Task 1.2: Administration

• Akubectl create -f manifests/

  Incorrect

  create is imperative object configuration for new objects; it reports an error when an object already exists.

• Bkubectl apply -f manifests/

  Correct

  Declarative configuration lets kubectl detect per object whether to create or patch it, and it works on whole directories.

• Ckubectl replace -f manifests/

  Incorrect

  replace overwrites live objects that must already exist and drops changes not in the file, so the first run fails.

• Dkubectl run app --image=app:1.0

  Incorrect

  run starts a single Pod imperatively and does not read the manifests at all.

Declarative object configuration with kubectl apply is the fit for files kept in version control: the same command creates, updates and works on directories.

• Akubectl config use-context production

  Correct

  use-context sets the current context in the kubeconfig file, and kubectl uses it for every later command.

• Bkubectl config set-context production

  Incorrect

  set-context does not switch which context is current, so later commands would still go to staging.

• Ckubectl config view --minify

  Incorrect

  view prints the configuration; with --minify it shows only what the current context uses. It changes nothing.

• Dkubectl cluster-info

  Incorrect

  cluster-info prints the addresses of the control plane and services for the current context.

A kubeconfig file can hold many clusters, users and contexts; kubectl config use-context picks the one that later commands use.

• Akubectl delete node <node>

  Incorrect

  Deleting the Node object removes it from the API instead of evicting its Pods through the Eviction API, so it is not a graceful maintenance step.

• Bkubectl taint nodes <node> maintenance=true:NoSchedule

  Incorrect

  A NoSchedule taint keeps new Pods off but leaves the running Pods where they are.

• Ckubectl drain <node> --ignore-daemonsets

  Correct

  drain marks the node unschedulable and evicts its Pods through the Eviction API, which respects PodDisruptionBudgets. DaemonSet Pods are skipped with the flag.

• Dkubectl rollout restart deployment --all

  Incorrect

  Restarting every Deployment recreates Pods across the cluster, possibly on the same node, and ignores Pods not owned by Deployments.

kubectl drain is the maintenance command: it cordons the node and evicts Pods with respect for disruption budgets, so workloads move before the reboot.

• ALimitRange in team-a

  Incorrect

  A LimitRange constrains individual Pods or containers, not the total for the namespace.

• BPriorityClass for team-a's Pods

  Incorrect

  Priority orders Pods for scheduling and preemption. It sets no ceiling on what a team consumes.

• CResourceQuota in team-a

  Correct

  A ResourceQuota limits the aggregate resource consumption of a namespace and rejects requests that would exceed it.

• DPodDisruptionBudget for team-a's Deployments

  Incorrect

  A disruption budget limits how many Pods voluntary disruptions may take down at once. It says nothing about resources.

Namespace-wide totals are the job of ResourceQuota; once a quota covers CPU or memory, Pods in that namespace must state requests or limits for them.

• Akubectl describe deployment web

  Incorrect

  describe shows the live state and recent events of one object, not field documentation.

• Bkubectl api-resources

  Incorrect

  api-resources lists the kinds the server supports, with short names and scope, but no field documentation.

• Ckubectl get deployment web -o yaml --show-managed-fields

  Incorrect

  This prints one object's current values. Fields that are unset do not appear and nothing is explained.

• Dkubectl explain deployment.spec.strategy

  Correct

  explain describes the fields and structure of a resource, addressed with a simple JSONPath-style identifier, using the cluster's API schema.

kubectl explain reads the API schema the server publishes, so it is the quickest way to look up what a field means and which sub-fields it has.

• AUpgrade the worker nodes' kubelets first so they are ready for the new API

  Incorrect

  A kubelet newer than kube-apiserver is outside the version skew policy.

• BUpgrade to v1.36 first and then from v1.36 to v1.37

  Correct

  kubeadm supports upgrades of one minor version at a time; skipping a minor version is unsupported.

• CRun kubeadm upgrade apply v1.37.x directly on the v1.35 control plane

  Incorrect

  That skips a minor version, which kubeadm does not support.

• DUpgrade the control plane nodes before the worker nodes

  Correct

  The workflow upgrades the primary control plane node, then the other control plane nodes, then the workers, because a kubelet must not be newer than the API server.

• EUpgrade the nodes together in one step and skip the drain

  Incorrect

  The documented procedure drains each node before upgrading its kubelet so workloads move off first.

Go one minor version at a time, control plane first and nodes after, draining each node before its kubelet is upgraded.

• Akubectl set resources run on each Deployment

  Incorrect

  That sets values once per workload by hand; new containers still get none.

• BA PriorityClass marked globalDefault

  Incorrect

  That sets a default priority, not resource values.

• CA VerticalPodAutoscaler for each Deployment

  Incorrect

  VPA recommends or adjusts requests from usage; it is not a namespace-wide default for new containers.

• DA LimitRange with default requests and limits

  Correct

  A LimitRange can set default requests and limits that the admission controller applies to containers that do not set them.

LimitRange sets per-container defaults and bounds inside a namespace, so containers that state nothing still get sensible values.

• AThey are deleted along with the namespace

  Correct

  Deleting a namespace deletes everything under it.

• BThey are moved into the default namespace

  Incorrect

  Kubernetes does not move objects between namespaces.

• CThey keep running but can no longer be listed

  Incorrect

  Namespaced objects cannot outlive their namespace.

• DThe command fails until the namespace is empty

  Incorrect

  The deletion proceeds and removes the contents.

A namespace delete is a bulk delete of all its objects, so it deserves care.

• AA HorizontalPodAutoscaler with minReplicas set to 2

  Incorrect

  The autoscaler sets the desired count; it does not hold back evictions.

• BA PodDisruptionBudget with minAvailable set to 2

  Correct

  Voluntary evictions go through the Eviction API, which respects disruption budgets, so maintenance will not take the service below 2.

• CA PriorityClass with a high value

  Incorrect

  Priority affects scheduling and preemption, not voluntary evictions.

• DA readiness probe on each of the 3 replicas

  Incorrect

  Readiness controls traffic to a Pod; it does not limit how many Pods are evicted.

PodDisruptionBudgets limit how many replicas voluntary disruptions, such as node maintenance, may take down at once.

• AIn the status field of the live object

  Incorrect

  status reports current state written by controllers.

• BIn its last-applied-configuration annotation

  Correct

  Client-side apply stores the applied configuration in this annotation and compares it with the new file.

• CIn a local cache file next to the manifest

  Incorrect

  kubectl keeps no per-object cache on disk for this.

• DIn the Deployment's revision history

  Incorrect

  Revision history tracks Pod template changes, not every applied field.

The last-applied-configuration annotation lets apply compute what to add, change and delete.