NCP-CN Questions and Answers

For deploying NKP clusters in AWS, setting the AWS_REGION environment variable is a key prerequisite to ensure that the AWS CLI and underlying deployment scripts know which region to target. This is essential for provisioning instances using the specified AMI.

Exact extract:

“Set the AWS_REGION environment variable to the appropriate region prior to deploying clusters to ensure proper interaction with the AWS API.”

According to the NKPA 6.10 documentation under “Air-Gapped Preparation with Konvoy Image Builder,” the konvoy-image upload command uploads essential artifacts to the target servers to prepare them to serve as cluster nodes. These artifacts include:

Container runtime (containerd)

OS bundle

Kubernetes components

It does not involve user creation or OS hardening scripts (those are separate, client-driven processes).

Key reference from documentation:

“The konvoy-image upload command uploads the required artifacts to the target server(s) to prepare them for Kubernetes deployment in air-gapped environments. This includes the container runtime, OS bundle, and Kubernetes binaries.”

The NKPA course details the process of creating an NKP cluster on vSphere using the NKP CLI, including the configuration of multiple node pools with specific worker node counts and CPU settings. The correct approach involves creating the cluster with the initial node pool and then adding additional node pools separately.

The steps in Option A align with this process:

nkp create cluster vsphere --worker-replicas 6 --worker-cpus 10: This command creates the NKP cluster on vSphere with the first node pool, consisting of 6 worker nodes, each with 10 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 8: This adds the second node pool to the cluster with 3 worker nodes, each with 8 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 6: This adds the third node pool with 3 worker nodes, each with 6 CPUs.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To create an NKP cluster with multiple node pools on vSphere, use nkp create cluster vsphere to define the first node pool, then add additional node pools with nkp create nodepool vsphere, specifying --worker-replicas and --worker-cpus for each pool.” This method ensures precise control over each node pool’s configuration.

Incorrect Options:

B: The second nkp create nodepool command uses --replicas and --cpus, which are not the correct flags. The NKPA course specifies --worker-replicas and --worker-cpus.

C: The --node-pools, --worker-replicas 6,3,3, and --worker-cpus 10,8,6 flags are not supported in a single nkp create cluster command. Node pools must be created separately.

D: There is no nkp create nodepools command; the correct command is nkp create nodepool. Additionally, --replicas and --cpus are incorrect flags.

According to the NKPA 6.10 documentation, licensing in an NKP cluster is constrained by the total number of vCPUs assigned to all nodes (workers and control planes). In this scenario, the cluster has a maximum of 150 vCPUs available.

The existing output shows 10 worker nodes, each with 8 vCPUs (10×8=80 vCPUs) and 3 control plane nodes, each with 4 vCPUs (3×4=12 vCPUs).

Current vCPU usage: 80 + 12 = 92 vCPUs.

Remaining vCPUs: 150 - 92 = 58 vCPUs.

Option A:

Adding 6 control plane nodes (6×4=24 vCPUs).

This would increase control planes to 9 total (3 existing + 6 new). Control plane nodes would consume 9×4=36 vCPUs.

Worker nodes remain at 80 vCPUs.

Total vCPU usage: 36 + 80 = 116 vCPUs (still under 150 vCPUs).

However, it’s unusual and unnecessary to have 9 control planes in a typical NKP setup. NKPA and NCP-CN best practices indicate typically no more than 3 or 5 control planes for HA. Therefore, this is technically possible but not recommended or standard practice. So not selected.

Option B:

Expanding the existing worker nodepool by 8 nodes (8×8=64 vCPUs).

This would add 64 vCPUs to the current 92 vCPUs:

92 + 64 = 156 vCPUs → exceeds licensing limit.

Correction: The question specifies “expand up to 8 nodes,” so it’s possible to expand by only 7 nodes (7×8=56 vCPUs).

92 + 56 = 148 vCPUs → within licensing limits.

Thus, expanding by up to 7 nodes is valid.

Option C:

Creating a new worker nodepool with 10 nodes (10×8=80 vCPUs).

This would add 80 vCPUs to the existing 92 vCPUs:

92 + 80 = 172 vCPUs → exceeds 150 vCPU licensing limit.

Not valid.

Option D:

Expanding the original worker nodepool by up to 4 nodes (4×8=32 vCPUs) = +32 vCPUs.

Adding a new nodepool of 6 nodes with 4 vCPUs/node (6×4=24 vCPUs) = +24 vCPUs.

Total increase: 32 + 24 = 56 vCPUs.

Total vCPU usage: 92 + 56 = 148 vCPUs → within the 150 vCPU limit.

Thus, valid.

Extract Reference:

NKPA 6.10 – “Cluster Sizing and Licensing”

Nutanix Kubernetes Platform Administration (NKPA) – Licensing Considerations

"The total number of vCPUs for all nodes (control planes and workers) must not exceed the licensed vCPU capacity of the NKP deployment."

This confirms that Options B and D are the two valid approaches to expand the cluster while remaining compliant with licensing constraints.

The Nutanix Kubernetes Platform (NKP) leverages Cluster API (CAPI) to manage the lifecycle of Kubernetes clusters. When preparing machine images for NKP deployment, the Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) process is used to create custom machine images that are compatible with NKP’s infrastructure requirements. According to the NKPA course, the primary purpose of this process is to create CAPI-compliant images that can be used as the base for NKP cluster nodes.

The NKPA course explains that NKP uses CAPI to provision and manage Kubernetes clusters, and CAPI requires machine images that meet specific criteria, such as including the necessary Kubernetes components, container runtimes, and operating system configurations. The NIB/KIB process ensures that the images are pre-configured with these components, making them suitable for use as NKP worker and control plane nodes. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images that include the required OS, Kubernetes binaries, and dependencies for NKP cluster nodes.”

These images are typically based on supported operating systems like Rocky Linux or Ubuntu, as provided by Nutanix, and are customized to include the container runtime (e.g., containerd), kubeadm, and other dependencies required for CAPI-based cluster provisioning. The resulting images are stored in a location accessible to the NKP deployment process, such as a local registry or Nutanix Prism Central.

Incorrect Options:

A. Hardening an OS image with client-supplied hardening scripts: While hardening the OS is a good practice, it is not the primary purpose of the NIB/KIB process. The NKPA course notes that hardening can be applied as part of image customization, but the core goal is to ensure CAPI compliance, not just hardening.

B. Creating a custom user account for NKP admins to ensure access to NKP nodes: The NIB/KIB process does not focus on creating user accounts. User access is managed through Kubernetes RBAC or external identity providers, as covered in the NKPA course’s authentication section.

C. Tagging the image to be used specifically for NKP: Tagging may occur as part of image management, but it is not the primary purpose. The NKPA course emphasizes CAPI compliance over tagging.

To push the NKP Catalog Applications image bundle to a private registry, the official nkp push bundle command must be used with the specified parameters to authenticate and push the bundle to the registry.

Exact extract:

“Use the nkp push bundle command to upload the NKP catalog applications image bundle to the specified private registry, ensuring secure and complete image upload.”

The NKPA course outlines the default behaviors of NKP when deploying workload clusters within a workspace, regardless of the provisioning environment (e.g., AWS, Nutanix, Azure). When a workload cluster is deployed in AWS, NKP ensures consistency across the workspace by applying the following default behaviors:

The NKP workload cluster will receive all of the GitOps sources that have been assigned to the NKP workspace (Option A): NKP uses GitOps with Flux to manage cluster configurations and applications. The course explains that GitOps sources (e.g., Git repositories) assigned to a workspace are automatically applied to all clusters in that workspace, ensuring consistent configuration and application deployment. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “New workload clusters inherit all GitOps sources configured for the workspace, enabling Flux to synchronize configurations from the specified repositories.”

The NKP workload cluster will be deployed all of the applications that have been enabled on this NKP workspace (Option D): NKP Platform Applications (e.g., Prometheus, Rook Ceph) enabled in the workspace are automatically deployed to new workload clusters. The NKPA course notes: “When a workload cluster is created, NKP deploys all platform applications enabled in the workspace to ensure consistent functionality across clusters.”

Incorrect Options:

B. The NKP workload cluster will receive all of the NKP RBAC policy: RBAC policies are defined at the workspace or project level and applied to users or groups, not automatically to clusters. Clusters inherit RBAC through user access, not as a default deployment behavior.

C. The NKP workload cluster will also be assigned to all of the NKP projects: Clusters are assigned to specific projects manually, not automatically to all projects in a workspace.

According to the NKPA 6.10 documentation, Rook Ceph is the recommended out-of-the-box storage solution integrated with NKP for persistent data storage, backups, and object storage within the Kubernetes environment.

Key Reference:

“Rook Ceph is integrated with NKP for providing persistent storage and backup support within the cluster.”

The NKPA course explains that by default, NKP creates new AWS infrastructure (VPC, subnets, ELBs) when deploying a cluster on AWS. However, NKP supports deploying clusters on existing AWS infrastructure by providing custom configurations. The recommended method using the NKP CLI is to create an overrides file specifying the pre-existing VPC, subnets, and ELB, and then pass this file to the nkp create cluster aws command using the --overrides parameter.

The overrides file (e.g., aws-infra-overrides.yaml) contains details like vpcID, subnetIDs, and loadBalancerIDs, which NKP uses to deploy the cluster on the specified infrastructure instead of creating new resources. For example:

yaml

CollapseWrap

Copy

aws:

vpcID: vpc-12345678

subnetIDs:

- subnet-12345678

- subnet-87654321

loadBalancerIDs:

- elb-12345678

The engineer then runs: nkp create cluster aws --overrides aws-infra-overrides.yaml.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy an NKP cluster on existing AWS infrastructure, create an overrides file with the pre-existing VPC, subnets, and ELB details, and use the --overrides parameter with the nkp create cluster aws command to apply the custom configuration.” This method ensures the AWS team’s requirement is met while leveraging NKP’s CLI for deployment.

Incorrect Options:

A. nkp adopt infrastructure aws: There is no nkp adopt infrastructure command in NKP for this purpose.

C. Use the NKP UI: While the UI allows specifying infrastructure details, the question focuses on the CLI-based deployment, and the UI method is less relevant here.

D. Include parameters directly in nkp create cluster aws: The nkp create cluster aws command does not support direct parameters for VPC, subnets, and ELB; it requires an overrides file.

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

The NKPA 6.10 documentation outlines that in air-gapped environments where default pod network CIDR conflicts exist, the cluster manifest (created via the nkp create cluster command) should be updated to specify an alternate, non-conflicting pod CIDR block range before deployment.

The NKPA course details the default node preparation process for NKP cluster nodes, which involves creating a machine image that is compliant with Cluster API (CAPI) standards. The primary tool used in this process is Packer, which automates the creation of machine images by provisioning a base OS image (e.g., Ubuntu or Rocky Linux) with the necessary components for Kubernetes, such as kubeadm, containerd, and other dependencies.

Packer ensures the image is CAPI-compliant by installing the required Kubernetes binaries, configuring the container runtime, and setting up networking and storage components. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In the default node preparation process for NKP, Packer is used to build a CAPI-compliant OS image, installing Kubernetes components and dependencies for use as an NKP node.” This process is typically orchestrated by NKP Image Builder (NIB) or Kubernetes Image Builder (KIB), both of which rely on Packer for image creation.

Incorrect Options:

B. Ansible is used to make the OS image CAPI-compliant: Ansible is used by KIB/NIB to apply configurations during the Packer build process, but Packer is the primary tool for creating the image. Ansible alone does not make the image CAPI-compliant.

C. Goss is used to harden the OS image: Goss is a validation tool that can be used for image hardening, but it is not part of the default NKP node preparation process. Hardening is an optional step.

D. Terraform is utilized to clone an existing OS image: Terraform is for infrastructure provisioning, not image creation or cloning. Packer handles image creation in NKP.

The NKPA course recommends using a S3-compatible API for backup and restore operations in production NKP environments, as it integrates with Velero, NKP’s backup and restore tool. Velero supports S3-compatible storage (e.g., AWS S3, Nutanix Objects, or MinIO) as a backup storage location, allowing persistent data, including volumes and cluster resources, to be backed up and restored during disaster recovery scenarios. This approach ensures compatibility with cloud-native backup workflows and provides scalability and reliability for production use cases.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For production backup and restore in NKP, use Velero with an S3-compatible API to store backups, ensuring persistent data availability during disaster recovery.” Nutanix Objects, which provides an S3-compatible API, is often used in Nutanix environments for this purpose, but any S3-compatible storage (e.g., an off-site S3 bucket) can be configured.

Incorrect Options:

A. Protection Domain: Protection Domains are a Nutanix AOS feature for VM-level replication, not for Kubernetes backup/restore.

B. Rook Ceph: Rook Ceph provides persistent storage for NKP clusters but is not a backup solution; it can be backed up using Velero with S3 storage.

C. External Storage Class: Storage Classes define how volumes are provisioned, not how they are backed up or restored.

For deployments in air-gapped environments where there is no external Internet connectivity, the --airgapped parameter is required. This instructs the NKP deployment to rely solely on internal resources, using pre-staged images and local container registries, ensuring that no external network dependencies cause deployment failures.

As outlined in the NKPA 6.10 documentation under "Customizing Resource Requests and Limits for Logging," to override the default resource values for the logging operator, a ConfigMap named logging-operator-logging-overrides in the kommander namespace is used. The values.yaml in the ConfigMap should precisely define fluentd resource limits and requests in a valid YAML format.

The correct YAML format is:

yaml

Copy

apiVersion: v1

kind: ConfigMap

metadata:

name: logging-operator-logging-overrides

namespace: kommander

data:

values.yaml: |

fluentd:

resources:

limits:

cpu: 4

memory: 4Gi

requests:

cpu: 4

memory: 4Gi

This ensures that the desired CPU and memory resources are correctly applied for the fluentd daemon, avoiding parsing errors and meeting the high-demand logging needs.

NKPA 6.10 recommends leveraging workspaces to isolate different tenants (clients) in a multi-tenant environment. LDAP connectors can be scoped to individual workspaces, allowing separate authentication and RBAC configurations per client.

Key reference from documentation:

“In multi-tenant scenarios, create a dedicated workspace for each tenant and configure a unique LDAP connector within that workspace to integrate their identity source.”

As per the NKPA 6.10 documentation, the standard and supported approach for installing Kommander on an NKP cluster is using the NKP CLI. The CLI provides commands for deploying Kommander and associated platform components as part of the cluster lifecycle management workflow.

Key Reference:

“The recommended approach to deploy Kommander is by using the nkp CLI, which ensures compatibility and streamlined installation with the rest of the Nutanix Kubernetes Platform stack.”

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image, include both the offline fips and fips overrides to ensure the image and components are built in compliance.

When deploying the cluster, include FIPS-specific references for both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

According to the NKPA 6.10 documentation, the critical system components for NKP nodes are:

kubelet

containerdThese components are deployed in the standard Linux path: /var/lib.

Exact extract from the documentation:

“The kubelet and containerd services require disk space in /var/lib on the host operating system. It’s essential to allocate sufficient storage in /var/lib to accommodate these core Kubernetes components.”

The NKPA course specifies that air-gapped deployments and centralized fleet management of multiple clusters are advanced features of NKP, requiring the NKP Ultimate license tier. The Ultimate tier includes support for air-gapped environments (via Air-Gapped Bundles) and fleet management capabilities, such as attaching and managing multiple clusters under a single management plane, which is critical for the national defense company’s scenario.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The NKP Ultimate license tier is required for air-gapped deployments and centralized management of multiple Kubernetes clusters, providing the necessary tools for secure, isolated environments.” This ensures the company can deploy and manage their three clusters in an air-gapped setup while maintaining strict data security.

Incorrect Options:

A. NKP Starter: The Starter tier lacks air-gapped and fleet management features.

C. NKP Pro: The Pro tier may support some advanced features but not air-gapped deployments or full fleet management.

D. NKP UI: This is not a license tier; it’s a UI component of NKP.

NKP uses the Cluster Autoscaler to scale worker node replicas up or down. This ensures that resource availability dynamically matches workload demand by adjusting the number of worker nodes. Pod-level autoscaling (Horizontal-Pod autoscaler) is also supported for pod scaling but is not responsible for node pool expansion or compaction.

Key Reference:

“NKP uses the Cluster Autoscaler to dynamically adjust worker node pool replicas in response to cluster resource demands.”

The error states:

pgsql

Copy

error upgrading CAPI components: unable to upgrade CAPI components: deployment "capp-controller-manager" is not ready after 10m0s: failed to connect to the management cluster: context deadline exceeded

This clearly points to connectivity issues between the VM (or nodes) and the management cluster, typically caused by registry communication issues in air-gapped or private environments. When the VM cannot connect to the registry to pull required images or configuration, the CAPI (Cluster API) components cannot be initialized, causing a timeout.

Key Reference:

Nutanix Kubernetes Platform Administration (NKPA) 6.10 – “Air-Gapped and Registry Communication Issues”

NCP-CN 6.10 Study Guide – “Cluster API Upgrade Process and Network Prerequisites”

=======

When attaching an Amazon EKS cluster to NKP for fleet management, persistent volume (PV) errors during application deployments often indicate issues with storage configuration. The NKPA course identifies a common cause: the absence of a default StorageClass. Kubernetes requires a default StorageClass to automatically provision PVs for PersistentVolumeClaims (PVCs) when none is specified. Without a default, applications fail to bind PVCs, resulting in deployment errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For attached EKS clusters, ensure a default StorageClass is configured to support dynamic provisioning of persistent volumes. Review existing StorageClasses and set one as default using the storageclass.kubernetes.io/is-default-class annotation.” The engineer should run kubectl get storageclass to list available StorageClasses, verify their configurations, and set one as default by patching it with kubectl patch storageclass -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'. In EKS, the default StorageClass is typically backed by Amazon EBS (e.g., gp2 or gp3).

Incorrect Options:

A. The storage appliance is having issues: This assumes a hardware issue, which is not indicated by PV errors. The NKPA course suggests checking Kubernetes configurations first.

B. There is no compatible storage: EKS supports EBS and EFS, which are compatible with NKP. The issue is likely configuration, not compatibility.

D. There could be a misconfiguration in the ConfigMap: ConfigMaps are not directly related to PV provisioning. The NKPA course points to StorageClass issues for PV errors.

According to the NKPA 6.10 documentation and Nutanix licensing details, NKP Starter is bundled with the NCI Starter entitlement. This basic licensing tier includes essential capabilities for deploying and managing Kubernetes clusters within a Nutanix environment.

Key reference:

“NKP Starter is included with NCI Starter, providing foundational Kubernetes cluster lifecycle management features for small-scale or starter deployments.”

The Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images for NKP cluster nodes, often leveraging tools like Packer to build AMIs for AWS. When the KIB process fails, troubleshooting requires detailed logs to identify the root cause. The NKPA course recommends increasing the verbosity of the KIB command to capture detailed output, including AWS CLI commands and their responses.

The correct troubleshooting step is to rerun the KIB command with the verbosity level set to debug. This is typically done using the --verbose or -v flag (e.g., -v debug) to enable debug-level logging, which includes all AWS CLI commands, their outputs, and errors, written to a log file for review. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To troubleshoot KIB failures, rerun the command with debug verbosity (-v debug) to log all operations, including AWS CLI interactions, to an exported log file for detailed analysis.” This approach helps pinpoint issues like permission errors, misconfigurations, or failures in image bundle uploads.

Incorrect Options:

A. Rerun with pause parameter: KIB does not support a pause parameter for step-by-step review, as per the NKPA course.

C. Instruct Packer not to delete the cloned AMI: While preserving the AMI can help, the course prioritizes debug logging for initial troubleshooting. Packer’s --on-error=abort flag exists, but it’s less direct than debug logs.

D. Instruct Ansible not to delete the cloned AMI: KIB primarily uses Packer, not Ansible, for AMI creation, making this option incorrect.

The NKPA course explains that NKP supports auto-scaling for clusters using Cluster API (CAPI), which manages the lifecycle of Kubernetes nodes. When auto-scaling is enabled, NKP monitors cluster workloads and automatically adjusts the number of nodes based on demand. The behavior involves CAPI creating or deleting nodes as needed to scale the cluster up or down, ensuring optimal resource utilization.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP auto-scaling uses Cluster API to dynamically create or delete nodes in response to workload demands, ensuring the cluster scales efficiently.” For example, if the workload increases, CAPI provisions additional worker nodes; if demand decreases, CAPI deletes nodes to reduce costs.

Incorrect Options:

A. CPU is hot-added or hot-removed: Hot-adding/removing CPU is not a Kubernetes auto-scaling behavior; scaling involves adding/removing nodes.

B. Memory is hot-added or hot-removed: Similar to CPU, memory scaling at the node level is not supported in this context.

C. Power-On Status/Mode of a node is changed: Auto-scaling does not involve changing node power states; it adds or removes nodes.

The NKPA course specifies that the NKP CLI is the primary tool for deploying NKP clusters with advanced configurations, such as those required for a dark site environment, custom Service and Pod CIDR blocks, and Nutanix AHV clusters. The NKP CLI (nkp) provides granular control over cluster creation, allowing administrators to specify custom networking parameters and air-gapped deployment settings via command-line flags or configuration files.

For a dark site deployment, the NKP CLI uses an Air-Gapped Bundle to provide all necessary dependencies. Custom CIDR blocks are configured using flags like --service-cidr and --pod-cidr during the nkp create cluster command. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The NKP CLI is used to deploy clusters with custom configurations, including dark site readiness and custom networking, on Nutanix AHV clusters.” For example: nkp create cluster --air-gapped --service-cidr 10.96.0.0/12 --pod-cidr 192.168.0.0/16 --infrastructure nutanix-ahv.

Incorrect Options:

A. kubectl CLI: kubectl manages Kubernetes resources, not NKP cluster deployment.

B. NKP GUI: The GUI supports basic deployments but lacks the flexibility for custom CIDR and dark site configurations.

D. OCP CLI: OpenShift (OCP) is a separate platform, not used for NKP deployments.