2020年CKA考试真题题库

2,297次阅读

Question 1

创建一个名为deployment-clusterrole的clusterrole,并且对该clusterrole只绑定对Deployment，Daemonset,Statefulset的创建权限

在指定namespace app-team1创建一个名为cicd-token的serviceaccount，并且将上一步创建clusterrole和该serviceaccount绑定

创建clusterrole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployment-clusterrole 
rules:
- apiGroups: [""]
  resources: ["deployments", "statefulsets", "daemonsets"]
  verbs: ["create"]

创建sa

kubectl create sa cicd-token -n app-team1

创建rolebinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployment-rolebinding 
  namespace: app-team1
subjects:
- kind: ServiceAccount
  name: cicd-token 
  namespace: app-team1
roleRef:
  kind: ClusterRole
  name: deployment-clusterrole 
  apiGroup: rbac.authorization.k8s.io

Question 2

将名为ek8s-node-1的node设置为不可用，并且重新调度该node上所有允许的pods

kubectl get nodes
NAME      STATUS   ROLES                  AGE   VERSION
master    Ready    control-plane,master   47h   v1.20.1
node-02   Ready    worker                 47h   v1.20.1
node-03   Ready    worker                 47h   v1.20.1

kubectl get po -o wide            
NAME                                READY   STATUS    RESTARTS   AGE   IP            NODE      NOMINATED NODE   READINESS GATES
nginx-deployment-66b6c48dd5-5b4n9   1/1     Running   0          46h   10.244.2.19   node-03   <none>           <none>
nginx-deployment-66b6c48dd5-9557j   1/1     Running   0          42h   10.244.2.20   node-03   <none>           <none>
nginx-deployment-66b6c48dd5-b6lln   1/1     Running   0          42h   10.244.2.21   node-03   <none>           <none>

驱逐node-03

kubectl cordon node-03
kubectl drain node-03 --delete-local-data --ignore-daemonsets --force

kubectl get po -o wide
NAME                                READY   STATUS    RESTARTS   AGE    IP            NODE      NOMINATED NODE   READINESS GATES
nginx-deployment-66b6c48dd5-fdxfn   1/1     Running   0          116s   10.244.1.37   node-02   <none>           <none>
nginx-deployment-66b6c48dd5-krrqk   1/1     Running   0          116s   10.244.1.40   node-02   <none>           <none>
nginx-deployment-66b6c48dd5-pxhwf   1/1     Running   0          116s   10.244.1.36   node-02   <none>           <none>

Question 3

现有的Kubernetes集权正在运行的版本是1.18.8，仅将主节点上的所有kubernetes控制面板和组件升级到版本1.19.0 另外，在主节点上升级kubelet和kubectl

# 将节点标记为不可调度状态
kubectl cordon k8s-master

# 驱逐Pod
kubectl drain k8s-master--delete-local-data --ignore-daemonsets --force

# 升级组件
$ yum install kubeadm=1.19.0-00 kubelet=1.19.0-00 kubectl=1.19.0-00 -y

# 重启kubelet服务
$ systemctl restart kubelet

# 升级集群其他组件
$ kubeadm upgrade apply v1.19.0

Question 4

首先，为运行在https://127.0.0.1:2379上的现有etcd实力创建快照并且将快照保存到/etc/data/etcd-snapshot.db 然后还原与/var/lib/backup/etcd-snapshot-previoys.db的现有先前快照提供了以下TLS证书和密钥，已通过etcdctl连接到服务器

ca证书：/opt/KUIN000601/ca.crt 客户端证书：/opt/KUIN000601/etcd-client.crt 客户端密钥：/opt/KUIN000601/etcd-client.key

#备份：要求备份到指定路径及指定文件名
$ ETCDCTL_API=3  etcdctl --endpoints="https://127.0.0.1:2379" --cacert=/opt/KUIN000601/ca.crt --cert=/opt/KUIN000601/etcd-client.crt --key=/opt/KUIN000601/etcd-client.key  snapshot save /etc/data/etcd-snapshot.db
#还原：要求使用指定文件进行还原
$ ETCDCTL_API=3  etcdctl --endpoints="https://127.0.0.1:2379" --cacert=/opt/KUIN000601/ca.crt --cert=/opt/KUIN000601/etcd-client.crt --key=/opt/KUIN000601/etcd-client.key   snapshot restore /var/lib/backup/etcd-snapshot-previoys.db --data-dir=/var/lib/etcd

Question 5

创建networkPolicy，针对namespace internal下的pod，只允许同样namespace下的pod访问，并且可访问pod的9000端口。

不允许不是来自这个namespace的pod访问。

不允许不是监听9000端口的pod访问。

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: all-port-from-namespace
  namespace: internal
spec:
  podSelector:
    matchLabels: {}
  ingress:
  - from:
    - podSelector: {}
    ports:
    - port: 80

Question 6

重新配置已经存在的deployment front-end，为容器nginx增加port

name: http

port: 80/tcp

创建服务front-end-svc，暴露名为http的容器端口

查看已存在的deployment

kubectl get deployment                  
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
front-end   1/1     1            1           18s

编辑，增加端口配置

kubectl edit deployment front-end
spec:
      containers:
      - image: nginx:1.14.2
        imagePullPolicy: IfNotPresent
        name: nginx
        ports:
        - containerPort: 80
          name: http
          protocol: TCP

暴露服务

kubectl expose deployment front-end --name=front-end-svc --port=80 --target-port=80 --type=NodePort

Question 7

创建Ingress，将指定的Service的指定端口暴露出来

集群资源查看

kubectl get svc,po -n ing-internal 
NAME         TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
service/hi   NodePort   10.110.68.143   <none>        5678:31873/TCP   2m17s

NAME        READY   STATUS    RESTARTS   AGE
pod/nginx   1/1     Running   0          21m

创建Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: pong
  namespace: ing-internal
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - http:
      paths:
      - path: /hi
        pathType: Prefix
        backend:
          service:
            name: hi
            port:
              number: 5678

访问测试

curl 10.234.2.12/hi         
hi

Question 8

将指定的deployment扩展至6个pods

kubectl scale deployment loadbalancer --replicas=6

Question 9

将pod名称为nginx-kusc00401,pod镜像名称为nginx，部署到标签为disk:spinning的node节点上

查看node标签

kubectl get nodes --show-labels

创建Pod

apiVersion: v1
kind: Pod
metadata:
  name: nginx-kusc00401
  labels:
    role: nginx-kusc00401
spec:
  nodeSelector:
    disk: spinning
  containers:
    - name: nginx
      image: nginx

Question 10

检查有多少node节点是健康状态，其中不包括”NoSchedule”，并将结果写入到指定目录中

kubectl describe nodes | grep -i taint
Taints:             node-role.kubernetes.io/master:NoSchedule
Taints:             <none>
Taints:             <none>

echo 2 > /opt/KUSC00402/kusc00402.txt

Question 11

创建一个拥有多个container容器的Pod:nginx+redis+memcached+consul

apiVersion: v1
kind: Pod
metadata:
  name: kucc1
spec:
  containers:
  - image: nginx
    name: nginx
  - image: redis
    name: redis
  - image: memchached
    name: memcached
  - image: consul
    name: consul

Question 12

创建一个名为app-config的PV，

容量为2Gi

访问模式为ReadWriteMany

volume的类型为hostPath

位置为/src/app-config

apiVersion: v1
kind: PersistentVolume
metadata:
  name: app-config
  labels:
    type: local
spec:
  capacity:
    storage: 2Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/src/app-config"

Question 13

用指定storageclass创建一个pvc 大小为10M

将这个nginx容器的/var/nginx/html目录使用该pvc挂在出来将这个pvc的大小从10M更新成70M

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pv-volume
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 10Mi
  storageClassName: nfs
---
apiVersion: v1
kind: Pod
metadata:
  name: web-server
spec:
  containers:
    - name: nginx
      image: nginx
      volumeMounts:
      - mountPath: "/usr/share/nginx/html"
        name: pv-volume
  volumes:
    - name: pv-volume
      persistentVolumeClaim:
        claimName: pv-volume

Question 14

监控 pod foobar的日志并提取错误的unable-access-website 相对于的日志写入到 /opt/KUTR00101/foobar

kubectl logs foobar | grep unable-access-website > /opt/KUTR00101/foobar

Question 15

Question 16

查看Pod标签为name=cpu-user的CPU使用率并且把cpu使用率最高的pod名称写入/opt/KUTR00401/KUTR00401.txt文件里

kubectl  top  pod -l name=cpu-user -A
    NAMAESPACE NAME        CPU   MEM
    delault    cpu-user-1  45m   6Mi
    delault    cpu-user-2  38m   6Mi
    delault    cpu-user-3  35m   7Mi
    delault    cpu-user-4  32m   10Mi
echo 'cpu-user-1' >>/opt/KUTR00401/KUTR00401.txt

Question 17

名为wk8s-node-0的节点处于NotReady状态，将其恢复成Ready状态，并且设置为开机自启

# 连接到NotReady节点
$ ssh wk8s-node-0

获取权限
$ sudo -i

# 查看服务是否运行正常
$ systemctl status kubelet 

#如果服务非正常运行进行恢复
$ systemctl start kubelet

#设置开机自启
$ systemctl enable kubelet

发表于：云原生

2021-01-06