Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Update the Deployment YAMLI
- Update the 'replicas' to 3.
- Define 'maxiJnavailable: 1 ' and 'maxSurge: O' in the 'strategy-rollingupdate' section to control the rolling update process.
- Use a 'readiness probe' within your container definition to ensure that the pod is considered ready only when tne database is successfully started and connected.
- Configure a 'strategy-type' to 'RollingUpdate' to trigger a rolling update when the deployment is updated.

2. Create the Deployment: - Apply the updated YAML file using 'kubectl apply -f database-deployment-yamp 3. Verify the Deployment - Check the status of the deployment using 'kubectl get deployments database-deployment to confirm the rollout and updated replica count. 4. Trigger the Automatic Update: - Pusn a new image to the Docker Hub repository. 5. Monitor the Deployment - Use 'kubectl get pods -l to monitor the pod updates during the rolling update process. You will observe that only one pod is terminated at a time. The readiness probe will ensure that a new pod is only considered ready when it's successfully connected to the database. 6. Check for Successful Update: - Once the deployment is complete, use 'kubectl describe deployment database-deployment to see that the 'updatedReplicas' field matches the 'replicas' field, indicating a successful update.,

Correct Answer:

See the Explanation below for complete solution.
Explanation:
ssh ckad00034c
You're debugging an Ingress # Service # Deployment chain. The fastest way is:
* reproduce the error with the right Host header
* check Ingress rules (host/path/backend)
* check Service (selector/port/targetPort)
* check Endpoints (do we have ready pods?)
* fix the manifest(s) under /home/candidate/content-marlin/
* apply + re-test
Below are the exact commands + the most common fixes for this exact symptom.
1) Reproduce the failing request correctly
Even if DNS isn't set up, you can test with a Host header:
curl -i -H "Host: content-marlin.local"
http://127.0.0.1/content-marlin
If your ingress controller is not on localhost, find the NodePort/LoadBalancer IP. In these labs it's often localhost via a local proxy, but if needed:
kubectl get svc -A | egrep -i 'ingress|nginx'
kubectl get nodes -o wide
(But start with the localhost curl above.)
2) Inspect the provided manifests (this is what you must edit)
cd /home/candidate/content-marlin/
ls -l
sed -n '1,200p' *.yaml
Also view what's currently live in the cluster:
kubectl -n content-marlin get deploy,svc,ingress
kubectl -n content-marlin describe ingress content-marlin-ingress
kubectl -n content-marlin get ingress content-marlin-ingress -o yaml
What to look for in the Ingress:
* spec.rules.host should be content-marlin.local
* spec.rules.http.paths[].path should match /content-marlin
* Backend service name must be your service
* Backend service port must match the service port (name or number)
* pathType should be Prefix (usually safest)
3) Validate Service # Pod wiring (most common real cause)
3.1 Check service selector and ports
kubectl -n content-marlin get svc -o wide
kubectl -n content-marlin describe svc content-marlin-deployment 2>/dev/null || true kubectl -n content-marlin describe svc Identify the service that the Ingress points to (from describe ingress).
Check if the Service selector matches pod labels:
kubectl -n content-marlin get pods --show-labels
kubectl -n content-marlin get svc <SERVICE_NAME> -o jsonpath='{.spec.selector}{"\n"}'
3.2 Check endpoints (this tells you instantly if traffic can reach pods) kubectl -n content-marlin get endpoints kubectl -n content-marlin get endpoints <SERVICE_NAME> -o wide
* If ENDPOINTS is empty # Service selector doesn't match Pods OR Pods aren't Ready.
3.3 If endpoints empty, check pod readiness and labels
kubectl -n content-marlin get pods -o wide
kubectl -n content-marlin describe pod <pod-name>
4) Apply the most likely fix patterns
Fix pattern A: Ingress path needs rewrite
If your app serves / but you route /content-marlin, you often need rewrite.
Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:
* path: /content-marlin
* pathType: Prefix
* annotation: rewrite to / (common for nginx ingress)
Example (typical nginx-ingress):
metadata:
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: content-marlin.local
http:
paths:
- path: /content-marlin
pathType: Prefix
backend:
service:
name: <SERVICE_NAME>
port:
number: 80
If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it's very often nginx.
Fix pattern B: Ingress points to wrong Service port
If the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port), align them:
* Either change Ingress backend port.number
* Or change Service spec.ports[].port / targetPort
Fix pattern C: Service selector mismatch (endpoints empty)
If pods have label app=content-marlin but service selector is app=content-marlin-deployment (or vice versa), fix the Service selector to match pod labels.
Service should have:
spec:
selector:
app: <label-that-actually-exists-on-pods>
Fix pattern D: Service targetPort wrong
If container listens on 8080 but service targetPort is 80, fix it:
spec:
ports:
- port: 80
targetPort: 8080
5) Apply the corrected manifests
After editing the YAMLs under /home/candidate/content-marlin/:
kubectl apply -f /home/candidate/content-marlin/
Wait for readiness:
kubectl -n content-marlin rollout status deploy content-marlin-deployment kubectl -n content-marlin get endpoints kubectl -n content-marlin describe ingress content-marlin-ingress
6) Re-test the URL
curl -i -H "Host: content-marlin.local"
http://127.0.0.1/content-marlin
If you still get errors, also check ingress controller logs/events quickly:
kubectl -n content-marlin get events --sort-by=.lastTimestamp | tail -n 30 kubectl get pods -A | egrep -i 'ingress|nginx' The fastest way for you to finish in 1 shot Run these and paste the output (I'll tell you exactly which line to change and what to change it to):
kubectl -n content-marlin describe ingress content-marlin-ingress
kubectl -n content-marlin get svc -o wide
kubectl -n content-marlin get endpoints -o wide
kubectl -n content-marlin get pods --show-labels
sed -n '1,200p' /home/candidate/content-marlin/*.yaml
But even without pasting, if you follow steps 2-4 above, you'll find the broken link (Ingress rule, Service port, selector, or rewrite) and fix it cleanly.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Service Account:
- Create a service account YAML file named 'database-service-account.yamr with the following contents:

2. Create a Secret for the API Key: - Create a secret YAML file named 'database-api-key.yaml with the following contents:

3. Create a Role and Role8inding: - Create a Role YAML file named 'database-role.yaml with the following contents:

4. Create a ROIeBinding YAML: - Create a RoleBinding YAML file named 'database-rolebinding.yamr with the following contents:

5. Apply the YAML Files: - Apply the created YAML files using 'kubectl apply -f database-service-account.yamr , 'kubectl apply -f database-api-key.yamr, ' kubectl apply -f database-role.yamr , and 'kubectl apply -f database-rolebinding.yamr 6. Update your Deployment: - Update your application deployment to use the 'database-service-account and mount the secret containing the API key.

7. Access the External Database: - Your application container should now be able to access the external database using the API key provided in the secret.

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Enable Metrics in Your Microservice:
- Ensure your microservice exposes metrics through an HTTP endpoint using a library like Prometheus Client (for Java), Go metrics, or StatsD.
- Define metrics such as request count, latency, error rate, and other relevant performance indicators.
2. Deploy Prometheus:
- Deploy Prometheus using a 'Deployment and a 'Service'
- Configure Prometheus to scrape metrics trom the microservice by adding its endpoint to the 'scrape_configs' in the 'prometheus.yaml' file.

3. Create a Service for Prometheus to Access the Microservice: - Create a 'Service' of type 'ClusterlP' that exposes the microservice's metrics endpoint (usually port 9100). - Ensure Prometheus can reacn this service. 4. Deploy Grafana: - Deploy Gratana using a 'Deployment' and a 'Service' - Configure Grafana to connect to Prometheus as a data source. 5. Create Dashboards in Grafana: - Use Grafana's dashboard builder to create custom dashboards that visualize the metrics collected by Prometheus. - Add panels to display graphs, charts, and tables that show the performance and health ot your microservice. 6. Configure Alerts in Grafana: - Configure alerts in Grafana based on specific metrics and thresholds. - Set up notifications to alert you when critical issues arise with the microservice. Note: This approach provides comprehensive monitoring for your microservice. Prometheus scrapes metrics from the microservice, stores them in its time series database, and Grafana visualizes these metrics and provides alerts for potential issues. Example Prometheus Scrape Configuration:

Example Grafana Dashboard: - Create a dashboard with panels that show the following metrics: - Request count per minute - Average request latency - Error rate - CPU and memory usage of the microservice container - Set up alerts to notify you it: - The request count exceeds a certain threshold - The average latency exceeds a certain threshold - The error rate exceeds a certain threshold - The CPU or memory usage exceeds a certain threshold,

Correct Answer:

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create a Role: Define a Role that grants access to the 'my-app' Deployment pods.

2. Create a RoleBinding: Bind the created Role to the 'developers' group.

3. Apply the Role and RoleBinding: use 'kubectl apply' to create the Role and ROIeBinding resources. bash kubectl apply -f my-app-pod-readenyaml kubectl apply -f my-app-pod-reader-binding.yaml 4. Verify Access: Attempt to access the pods of the 'my-app' Deployment from a user in the "developers' group. You should be able to access the pods. Attempt to access the pods from a user not in the 'developers' group. You should receive an error indicating insufficient permissions.,