NCP-CN Nutanix Certified Professional - Cloud Native (NCP-CN-6.10) Questions and Answers

According to the NKPA 6.10 documentation, the Pre-provisioned infrastructure provider (CAPPP) requires the user to provide an inventory file of the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

The NKPA course covers user authentication for NKP clusters as part of Day 2 operations, emphasizing integration with external identity providers (IdPs) to manage user access securely. NKP uses Dex, an OpenID Connect (OIDC) identity provider, to facilitate authentication by acting as a connector between the Kubernetes cluster and external IdPs, such as LDAP, SAML, or OAuth-based systems.

The course explains that to set up user authentication, a Platform Engineer must configure a Dex connector to the user base’s identity provider. Dex integrates with the Kubernetes API server to enable OIDC-based authentication, allowing users to log in using their IdP credentials. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP supports user authentication through Dex, which provides OIDC integration with external identity providers, enabling single sign-on (SSO) for cluster access.” The process involves deploying Dex as a platform application, configuring the IdP connector (e.g., specifying client IDs, secrets, and endpoints), and updating the Kubernetes API server to use OIDC authentication.

Incorrect Options:

A. Enable Gatekeeper and create a connector to the user base’s identity provider: Gatekeeper is a Kubernetes policy engine used for enforcing admission control policies, not for authentication. The NKPA course does not associate Gatekeeper with user authentication.

B. Disable native NKP authentication, enable Traefik, and create a connector to the user base’s identity provider: Traefik is an ingress controller for managing external traffic, not authentication. Disabling native authentication is unnecessary, as NKP supports OIDC alongside native methods. The NKPA course does not mention Traefik in the context of authentication.

C. Create a MetalLB connector to the user base’s identity provider: MetalLB is a load balancer for bare-metal Kubernetes clusters, not an authentication component. This option is irrelevant, as per the NKPA course.

As outlined in the NKPA 6.10 documentation under "Customizing Resource Requests and Limits for Logging," to override the default resource values for the logging operator, a ConfigMap named logging-operator-logging-overrides in the kommander namespace is used. The values.yaml in the ConfigMap should precisely define fluentd resource limits and requests in a valid YAML format.

The correct YAML format is:

yaml

Copy

apiVersion: v1

kind: ConfigMap

metadata:

name: logging-operator-logging-overrides

namespace: kommander

data:

values.yaml: |

fluentd:

resources:

limits:

cpu: 4

memory: 4Gi

requests:

cpu: 4

memory: 4Gi

This ensures that the desired CPU and memory resources are correctly applied for the fluentd daemon, avoiding parsing errors and meeting the high-demand logging needs.

NKP uses the Cluster Autoscaler to scale worker node replicas up or down. This ensures that resource availability dynamically matches workload demand by adjusting the number of worker nodes. Pod-level autoscaling (Horizontal-Pod autoscaler) is also supported for pod scaling but is not responsible for node pool expansion or compaction.

Key Reference:

“NKP uses the Cluster Autoscaler to dynamically adjust worker node pool replicas in response to cluster resource demands.”

As outlined in the NKPA 6.10 documentation, Goss is used to validate that an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”

NKP uses Cluster API (CAPI) to provision and manage Kubernetes clusters across supported infrastructures, including Nutanix AHV, vSphere, AWS, and GCP. CAPI components, such as controllers and providers, are deployed to manage the lifecycle of clusters on these platforms. However, when NKP attaches to a managed Kubernetes service like Azure Kubernetes Service (AKS), CAPI components are not deployed because AKS is managed by Azure, and NKP only integrates with the cluster for fleet management, not provisioning.

The NKPA course explains: “For managed Kubernetes services like AKS, NKP attaches the cluster to its management plane without deploying CAPI components, as the underlying infrastructure is managed by the cloud provider.” The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide reinforces this: “CAPI is used for NKP-managed clusters on Nutanix, vSphere, AWS, and GCP, but not for attached managed services like AKS.”

Incorrect Options:

A. vSphere: NKP deploys CAPI components (e.g., CAPV provider) to manage vSphere-based clusters.

B. GCP: NKP deploys CAPI components (e.g., CAPG provider) for GCP-based clusters.

C. Nutanix: NKP deploys CAPI components (e.g., CAPA provider for AHV) for Nutanix AHV clusters.

The primary benefit of a private registry is to ensure security and privacy for container images, especially when dealing with sensitive data and compliance requirements (such as financial or government use cases). While secure connections to public registries like DockerHub or GitHub container registries are possible, using a private registry ensures full control over image access and auditing.

Key reference:

“Private registries ensure images remain within the security and compliance boundaries of the enterprise, avoiding potential risks associated with public SaaS registries.”

According to the NKPA 6.10 documentation, Rook Ceph is the recommended out-of-the-box storage solution integrated with NKP for persistent data storage, backups, and object storage within the Kubernetes environment.

Key Reference:

“Rook Ceph is integrated with NKP for providing persistent storage and backup support within the cluster.”

The NKPA 6.10 documentation confirms that the proper method to customize application deployment (including disabling Velero) is by generating a configuration file using the nkp install kommander --init command. The file can then be modified to set custom specs and disable Velero, and finally deployed using the nkp install kommander command.

Exact extract:

“Generate a custom configuration file using --init, modify it for your specific environment (including disabling Velero), and deploy with the same nkp install kommander command.”

As per the NKPA 6.10 documentation under “Day 2 Operations: Managing Applications”, the recommended procedure to enable an application (like NKP Insights) involves accessing the cluster’s Application Dashboard. The NKP Insights application does not appear in the general category list if the cluster does not have the correct context or if the application category is not globally enabled.

The specific procedure to enable NKP Insights includes:

Navigate to the Clusters section from the left-side menu.

Select View Details for the target cluster (prod-01 in this case).

In the Application Dashboard of that specific cluster, locate the NKP Insights application.

Click the three-dot menu (ellipsis) for NKP Insights and select Enable.

NKP uses Helm and Flux for application deployment, where applications are managed as HelmReleases, a custom resource that defines Helm chart deployments. The NKPA course explains that to validate the status of HelmReleases, administrators can use the kubectl command to query these resources. The correct command is kubectl get helmreleases -n ${PROJECT_NAMESPACE}, which lists all HelmReleases in the specified project namespace, showing their status (e.g., Ready, Failed) and other details like chart version and reconciliation status.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To check the status of HelmReleases in NKP, use kubectl get helmreleases -n to view the current state of application deployments managed by Flux.” This command helps the operations team verify that applications are running correctly and identify any issues in production.

Incorrect Options:

A. kubectl get namespaces: This lists namespaces, not HelmReleases or their status.

C. kubectl edit helmreleases -n ${PROJECT_NAMESPACE}: This edits HelmRelease resources, not displays their status.

D. kubectl apply -f fluent-bit-overrides.yaml: This applies a configuration for Fluent Bit, unrelated to HelmRelease status.

The NKPA course details NKP’s monitoring stack for collecting and analyzing metrics across attached and managed clusters, which is critical for troubleshooting issues like out-of-memory errors. The engineer needs to collect centralized metrics and set up alerting to identify performance issues. The correct approach is to use Prometheus for metrics collection and Thanos Query for alerting (Option C).

Utilize Prometheus to collect and present centralized metrics on NKP attached and managed clusters: Prometheus is NKP’s default metrics collection tool, deployed as a platform application. It scrapes metrics (e.g., CPU, memory usage) from nodes, pods, and services across all clusters in a workspace, centralizing them for analysis. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Prometheus is used in NKP to collect and present centralized metrics from attached and managed clusters, enabling detailed performance analysis.” This is ideal for identifying differences in memory usage causing the out-of-memory errors.

Configure Thanos Query to monitor and send out alerts based on the metric thresholds that have been configured within it: Thanos Query, part of NKP’s monitoring stack, aggregates Prometheus metrics across clusters and provides a unified query interface. It also integrates with Alertmanager to send alerts based on configured thresholds (e.g., memory usage > 90%). The NKPA course notes: “Use Thanos Query to monitor metrics across NKP clusters and configure alerts with Alertmanager to notify engineers of performance issues like out-of-memory errors.” This setup helps the engineer proactively address the issue.

Incorrect Options:

A & B. Utilize Fluentd and Fluent Bit: Fluentd and Fluent Bit are logging tools in NKP, used for collecting logs, not metrics. Metrics collection requires Prometheus.

D. Utilize Thanos to collect and present centralized metrics: Thanos does not collect metrics directly; it extends Prometheus by providing long-term storage and query aggregation. Prometheus is the primary collection tool.

The NKPA course explains that upgrading an NKP license to the Ultimate tier unlocks advanced features such as fleet management, air-gapped deployments, and additional platform services (e.g., monitoring, logging, backup/restore). These services are deployed on the Management cluster and require sufficient resources to operate effectively. A key prerequisite is to size the Control Plane nodes appropriately to support the installation of default platform services (Option C).

The Control Plane nodes in the NKP Management cluster run critical components like the API server, controller manager, and Kommander, as well as platform services such as Prometheus, Grafana Loki, and Velero. The Ultimate license increases resource demands due to the expanded functionality, and undersized Control Plane nodes can lead to performance issues or failed deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before upgrading to an NKP Ultimate license, ensure the Control Plane nodes of the Management cluster are sized appropriately (e.g., sufficient CPU, memory, and storage) to support the additional default platform services enabled by the license.” For example, Control Plane nodes might need to be scaled to at least 4 vCPUs and 16 GB RAM, depending on the workload.

Incorrect Options:

A. Size the Sidecar containers appropriately: Sidecar containers are typically used for specific workloads (e.g., logging agents), not for platform services deployment, and are not a licensing prerequisite.

B. Size the ETCD nodes appropriately: While etcd is part of the Control Plane, the course refers to the Control Plane nodes as a whole, not etcd specifically, as the sizing requirement.

D. Size the Worker nodes appropriately: Worker nodes run user workloads, not the platform services, which are deployed on the Control Plane in the Management cluster.

The error states:

pgsql

Copy

error upgrading CAPI components: unable to upgrade CAPI components: deployment "capp-controller-manager" is not ready after 10m0s: failed to connect to the management cluster: context deadline exceeded

This clearly points to connectivity issues between the VM (or nodes) and the management cluster, typically caused by registry communication issues in air-gapped or private environments. When the VM cannot connect to the registry to pull required images or configuration, the CAPI (Cluster API) components cannot be initialized, causing a timeout.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Air-Gapped and Registry Communication Issues”

NCP-CN 6.10 Study Guide – “Cluster API Upgrade Process and Network Prerequisites”

=======

The NKPA course emphasizes that NKP’s fleet management capabilities allow administrators to manage multiple Kubernetes clusters, including lightweight clusters on edge devices, by attaching them to an NKP workspace. With the NKP Ultimate license tier, the administrator has access to advanced fleet management features, including GitOps-based application deployment across attached clusters.

The most efficient way to lifecycle manage application deployments across the 30 edge devices is to create a new workspace and attach the 30 edge devices to this workspace using the Attach Cluster functionality (Option D). Once attached, NKP can use GitOps (via Flux) to push applications to all clusters in the workspace simultaneously, ensuring consistent deployment and lifecycle management. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For managing edge devices with lightweight Kubernetes, attach the clusters to an NKP workspace using the Attach Cluster feature, enabling centralized application deployment and lifecycle management via GitOps.” The administrator can use the kubeconfig files to attach each cluster via the NKP UI or CLI (e.g., nkp attach cluster).

Incorrect Options:

A. Create a GitHub configuration for each device: This is manual and inefficient compared to NKP’s centralized GitOps management.

B. Create a script to automate deployment: Scripting is error-prone and lacks NKP’s built-in fleet management capabilities.

C. Delete lightweight Kubernetes and deploy new clusters: This is unnecessary, as NKP can manage existing clusters, including lightweight ones.

The documentation confirms that when a new license is activated to upgrade to a higher tier, users must log out and log back in for the license changes to take effect. This ensures that updated entitlements are loaded into the UI and CLI environment.

Exact extract from documentation:

“After applying a new license for a higher-tier product, log out and log back in to see and activate the newly available features.”

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the --to-registry option, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”

The NKPA course explains the role of a bootstrap cluster in NKP deployments, particularly in hybrid architectures involving Nutanix on-prem and Amazon EKS. A bootstrap cluster is a temporary Kubernetes cluster created during the deployment process to initialize Cluster API (CAPI) components, which manage the lifecycle of the target NKP clusters. The primary function of the bootstrap cluster is to use Cluster API for infrastructure-agnostic provisioning (Option D).

CAPI enables NKP to provision clusters across different infrastructures (e.g., Nutanix AHV, AWS EKS) in a consistent, infrastructure-agnostic manner. The bootstrap cluster runs the CAPI controllers (e.g., CAPX for Nutanix, CAPA for AWS) that orchestrate the creation of the target clusters, abstracting the underlying infrastructure details. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The bootstrap cluster in NKP uses Cluster API to provide infrastructure-agnostic provisioning, enabling consistent cluster creation across diverse environments like Nutanix AHV and Amazon EKS.” This ensures that the same CAPI-based workflow can deploy clusters on both on-prem Nutanix and cloud-based EKS.

Incorrect Options:

A. Increases security from a single point of entry: A bastion host, not a bootstrap cluster, provides a single point of entry for security. The bootstrap cluster is temporary and focuses on provisioning.

B. Simplifies the networking requirements for Kubernetes: Networking is managed by the target cluster’s CNI (e.g., Calico), not the bootstrap cluster.

C. Saves cost by minimizing resources required for provisioning: The bootstrap cluster is temporary and does not significantly impact costs; its purpose is provisioning, not cost-saving.

As per the NKPA 6.10 documentation, the primary requirement for attaching external (self-managed) Kubernetes clusters to NKP is network connectivity. Specifically, the NKP management cluster must be able to communicate with the Kubernetes API server and relevant services of the target cluster. This allows NKP to collect metrics, perform health checks, and manage the attached cluster through Kommander and associated tools.

Exact extract:

“For attaching existing Kubernetes clusters, ensure the NKP management cluster can reach the Kubernetes API server of the target cluster and that the kubeconfig used has sufficient permissions.”

There is no requirement that the Kubernetes versions be exactly matched or within N-1, nor that an NKP admin account be directly established on the target clusters; the connectivity and valid kubeconfig file are the essential requirements.

The NKPA course emphasizes that NKP supports multi-tenancy through workspaces, each of which can be configured with its own Identity Provider (IdP) for authentication. In this scenario, each group (Fin VD, Fin Insurance, Fin Travel) has its own IdP, and the engineer has created separate workspaces for them. To assign the Tenant Administrators role, the engineer must configure a dedicated IdP for each group’s workspace, enabling users to authenticate via their group-specific IdP and assume the Tenant Administrator role.

The course details that NKP uses Dex as the OIDC provider to integrate with external IdPs. For each workspace, the engineer configures a Dex connector to the group’s IdP, maps the IdP groups to NKP roles (e.g., Tenant Administrator), and assigns permissions via role bindings. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To assign Tenant Administrator roles in NKP, configure a dedicated IdP for each workspace using Dex connectors, mapping IdP groups to the appropriate roles for workspace management.” This ensures that each group’s administrators can access only their designated workspace.

Incorrect Options:

B. Create a role named admin-tenant-X: NKP uses predefined roles like Tenant Administrator, not custom roles with specific naming conventions.

C. Create a role binding and assign it: Role bindings are part of the process, but the primary step is configuring the IdP for authentication, as per the NKPA course.

D. Configure the global Active Directory: The scenario specifies separate IdPs per group, not a global Active Directory for all groups.

The NKPA course details the process for upgrading an NKP-managed Kubernetes cluster, such as one running on AWS from version 1.28.1 to 1.29.9. Upgrading a Kubernetes cluster involves two distinct steps: upgrading the control plane nodes and upgrading the worker nodes, ensuring minimal disruption and maintaining compatibility. The NKP CLI provides specific commands to handle these upgrades separately for AWS clusters.

Upgrade Control Planes with nkp update controlplane aws --cluster-name=${CLUSTER_NAME} --ami AMI_ID --kubernetes-version=v1.29.9 (Option B):The control plane must be upgraded first to the target Kubernetes version (1.29.9). The nkp update controlplane aws command updates the control plane nodes, specifying the cluster name, the new Kubernetes version, and an updated AMI (Amazon Machine Image) that supports the target version. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To upgrade an NKP cluster on AWS, first update the control plane using nkp update controlplane aws --cluster-name --ami --kubernetes-version to ensure the control plane runs the desired Kubernetes version.” The --ami flag is required to specify a compatible image for the upgraded control plane nodes.

Upgrade Workers with nkp upgrade nodepool aws ${NODEPOOL_NAME} --cluster-name=${CLUSTER_NAME} --kubernetes-version=v1.29.9 (Option C):After the control plane is upgraded, the worker nodes in each node pool must be upgraded to match the control plane version. The nkp upgrade nodepool aws command updates the specified node pool to the target Kubernetes version (1.29.9). The NKPA course notes: “Upgrade worker nodes using nkp upgrade nodepool aws --cluster-name --kubernetes-version , which performs a rolling update to ensure minimal downtime.” This command automatically handles the rolling update of worker nodes, replacing them with new nodes running the updated version. Note that the --ami flag is not required here, as NKP typically uses the same AMI as the control plane or retrieves a compatible one based on the version.

Incorrect Options:

A. nkp update nodepool aws: The correct command is nkp upgrade nodepool, not nkp update nodepool. The NKPA course uses upgrade for version changes to node pools.

D. nkp update cluster aws: This command is not the standard approach for upgrading Kubernetes versions in NKP. The course specifies separate commands for control plane and node pool upgrades to ensure a controlled process.

Continuous Deployment (CD) is the practice of automatically deploying new software releases across environments after a successful build and testing phase. In the context of NKP, enabling CD ensures that software changes are consistently and reliably rolled out to all clusters associated with a project, ensuring operational uniformity and rapid feature adoption.

According to the NKPA 6.10 documentation, the critical system components for NKP nodes are:

kubelet

containerdThese components are deployed in the standard Linux path: /var/lib.

Exact extract from the documentation:

“The kubelet and containerd services require disk space in /var/lib on the host operating system. It’s essential to allocate sufficient storage in /var/lib to accommodate these core Kubernetes components.”

The Konvoy Image Builder requires a 64-bit Linux or MacOS environment (x86_64 architecture) to build and customize the OS images.

The Secure Tunnel feature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

The scenario describes an isolated environment in Antarctica, implying an air-gapped NKP deployment where the bastion host serves as the primary management point for deploying and managing NKP clusters without Internet access. The NKPA course outlines the essential tools that must be installed on a bastion host to facilitate NKP deployment and management in such environments.

The required programs are kubectl and nkp:

kubectl: This is the Kubernetes command-line tool used to interact with Kubernetes clusters, essential for managing cluster resources, debugging, and applying configurations during and after deployment.

nkp: The NKP CLI (nkp) is the primary tool for deploying, managing, and scaling NKP clusters, including creating bootstrap clusters, deploying clusters, and managing platform applications. In an air-gapped setup, the nkp CLI is critical for executing deployment commands using the Air-Gapped Bundle.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For an air-gapped NKP deployment, ensure the bastion host has kubectl and the nkp CLI installed to manage the deployment process and interact with the resulting Kubernetes clusters.” These tools are sufficient for the engineer to deploy and operate NKP in an isolated environment.

Incorrect Options:

A. awscli and nkp: The awscli is specific to AWS environments, but the question does not specify AWS infrastructure. Additionally, in an isolated environment, awscli is less relevant without Internet access.

B. oc and kubectl: oc is the OpenShift CLI, not used for NKP deployments. NKP uses nkp CLI instead.

C. oc and az: az is the Azure CLI, and oc is for OpenShift—neither is relevant to NKP deployment.

For creating custom images for vSphere (and other supported platforms), Konvoy Image Builder (KIB) is the officially supported tool for NKP. It can create images with custom configurations, package versions, and pre-bundled artifacts.

Key Reference:

“Konvoy Image Builder (KIB) is the Nutanix-recommended tool for building NKP cluster node images for vSphere, AWS, Azure, and other environments.”

The NKPA course recommends using a S3-compatible API for backup and restore operations in production NKP environments, as it integrates with Velero, NKP’s backup and restore tool. Velero supports S3-compatible storage (e.g., AWS S3, Nutanix Objects, or MinIO) as a backup storage location, allowing persistent data, including volumes and cluster resources, to be backed up and restored during disaster recovery scenarios. This approach ensures compatibility with cloud-native backup workflows and provides scalability and reliability for production use cases.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For production backup and restore in NKP, use Velero with an S3-compatible API to store backups, ensuring persistent data availability during disaster recovery.” Nutanix Objects, which provides an S3-compatible API, is often used in Nutanix environments for this purpose, but any S3-compatible storage (e.g., an off-site S3 bucket) can be configured.

Incorrect Options:

A. Protection Domain: Protection Domains are a Nutanix AOS feature for VM-level replication, not for Kubernetes backup/restore.

B. Rook Ceph: Rook Ceph provides persistent storage for NKP clusters but is not a backup solution; it can be backed up using Velero with S3 storage.

C. External Storage Class: Storage Classes define how volumes are provisioned, not how they are backed up or restored.

NKP Platform Applications (e.g., Rook Ceph, Prometheus, Fluent Bit) are pre-integrated tools that can be deployed to Kubernetes clusters within a workspace to provide services like storage, monitoring, and logging. The NKPA course specifies that to deploy a platform application to all clusters in a workspace from the command line, the engineer uses the nkp create appdeployment command. This command creates an application deployment resource that targets the specified workspace and clusters.

The required parameters include the application ID (to identify the platform application), the version (to specify the desired version of the application), and the NKP workspace (to define the scope of clusters). For example: nkp create appdeployment --app-id prometheus --version 2.30.0 --workspace fin-vd. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Use the nkp create appdeployment command to deploy platform applications, specifying the application ID, version, and target workspace to apply the deployment across all clusters in that workspace.”

Incorrect Options:

B. nkp deploy platform-app: This is not a valid NKP command. The correct command is nkp create appdeployment.

C. nkp deploy app: This is not a recognized command in the NKPA documentation.

D. kubectl create appdeployment: kubectl interacts with Kubernetes resources, not NKP-specific platform applications.