CKAD Services and Networking 2 — Questions and Answers
Question 1: What is an Ingress resource used for in Kubernetes?
- Controlling pod-to-pod traffic
- Exposing HTTP/HTTPS routes from outside the cluster to services within it (Correct answer)
- Creating internal ClusterIP services
- Configuring node firewall rules
Correct answer: Exposing HTTP/HTTPS routes from outside the cluster to services within it
An Ingress manages external HTTP/HTTPS access to cluster services, supporting path-based and host-based routing with TLS termination.
Question 2: Which component is required in the cluster for an Ingress resource to function?
- kube-proxy
- Ingress Controller (e.g., nginx-ingress) (Correct answer)
- CoreDNS
- Metrics Server
Correct answer: Ingress Controller (e.g., nginx-ingress)
An Ingress resource only defines routing rules; an Ingress Controller (like nginx-ingress or Traefik) actually implements those rules.
Question 3: What does a Network Policy's 'podSelector: {}' (empty selector) in the 'spec' match?
- No pods
- All pods in the namespace (Correct answer)
- All pods in the cluster
- Only pods with no labels
Correct answer: All pods in the namespace
An empty podSelector '{}' matches all pods in the namespace where the NetworkPolicy is applied.
Question 4: Which field in an Ingress spec routes requests with path '/api' to a backend service?
- spec.rules[].http.paths[].path (Correct answer)
- spec.backend.path
- spec.routes[].path
- spec.ingress.paths[].url
Correct answer: spec.rules[].http.paths[].path
Ingress path-based routing is configured under 'spec.rules[].http.paths[]', where 'path' specifies the URL prefix and 'backend' the target service.
Question 5: What is the purpose of a headless Service (clusterIP: None) in Kubernetes?
- To block all traffic to the selected pods
- To allow direct DNS-based discovery of individual pod IPs instead of a virtual IP (Correct answer)
- To expose the service externally without a load balancer
- To create a service with no selector
Correct answer: To allow direct DNS-based discovery of individual pod IPs instead of a virtual IP
A headless service returns individual pod IPs in DNS responses rather than a single virtual IP, enabling direct pod addressing (used with StatefulSets).
Question 6: Which Network Policy 'namespaceSelector' configuration allows ingress from all pods in namespaces labeled 'env=monitoring'?
- ingress.from.namespaceSelector.matchLabels.env: monitoring (Correct answer)
- ingress.namespaceLabel: env=monitoring
- ingress.from.namespace: monitoring
- ingress.allowNamespace.label: env=monitoring
Correct answer: ingress.from.namespaceSelector.matchLabels.env: monitoring
Network Policies use 'namespaceSelector.matchLabels' to select source namespaces by their labels.
CKAD Services and Networking 2
What is an Ingress resource used for in Kubernetes?