Configuration Flashcards
What is the ENTRYPOINT statement of a Dockerfile?
Defines the command that is run at startup of the container
What is the CMD statement of a Dockerfile
an array of parameters that are passed to the container as arguments at startup
What Dockerfile statement is equivalent to spec.containers[].command of a kubernetes Pod specification
spec.containers[].command is equivalent to the ENTRYPOINT statement in a Dockerfile
What Dockerfile statement is equivalent to spec.containers[].args of a kubernetes Pod specification
spec.containers[].args is equivalent to the CMD statement in a Dockerfile
In Pod spec.containers[], what parameter sets the environment variables
spec.containers[].env is an array of name-value objects, e.g.:
spec: containers: - env: - name: FOO value: bar
What are three different ways of setting environment variables for a container in kubernetes
-
spec.containers[].envproperty of Pod (or pod template in replicaset or deployment) - configmap
- secrets
How to reference a single environment variable value from a configmap in a Pod definition file
spec: containers: - env: - name: FOO valueFrom: configMapKeyRef: name: config-map-name key: config-map-key-name
How to reference an environment variable value from a secret within a Pod definition file
(e.g. a secret key with name my-secret)
spec: containers: - env: - name: FOO valueFrom: secretKeyRef: my-secret
How to reference an entire configmap as environment variables in a Pod definition file
spec: containers: - envFrom: - configMapRef: name: config-map-name
What is the apiVersion of a configmap?
v1
In a ConfigMap definition, how is a key created?
(e.g. a config map of name my-configmap including a key with name foo and valuebar)
apiVersion: v1 kind: ConfigMap metadata: name: my-configmapdata: foo: bar
What is the imperative command for getting a list of ConfigMaps
kubectl get cm
What is the imperative command for viewing the contents of a ConfigMap cm1
kubectl describe cm cm1
What is the imperative command for viewing the contents of all ConfigMaps
kubectl describe cm
What is the purpose of a ConfigMap?
A ConfigMap is an API object used to store non-confidential data in key-value pairs.
What is the purpose of Secrets
Kubernetes Secrets let you store and manage sensitive information
What is the apiVersion of a Secret
v1
In a Secret specification, what are the four top-level keys?
apiVersion: v1kind: Secretmetadata: {}data: {}
What is the imperative command for creating a secret named FOO with sensitive data BAR
kubectl create secret mysecret1 --from-literal=FOO=$(echo BAR | base64)
How to encode a value BAR into a kubernetes secret
echo BAR | base64
How to decode a kubernetes secret
echo QkFSCg== | base64 -d
How to reference all values within a secret as environment variables within a Pod definition file
spec: containers: - envFrom: - secretRef: name: secret-name
In a Pod specification, spec.containers[], how do you run the container as user 1000?
spec: containers: - securityContext: runAsUser: 1000
In a Pod specification, spec.containers[], how do you give user 1000 MAC_ADMIN capabilities?
spec: containers: - securityContext: runAsUser: 1000 capabilities: add: ["MAC_ADMIN"]
What is the purpose of a ServiceAccount?
A service account provides an identity for processes that run in a Pod. Processes in containers inside pods can contact the apiserver. When they do, they are authenticated as a particular Service Account.
What is the apiVersion of ServiceAccount?
v1
What is the imperative command for creating a ServiceAccount named sa1?
kubectl create sa sa1
What is the imperative command for listing all ServiceAccounts?
kubectl get sa
When a ServiceAccount is created, what happens and how is it connected to a pod
A ServiceAccount creates a Secret, which stores a token which can be used to access the ApiServer. The token is available to pods by mounting the secret as a volume.
In a pod specification, how do we define we should use the sa1 ServiceAccount?
spec: containers: [] serviceAccount: sa1
If a ServiceAccount is not specified in a pod (or pod template), what happens?
The default serviceAccount is mounted.
How can you prevent the default ServiceAccount from being mounted to a pod?
spec: automountServiceAccountToken: false
What is the default minimum resource request for a Pod assumed by Kubernetes?
0.5 CPU 256Mi memory
In Pod definition file how do you request a minimum of 1Gi memory and 1 CPU?
spec: containers: - resources: requests: memory: "1Gi" cpu: 1
What is the lowest value of CPU that can be requested for a Pod?
0.1 CPU. (= 100m CPU)
What is 1 CPU equivalent to in AWS?
1 AWS vCPU
In Pod definition, how do you request a limit of 2Gi memory and 2CPU?
spec: containers: - resources: limits: memory: "2Gi" cpu: 2
What happens if a pod uses more CPU than its limit?
It is throttled
What happens if a pod uses more memory than its limit?
It can temporarily use more memory, but if it is persistently using more memory then it is terminated
On what kubernetes entity are taints applied?
Nodes
On what kubernetes entity are tolerations applied?
Pods
What is the imperative command to apply a taint?
kubectl taint nodes node-name key=value:taint-effect
What are the different types of taint effect?
- NoSchedule
- PreferNoSchedule
- NoExecute
How do NoSchedule and NoExecute taints differ?
NoSchedule prevents new pods being scheduled and run on a node, but does not effect existing ones.
NoExecute will also apply NoSchedule and will evict existing pods which cannot tolerate the taint.
In the Pod definition, how are tolerations applied? (e.g. for taint foo=bar with taint effect NoSchedule)
spec: tolerations: - key: "foo" operator: "Equal" value: "bar" effect: "NoSchedule"
NB. All values have to be quoted
What taint is present on the master node which prevents Pods being scheduled there?
node-role.kubernetes.io/master:NoSchedule
In the Pod definition file, how are Pods limited to only run on a particular node given a single label?
spec: nodeSelector: node-label-key: node-label-value
What is the imperative command to label a node? (e.g. node-name with key foo and value bar)
kubectl label nodes node-name foo=bar
What are the limitations of nodeSelector?
Only matches a single label and value, cannot match complex matching rules (e.g. OR, or NOT)
In the Pod definition, create an affinity for nodes with label foo=bar
spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: foo operator: In values: - bar
In the Pod definition, create an affinity for nodes with label foo=bar OR foo=buzz
spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: foo operator: In values: - bar - buzz
In the Pod definition, create an anti-affinity for nodes with label foo=bar
spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: foo operator: NotIn values: - bar
In the Pod definition, create an affinity for any node labelled with a key of foo and any value
spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: foo operator: Exists
What are the two current types of node affinities?
- requiredDuringSchedulingIgnoredDuringExecution
- preferredDuringSchedulingIgnoredDuringExecution
What is the planned type of node affinity?
requiredDuringSchedulingRequiredDuringExecution
How are taints, tolerations, and affinity used together?
taints prevent non-tolerant pods being scheduled on a node, but they do not guarantee that a tolerant pod will be scheduled on the node. affinity ensures that a pod will be scheduled on a matching node, but does not guarantee that other pods will not also be scheduled on that node. Together, affinity ensures a pod is scheduled on a matching node and taints ensure non-tolerant pods are not scheduled on that pod.
In the Pod definition, how do you run a shell script?
e.g. run while true; do echo hello; sleep 10;done
spec: containers: - command: - "/bin/sh" args: - "-c" - "while true; do echo hello; sleep 10;done"
What is the imperative command for creating a resourcequota?
(e.g. CPU of 1, memory of 1Gi, and 2 pods)
kubectl create quota myrq --hard=cpu=1,memory=1G,pods=2
