KCNA Networking & Service Discovery 5 — Questions and Answers
Question 1: Which component is responsible for watching Service and Endpoints changes and updating node-level routing rules?
- CoreDNS
- kube-proxy (Correct answer)
- cloud-controller-manager
- kubelet
Correct answer: kube-proxy
kube-proxy runs on every node, watches the API server for Service and Endpoint changes, and updates iptables or IPVS rules accordingly.
Question 2: In Kubernetes, what is a 'Service Topology' feature used for?
- Mapping Services to physical network topology diagrams
- Routing Service traffic preferentially to endpoints in the same zone or node (Correct answer)
- Defining the VLAN topology for pod networks
- Configuring BGP topology for multi-cluster networking
Correct answer: Routing Service traffic preferentially to endpoints in the same zone or node
Service Topology allows traffic to be routed preferentially to endpoints topologically close to the client, such as same-node or same-zone, reducing latency and cross-zone costs.
Question 3: What is the purpose of a NetworkPolicy's 'namespaceSelector'?
- To select which namespaces the policy applies to
- To allow or deny traffic from pods in specific namespaces (Correct answer)
- To restrict CoreDNS to specific namespaces
- To define the namespace where the Ingress controller runs
Correct answer: To allow or deny traffic from pods in specific namespaces
namespaceSelector in NetworkPolicy ingress/egress rules matches namespaces by label, controlling which namespaces' pods can communicate with the selected pods.
Question 4: Which Service discovery mechanism do pods use by default when environment variable injection is enabled?
- Consul service mesh
- Environment variables injected at pod start for each active Service (Correct answer)
- A sidecar proxy querying the API server
- mDNS broadcast within the pod network
Correct answer: Environment variables injected at pod start for each active Service
Kubernetes injects environment variables like <SERVICE_NAME>_SERVICE_HOST and <SERVICE_NAME>_SERVICE_PORT into each pod at startup for all Services that existed before the pod.
Question 5: What is the function of the 'targetPort' field in a Service spec?
- The port exposed on the node for external access
- The port on the pod/container that the Service forwards traffic to (Correct answer)
- The port the Service listens on within the cluster
- The external load balancer's listening port
Correct answer: The port on the pod/container that the Service forwards traffic to
targetPort specifies the actual port on the pod container to which the Service forwards incoming traffic, and can be a number or a named port.
Question 6: Which Cilium feature goes beyond standard NetworkPolicy to provide identity-based security at L3/L4/L7?
- CiliumNetworkPolicy (Correct answer)
- Kubernetes NetworkPolicy
- PodSecurityPolicy
- ResourceQuota
Correct answer: CiliumNetworkPolicy
CiliumNetworkPolicy is a CRD that extends standard NetworkPolicy with L7 rules (e.g., HTTP methods, paths) and identity-based enforcement using eBPF.
Question 7: In the context of service meshes, what is 'mTLS' used for between services?
- Mutual TLS for encrypted and mutually authenticated pod-to-pod communication (Correct answer)
- Multi-tenant load balancing across namespaces
- Multiplexed TCP connection pooling
- Manual traffic load shaping between services
Correct answer: Mutual TLS for encrypted and mutually authenticated pod-to-pod communication
Mutual TLS (mTLS) ensures both the client and server authenticate each other with certificates, encrypting service-to-service traffic in a service mesh like Istio or Linkerd.
KCNA Networking & Service Discovery 5
Which component is responsible for watching Service and Endpoints changes and updating node-level routing rules?