VMware 2V0-71.23 - Questions & Answers
Free preview · every answer includes a full explanation
Product page: https://prepkeys.com/2v0-7123.html
Which command has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI?
tanzu cluster scale <cluster_name> --controlplane 5 --worker 10 -- namespace=<my_namespace>
tanzu cluster scale <cluster_name> --controlplane-machine-count 5 --worker-machine-count 10
tanzu scale <cluster_name> --controlplane-machine-count 5 --worker-machine-count 10 --
namespace=<my_namespace>
tanzu scale <cluster_name> --controlplane 5
worker 10
The command that has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI is tanzu cluster scale <cluster_name> --controlplane-machine-count 5 --worker-machine-count 10. The
tanzu cluster scale command allows users to manually scale the number of control plane and worker nodes in a cluster 5. The -- controlplane-machine-count flag specifies the desired number of control plane nodes, while the --worker-machine-count flag specifies the desired number of worker nodes 5. The other commands are invalid because they either use incorrect flags or omit the namespace flag when required 5.
References:
Scale Clusters - VMware Docs
What is the correct procedure to attach a management cluster using the Tanzu Mission Control web console?
On the Clusters page, select the "Management Clusters" tab. Click "Register Management Cluster", and select the type of management cluster to register.
On the Clusters page, select "Attach Cluster" and then select the "Management Cluster" option, complete the form, and click the "Connect" button.
On the Administration page, select "Attach Cluster" and then select the "Management Cluster" option, complete the form, and click the "Connect" button.
On the Administration page, select the "Management Clusters" tab. Click "Register Management Cluster", and select the type of management cluster to register.
The correct procedure to attach a management cluster using the Tanzu Mission Control web console is to go to the Administration page, select the Management Clusters tab, click Register Management Cluster, and select the type of management cluster to register. A management cluster is a Kubernetes cluster that runs the Cluster API components and can be used to create and manage workload clusters 3. VMware Tanzu Mission Control supports registering two types of management clusters: Tanzu Kubernetes Grid management clusters and vSphere with Tanzu Supervisor Clusters4. By registering a management cluster with Tanzu Mission Control, you can enable lifecycle management of its workload clusters, assign them to cluster groups, apply policies, and monitor their health and performance 4.
References:
Register a Management Cluster with Tanzu Mission Control - VMware Docs, Management Clusters - The Cluster API Book
Which component must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster?
Tanzu CLI
Cluster API
Kubeadm
External DNS
The Tanzu CLI is a command-line tool that enables users to interact with VMware Tanzu products and services. It must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster, as it provides commands to create, configure, scale, upgrade, and delete management clusters on different platforms. The Tanzu CLI also allows users to create workload clusters from the management cluster, and to perform various operations on both types of clusters.
References:
VMware Tanzu CLI Documentation, [Deploying Management Clusters with the Tanzu CLI]
What is the correct resource hierarchy order in VMware Tanzu Mission Control?
Root -> Cluster Groups -> Clusters
Organization -> Cluster Groups -> Namespaces
Organization -> Clusters -> Cluster Groups
Organization -> Cluster Groups -> Clusters
The correct resource hierarchy order in VMware Tanzu Mission Control is Organization -> Cluster Groups
-> Clusters. An organization is the root of the resource hierarchy and represents a customer account in Tanzu Mission Control. A cluster group is a logical grouping of clusters that can be used to apply policies and manage access. A cluster is a Kubernetes cluster that can be attached or provisioned by Tanzu Mission Control. A cluster belongs to one and only one cluster group, and a cluster group belongs to one and only one organization.
References:
VMware Tanzu Mission Control Concepts, Resource Hierarchy
What are two possible counts of control plane nodes in a Tanzu Kubernetes Grid Workload Cluster? (Choose two.)
3
5
2
0
1
The control plane nodes are the nodes that run the Kubernetes control plane components, such as the API server, the scheduler, the controller manager, and etcd. The control plane nodes are responsible for managing the cluster state and orchestrating workload operations. The possible counts of control plane nodes in a Tanzu Kubernetes Grid workload cluster are 1 or 3. The control plane must have an odd number of nodes to ensure quorum and high availability. A single control plane node is suitable for development or testing purposes, while three control plane nodes are recommended for production clusters 23.
References:
Deploy Workload Clusters - VMware Docs, Concepts and References - VMware Docs
Which statement about Tanzu Mission Control policies is correct?
Policies can be configured using a tag selector to restrict the scope of the policy.
Policies can only be applied to clustergroups.
Policies allow management and operation of the security posture of Kubernetes clusters, and other organizational objects.
Policies can be enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller.
Policies are one of the features of Tanzu Mission Control that allow you to manage the operation and security posture of your Kubernetes clusters and other organizational objects. Policies allow you to provide a set of rules that govern your organization and all the objects it contains. The policy types available in Tanzu Mission Control include access policy, image registry policy, network policy, quota policy, security policy, and custom policy. Policies can be applied at the individual, group, or organizational level to control access, image registries, networking, resource consumption, security context, and more 18.
The other options are incorrect because: Policies can be configured using a tag selector to restrict the scope of the policy is false. Policies can be configured using a label selector, not a tag selector, to include or exclude certain objects from the policy. A label is a key/value pairattached to a Kubernetes object that allows you to specify identifying attributes for that object. A selector provides the means to identify the objects that have a given label 18.
Policies can only be applied to clustergroups is false. Policies can be applied to various levels of the Tanzu Mission Control resource hierarchy, such as organization, cluster group, workspace, cluster, and namespace 18. Policies can be enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller is false. Policies are enforced by Tanzu Mission Control using its own admission controller and webhook server. Kyverno is an open-source policy engine for Kubernetes that is not related to Tanzu Mission Control.
References:
Policy-Driven Cluster Management, [Kyverno]
Which Kubernetes object must be used to be able to upgrade a pod without disrupting services?
ReplicaSet
Service
Container
Deployment
A Deployment is a Kubernetes object that allows you to perform a rolling update without disrupting services. A Deployment manages a ReplicaSet or a Pod and provides declarative updates for them. You can describe the desired state of your application using a Deployment, and it will change the actual state to the desired state at acontrolled rate. A Deployment also allows you to roll back to a previous version if something goes wrong during the update 14.
The other options are incorrect because: A ReplicaSet is a Kubernetes object that ensures that a specified number of pod replicas are running at any given time. It does not provide any mechanism for updating or rolling back pods 15.
A Service is a Kubernetes object that defines a logical set of pods and a policy to access them. It does not provide any mechanism for updating or rolling back pods 16.
A Container is not a Kubernetes object, but rather a component of a Pod. A Pod is the smallest deployable unit of computing in Kubernetes. A Pod can contain one or more containers that share storage and network resources. A Pod does not provide any mechanism for updating or rolling back itself or its containers 17.
References:
Deployments, ReplicaSets, Services, Pods
Which L7 ingress mode leverages the integration between NSX Advanced Load Balancer and Antrea?
L7 ingress in NodePort mode
L7 ingress in ClusterIP mode
L7 ingress in NodePortLocal mode
L7 ingress in Nodelntegration mode
L7 ingress in NodePortLocal mode is an ingress mode that leverages the integration between NSX Advanced Load Balancer and Antrea. NSX Advanced Load Balancer (NSX ALB) is a solution that provides
L4 and L7 load balancing and ingress control for Kubernetes clusters 5. Antrea is a Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the data plane 6. In NodePortLocal mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a unique port on each node for each pod that serves as a backend for the service. The network traffic is routed from the client to the NSX ALB Service Engine (SE), and then directly to the pods without going through the nodes or kube-proxy. This mode reduces network latency and improves performance by avoiding extra hops 7.
The following diagram illustrates how the network traffic is routed in NodePortLocal mode:
!NodePortLocal mode diagram
The other options are incorrect because: L7 ingress in NodePort mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be NodePort mode, and the network traffic is routed from the client to the NSX ALB SE, and then to the cluster nodes, before it reaches the pods. The NSX ALB SE routes the traffic to the nodes, and kube-proxy helps route the traffic from the nodes to the target pods. This mode requires an extra hop for kube-proxy to route traffic from node to pod 7.
L7 ingress in ClusterIP mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a virtual IP (VIP) for each service. The network traffic is routed from the client to the NSX ALB SE, and then to one of the VIPs assigned by Antrea, before it reaches the pods. The NSX ALB SE routes the traffic to one of the VIPs, and kube-proxy helps route the traffic from the VIPs to the target pods. This mode requires an extra hop for kube-proxy to route traffic from VIPs to pod 7.
L7 ingress in Nodelntegration mode is not a valid ingress mode for NSX ALB.
References:
NSX Advanced Load Balancer, Antrea, NSX ALB as L7 Ingress Controller
An administrator was requested to create a pod with two interfaces to separate the application and management traffic for security reasons.
Which two packages have to be installed in VMware Tanzu Kubernetes Grid cluster to satisfy the requirement? (Choose two.)
multus
external-dns
cert-manager
qrafana
contour
Multus is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods. Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane. By installing these two packages in a VMware Tanzu Kubernetes Grid cluster, an administrator can create a pod with two interfaces and use Contour to route the application and management traffic to different networks.
The other options are incorrect because: external-dns is a package that synchronizes exposed Kubernetes services and ingresses with DNS providers. It does not provide multiple interfaces for pods. cert-manager is a package that automates the management and issuance of TLS certificates from various sources. It does not provide multiple interfaces for pods. qrafana is not a valid package name. The correct spelling is Grafana, which is a package that provides visualization and analytics for metrics collected by Prometheus. It does not provide multiple interfaces for pods.
References:
Install Multus and Whereabouts for Container Networking, Install Contour for Ingress
Which Kubernetes object controls what traffic is allowed to and from selected pods and network endpoints?
Ingress
NetworkPolicv
PodSecurityPolicy
ISecret
A NetworkPolicy is a Kubernetes object that controls what traffic is allowed to and from selected pods and network endpoints 6. NetworkPolicy objects contain the following information: The pods that are affected by this policy (the pod selector) The traffic that is allowed for these pods (the ingress and egress rules) The network entities that are allowed or denied for this traffic (the selectors and
IP blocks)
By default, all pods in a cluster can communicate with each other and with any external network endpoint.
A NetworkPolicy allows you to restrict this behavior by defining rules for pod isolation and network access.
A NetworkPolicy is enforced by a network plugin that supports it6.
The other options are incorrect because: An Ingress is a Kubernetes object that manages external access to services in a cluster, typically HTTP7.
It does not control what traffic is allowed to and from selected pods and network endpoints.
A PodSecurityPolicy is a Kubernetes object that controls security-sensitive aspects of pod specification, such as running as privileged or using host networking 8. It does not control what traffic is allowed to and from selected pods and network endpoints.
A Secret is a Kubernetes object that stores sensitive information, such as passwords or keys, in an encrypted form 9. It does not control what traffic is allowed to and from selected pods and network endpoints.
References:
Network Policies, Ingress, Pod Security Policies, Secrets
Showing 10 of 63 questions · Unlock the full set