Deployment's Pods
4.1 Get a reliable target port
Try to read containerPort:
kubectl -n prod get deploy nginx-deployment -o jsonpath='{.spec.template.spec.containers[0].ports[0].
containerPort}{"\n"}'
* If this prints a number (commonly 80), use it as --target-port.
* If it prints nothing/empty, check a pod:
POD=$(kubectl -n prod get pod -l role=webFrontEnd -o jsonpath='{.items[0].metadata.name}') kubectl -n prod describe pod "$POD" | sed -n '/Containers:/,/Conditions:/p' | sed -n '/Ports:/,/Environment:/p' Assuming nginx is on 80 (most common), create the service:
kubectl -n prod expose deploy nginx-deployment \
--name=rover \
--type=NodePort \
--port=80 \
--target-port=80
If your nginx container port is different (e.g., 8080), change --target-port=8080 accordingly.
5) Verify Service + endpoints (critical)
kubectl -n prod get svc rover -o wide
kubectl -n prod describe svc rover
kubectl -n prod get endpoints rover -o wide
You should see 2 endpoints (matching 2 pods).
Also confirm the pods are Ready:
kubectl -n prod get pods -l role=webFrontEnd -o wide
Quick "CKAD checkpoints"
* Deployment in prod has replicas=2
* Pod template has label role=webFrontEnd
* Service rover in prod is NodePort
* Service endpoints point to the nginx pods