NCP-CN Questions and Answers

The NKPA course specifies that air-gapped deployments and centralized fleet management of multiple clusters are advanced features of NKP, requiring theNKP Ultimatelicense tier. The Ultimate tier includes support for air-gapped environments (via Air-Gapped Bundles) and fleet management capabilities, such as attaching and managing multiple clusters under a single management plane, which is critical for the national defense company’s scenario.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The NKP Ultimate license tier is required for air-gapped deployments and centralized management of multiple Kubernetes clusters, providing the necessary tools for secure, isolated environments.” This ensures the company can deploy and manage their three clusters in an air-gapped setup while maintaining strict data security.

Incorrect Options:

A. NKP Starter: The Starter tier lacks air-gapped and fleet management features.

C. NKP Pro: The Pro tier may support some advanced features but not air-gapped deployments or full fleet management.

D. NKP UI: This is not a license tier; it’s a UI component of NKP.

According to theNKPA 6.10 documentation, licensing in an NKP cluster is constrained by the total number of vCPUs assigned to all nodes (workers and control planes). In this scenario, the cluster has a maximum of 150 vCPUs available.

The existing output shows 10 worker nodes, each with 8 vCPUs (10×8=80 vCPUs) and 3 control plane nodes, each with 4 vCPUs (3×4=12 vCPUs).

Current vCPU usage: 80 + 12 = 92 vCPUs.

Remaining vCPUs: 150 - 92 = 58 vCPUs.

Option A:

Adding 6 control plane nodes (6×4=24 vCPUs).

This would increase control planes to 9 total (3 existing + 6 new). Control plane nodes would consume 9×4=36 vCPUs.

Worker nodes remain at 80 vCPUs.

Total vCPU usage: 36 + 80 = 116 vCPUs (still under 150 vCPUs).

However, it’s unusual and unnecessary to have 9 control planes in a typical NKP setup. NKPA and NCP-CN best practices indicate typically no more than 3 or 5 control planes for HA. Therefore, this is technically possible but not recommended or standard practice. So not selected.

Option B:

Expanding the existing worker nodepool by 8 nodes (8×8=64 vCPUs).

This would add 64 vCPUs to the current 92 vCPUs:

92 + 64 = 156 vCPUs → exceeds licensing limit.

Correction:The question specifies “expand up to 8 nodes,” so it’s possible to expand by only 7 nodes (7×8=56 vCPUs).

92 + 56 = 148 vCPUs → within licensing limits.

Thus, expanding byup to 7 nodesis valid.

Option C:

Creating a new worker nodepool with 10 nodes (10×8=80 vCPUs).

This would add 80 vCPUs to the existing 92 vCPUs:

92 + 80 = 172 vCPUs → exceeds 150 vCPU licensing limit.

Not valid.

Option D:

Expanding the original worker nodepool by up to 4 nodes (4×8=32 vCPUs) = +32 vCPUs.

Adding a new nodepool of 6 nodes with 4 vCPUs/node (6×4=24 vCPUs) = +24 vCPUs.

Total increase: 32 + 24 = 56 vCPUs.

Total vCPU usage: 92 + 56 = 148 vCPUs → within the 150 vCPU limit.

Thus, valid.

Extract Reference:

NKPA 6.10– “Cluster Sizing and Licensing”

Nutanix Kubernetes Platform Administration (NKPA) – Licensing Considerations

"The total number of vCPUs for all nodes (control planes and workers) must not exceed the licensed vCPU capacity of the NKP deployment."

This confirms thatOptions B and Dare the two valid approaches to expand the cluster while remaining compliant with licensing constraints.

The documentation confirms that when a new license is activated to upgrade to a higher tier, users mustlog out and log back infor the license changes to take effect. This ensures that updated entitlements are loaded into the UI and CLI environment.

Exact extract from documentation:

“After applying a new license for a higher-tier product, log out and log back in to see and activate the newly available features.”

The NKPA course recommends using aS3-compatible APIfor backup and restore operations in production NKP environments, as it integrates with Velero, NKP’s backup and restore tool. Velero supports S3-compatible storage (e.g., AWS S3, Nutanix Objects, or MinIO) as a backup storage location, allowing persistent data, including volumes and cluster resources, to be backed up and restored during disaster recovery scenarios. This approach ensures compatibility with cloud-native backup workflows and provides scalability and reliability for production use cases.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For production backup and restore in NKP, use Velero with an S3-compatible API to store backups, ensuring persistent data availability during disaster recovery.” Nutanix Objects, which provides an S3-compatible API, is often used in Nutanix environments for this purpose, but any S3-compatible storage (e.g., an off-site S3 bucket) can be configured.

Incorrect Options:

A. Protection Domain: Protection Domains are a Nutanix AOS feature for VM-level replication, not for Kubernetes backup/restore.

B. Rook Ceph: Rook Ceph provides persistent storage for NKP clusters but is not a backup solution; it can be backed up using Velero with S3 storage.

C. External Storage Class: Storage Classes define how volumes are provisioned, not how they are backed up or restored.

TheNKPA 6.10 documentationconfirms thatworkspacesin NKP are used to logically group and standardize configurations across multiple clusters. By creating aproduction workspaceand adevelopment workspace, the organization can control and enforce standardized configurations and policies for all relevant clusters.

Exact extract:

“Workspaces provide logical separation for resources, configuration, and policy management across multiple clusters, enabling standardized operations.”

The NKPA course explains that by default, NKP creates new AWS infrastructure (VPC, subnets, ELBs) when deploying a cluster on AWS. However, NKP supports deploying clusters on existing AWS infrastructure by providing custom configurations. The recommended method using the NKP CLI is tocreate an overrides filespecifying the pre-existing VPC, subnets, and ELB, and then pass this file to the nkp create cluster aws command using the --overrides parameter.

The overrides file (e.g., aws-infra-overrides.yaml) contains details like vpcID, subnetIDs, and loadBalancerIDs, which NKP uses to deploy the cluster on the specified infrastructure instead of creating new resources. For example:

yaml

CollapseWrap

Copy

aws:

vpcID: vpc-12345678

subnetIDs:

- subnet-12345678

- subnet-87654321

loadBalancerIDs:

- elb-12345678

The engineer then runs: nkp create cluster aws --overrides aws-infra-overrides.yaml.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy an NKP cluster on existing AWS infrastructure, create an overrides file with the pre-existing VPC, subnets, and ELB details, and use the --overrides parameter with the nkp create cluster aws command to apply the custom configuration.” This method ensures the AWS team’s requirement is met while leveraging NKP’s CLI for deployment.

Incorrect Options:

A. nkp adopt infrastructure aws: There is no nkp adopt infrastructure command in NKP for this purpose.

C. Use the NKP UI: While the UI allows specifying infrastructure details, the question focuses on the CLI-based deployment, and the UI method is less relevant here.

D. Include parameters directly in nkp create cluster aws: The nkp create cluster aws command does not support direct parameters for VPC, subnets, and ELB; it requires an overrides file.

According to theNKPA 6.10 documentation, theFIPS Compliant Build featureis exclusively available forEnterprise tierlicensing. This ensures compliance with NIST security standards and provides hardened cryptographic capabilities throughout the Kubernetes cluster stack.

Exact extract from documentation:

“The FIPS-compliant build feature is included in the NKP Enterprise tier, enabling deployments in environments that require strict security compliance.”

The exhibit shows a YAML manifest for a NodeGroup resource that has autoscaler-related annotations:

yaml

Copy

cluster.x-k8s.io/cluster-api-autoscaler-node-group-min-size: "3"

cluster.x-k8s.io/cluster-api-autoscaler-node-group-max-size: "15"

According to theNKPA 6.10 documentation, these annotations configure theminimumandmaximumnumber of nodes for the autoscaler in the specified NodeGroup. The autoscaler will ensure the number of nodes never goes below the minimum (3) and never exceeds the maximum (15).

Key Reference:

"The cluster-autoscaler will scale the NodeGroup up to the maximum size and down to the minimum size based on workload requirements."

As outlined in theNKPA 6.10 documentation,Gossis used tovalidatethat an OS image meets the requirements to serve as an NKP node (such as the presence of required packages, kernel modules, and system settings). Goss is not used to modify or harden the image; rather, it validates conformance.

Key reference:

“During the image build process, Goss tests validate that the image meets the required standards for use as a Kubernetes node in NKP deployments.”

When deploying NKP to AWS, the bootstrap process requires AWS credentials to interact with AWS APIs for provisioning resources like EC2 instances. The NKPA course specifies that the nkp CLI supports the --aws-profile flag to specify a custom AWS profile for authentication. This profile, defined in the AWS credentials file (~/.aws/credentials), contains the access key and secret key for the desired AWS account.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy NKP on AWS with custom credentials, use the --aws-profile= flag during the nkp create bootstrap command to reference a specific AWS profile.” This approach leverages the AWS CLI’s profile management, ensuring secure and flexible credential handling. For example, the command would be nkp create bootstrap --aws-profile=my-profile --kubeconfig bootstrap-cluster.conf.

Incorrect Options:

B. --cloud-credentials=<my-profile></my-profile>: This flag is not used by the nkp CLI. The NKPA course specifies --aws-profile for AWS.

C. --with-aws-bootstrap-credentials=true: This flag does not exist in the NKPA documentation for NKP bootstrap.

D. --aws-access-key=<aws access="" key=""> --aws-secret-key=<aws secret="" key=""></aws></aws>: While these flags may be used in some tools, the NKPA course recommends using --aws-profile to avoid hardcoding sensitive credentials.

TheNKPA 6.10 documentationand Nutanix Best Practices recommend using workspaces to segment cluster deployments and their associated infrastructure providers, as well as to manage access control through RBAC. The typical workflow is:

Create an NKP workspace dedicated to the R&D environment.

Create an infrastructure provider (e.g., vSphere, AHV) scoped to that workspace.

Create an NKP group for the R&D team and assign admin roles to this group within the workspace.

Deploy workload clusters in this workspace, leveraging the scoped infrastructure provider.

This ensures that:

The R&D team has full administrative control over their resources.

Clusters and infrastructure are logically isolated in the R&D workspace.

RBAC policies are applied cleanly within the workspace context.

As stated in theNKPA 6.10 documentation, when using external storage (such as AWS S3) withLokifor log storage, AWS credentials must be provided securely. This typically involves creating a KubernetesSecretcontaining the static AWS credentials (access key ID and secret access key), which are referenced in the override ConfigMap to authenticate Loki’s S3 storage backend.

Key reference from documentation:

“For Loki to store logs in an S3 bucket, AWS credentials must be created as a Kubernetes secret and referenced in the storage configuration.”

The NKPA course specifies the supported operating systems for NKP clusters deployed using the Nutanix provisioning method (CAPX), which leverages Cluster API for Nutanix (CAPX) to provision clusters on Nutanix AHV. The supported OS platforms for CAPX areRocky LinuxandUbuntu, as these distributions are tested and optimized for Nutanix infrastructure and Kubernetes requirements.

Rocky Linux is a CentOS replacement adopted by Nutanix after CentOS 8’s end-of-life in 2021, providing a stable, enterprise-grade OS. Ubuntu, particularly LTS versions like 20.04 or 22.04, is widely supported due to its compatibility with Kubernetes and Nutanix AHV. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “When deploying NKP with the Nutanix provisioning method (CAPX), the supported OS platforms are Rocky Linux and Ubuntu, ensuring compatibility with Nutanix AHV and Kubernetes.” These OS images are typically prepared using NKP Image Builder (NIB) to include necessary components like kubeadm and containerd.

Incorrect Options:

A. CentOS and Rocky Linux: CentOS 8 is no longer supported post-2021, and Nutanix has shifted to Rocky Linux.

C. Flatcar, Rocky Linux, and Ubuntu: Flatcar Container Linux is not a supported OS for CAPX in NKP deployments.

D. CentOS and Ubuntu: CentOS is not supported, as noted above.

The Nutanix Kubernetes Platform (NKP) leverages Cluster API (CAPI) to manage the lifecycle of Kubernetes clusters. When preparing machine images for NKP deployment, the Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) process is used to create custom machine images that are compatible with NKP’s infrastructure requirements. According to the NKPA course, the primary purpose of this process is to createCAPI-compliant imagesthat can be used as the base for NKP cluster nodes.

The NKPA course explains that NKP uses CAPI to provision and manage Kubernetes clusters, and CAPI requires machine images that meet specific criteria, such as including the necessary Kubernetes components, container runtimes, and operating system configurations. The NIB/KIB process ensures that the images are pre-configured with these components, making them suitable for use as NKP worker and control plane nodes. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images that include the required OS, Kubernetes binaries, and dependencies for NKP cluster nodes.”

These images are typically based on supported operating systems like Rocky Linux or Ubuntu, as provided by Nutanix, and are customized to include the container runtime (e.g., containerd), kubeadm, and other dependencies required for CAPI-based cluster provisioning. The resulting images are stored in a location accessible to the NKP deployment process, such as a local registry or Nutanix Prism Central.

Incorrect Options:

A. Hardening an OS image with client-supplied hardening scripts: While hardening the OS is a good practice, it is not the primary purpose of the NIB/KIB process. The NKPA course notes that hardening can be applied as part of image customization, but the core goal is to ensure CAPI compliance, not just hardening.

B. Creating a custom user account for NKP admins to ensure access to NKP nodes: The NIB/KIB process does not focus on creating user accounts. User access is managed through Kubernetes RBAC or external identity providers, as covered in the NKPA course’s authentication section.

C. Tagging the image to be used specifically for NKP: Tagging may occur as part of image management, but it is not the primary purpose. The NKPA course emphasizes CAPI compliance over tagging.

In an air-gapped NKP deployment, the Konvoy bootstrap image (used to create the bootstrap cluster) must be available locally on the bastion host or in a private registry. The NKPA course specifies that after extracting the NKP Air-Gapped Bundle, the bootstrap image (e.g., konvoy-bootstrap-image-.tar) is a tarball that needs to be loaded into the Docker daemon on the bastion host before creating the bootstrap cluster.

The most viable command isdocker load -i konvoy-bootstrap-image-<version>.tar(Option A). This command loads the tarball into the local Docker daemon on the bastion host, making the image available for the nkp create bootstrap command to use. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “In an air-gapped environment, load the Konvoy bootstrap image on the bastion host using docker load -i to make it available for creating the bootstrap cluster.” After loading, the engineer can optionally tag and push the image to the private registry if needed, but the question focuses on loading the image on the host, which this command accomplishes.

Incorrect Options:

B. docker image tag: This command is syntactically incorrect (version appears twice, and .tar is not part of a tag). Tagging is a subsequent step after loading, not the primary action to load the image.

C. nkp push bundle: This is not a valid command for loading an image; it’s closer to a bundle management action, but the syntax is incorrect.

D. nkp load image: There is no nkp load image command in NKP; loading images is done via docker load.

As per theNKPA 6.10 documentation, the standard and supported approach for installing Kommander on an NKP cluster is using theNKP CLI. The CLI provides commands for deploying Kommander and associated platform components as part of the cluster lifecycle management workflow.

Key Reference:

“The recommended approach to deploy Kommander is by using the nkp CLI, which ensures compatibility and streamlined installation with the rest of the Nutanix Kubernetes Platform stack.”

As per the “Nutanix Kubernetes Platform Administration (NKPA)” documentation, during the preparation of the environment for an air-gapped deployment, the first task involves installing critical software packages on the bastion host. The bastion host acts as a jump host in a secure network and requires tools such as yum-utils, bzip2, and wget to facilitate the retrieval and processing of required images and configuration files.

Specifically, in theNKPA 6.10 course under "Preparing the Air-gapped Environment", the documentation clearly states:

"The initial step for configuring the bastion host includes installing required pre-requisites like yum-utils, bzip2, and wget. This ensures that the host has the basic tools to download and manage required container images and other dependencies."

This step is explicitly called out as the first actionable item before proceeding to more advanced tasks like configuring public IP access or creating a bootstrap cluster. The need for these pre-requisite packages is foundational, as they are required to handle image downloading and manipulation in the subsequent steps of the air-gapped installation process.

TheSecure Tunnelfeature in NKP relies on HTTPS (TCP port 443) to establish secure, encrypted connections between the attached cluster and the management cluster, enabling fleet management even in restricted network environments.

Exact extract:

“Secure Tunnel uses TCP/443 (HTTPS) for establishing a secure connection between the attached cluster and NKP.”

TheKonvoy Image Builderrequires a64-bit Linux or MacOS environment(x86_64 architecture) to build and customize the OS images.

For deploying NKP clusters in AWS, setting theAWS_REGIONenvironment variable is a key prerequisite to ensure that the AWS CLI and underlying deployment scripts know which region to target. This is essential for provisioning instances using the specified AMI.

Exact extract:

“Set the AWS_REGION environment variable to the appropriate region prior to deploying clusters to ensure proper interaction with the AWS API.”

According to theNKPA 6.10 documentation, thePre-provisioned infrastructure provider (CAPPP)requires the user to provide aninventory fileof the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

Continuous Deployment (CD) is the practice of automatically deploying new software releases across environments after a successful build and testing phase. In the context of NKP, enabling CD ensures that software changes are consistently and reliably rolled out to all clusters associated with a project, ensuring operational uniformity and rapid feature adoption.

NKP uses Cluster API (CAPI) to provision and manage Kubernetes clusters across supported infrastructures, including Nutanix AHV, vSphere, AWS, and GCP. CAPI components, such as controllers and providers, are deployed to manage the lifecycle of clusters on these platforms. However, when NKP attaches to a managed Kubernetes service like Azure Kubernetes Service (AKS), CAPI components are not deployed because AKS is managed by Azure, and NKP only integrates with the cluster for fleet management, not provisioning.

The NKPA course explains: “For managed Kubernetes services like AKS, NKP attaches the cluster to its management plane without deploying CAPI components, as the underlying infrastructure is managed by the cloud provider.” The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide reinforces this: “CAPI is used for NKP-managed clusters on Nutanix, vSphere, AWS, and GCP, but not for attached managed services like AKS.”

Incorrect Options:

A. vSphere: NKP deploys CAPI components (e.g., CAPV provider) to manage vSphere-based clusters.

B. GCP: NKP deploys CAPI components (e.g., CAPG provider) for GCP-based clusters.

C. Nutanix: NKP deploys CAPI components (e.g., CAPA provider for AHV) for Nutanix AHV clusters.

NKP uses the Cluster Autoscaler to scale worker node replicas up or down.This ensures that resource availability dynamically matches workload demand by adjusting the number of worker nodes. Pod-level autoscaling (Horizontal-Pod autoscaler) is also supported for pod scaling but is not responsible for node pool expansion or compaction.

Key Reference:

“NKP uses the Cluster Autoscaler to dynamically adjust worker node pool replicas in response to cluster resource demands.”

The exhibit shows the NKP UI with the "Create Cluster" option grayed out in a new workspace, indicating that a prerequisite for cluster creation is missing. The NKPA course explains that to create a new Kubernetes cluster in a workspace, anInfrastructure Providermust be configured for that workspace. An Infrastructure Provider defines the underlying infrastructure (e.g., Nutanix AHV, AWS, vSphere) where the cluster will be provisioned, and without it, the Create Cluster option remains disabled in the UI.

The NKP Ultimate license supports creating clusters across various infrastructures, but the workspace must be associated with an Infrastructure Provider to enable cluster creation. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before creating a cluster in a new workspace, ensure an Infrastructure Provider is configured for the workspace in the NKP UI; otherwise, the Create Cluster option will be grayed out.” The engineer should navigate to the Infrastructure Providers section in the NKP UI (typically under the Global or Administration view), create a provider (e.g., for Nutanix AHV, AWS, or vSphere), and associate it with the workspace. Once this is done, the Create Cluster option will become available.

Incorrect Options:

A. Create the cluster only using YAML and not the GUI: The issue is not with the GUI itself but with the missing Infrastructure Provider, which affects both GUI and CLI cluster creation. YAML alone does not resolve this.

B. Attach existing clusters instead of creating a new cluster: Attaching existing clusters is an alternative but does not address the requirement to create a new cluster.

D. Ensure NKP is upgraded to a minimum version of 2.12: The NKP Ultimate license implies a recent version, and the course does not indicate that version 2.12 is specifically required for this functionality. The issue is configuration-related, not version-related.

The NKPA course explains that upgrading an NKP license to the Ultimate tier unlocks advanced features such as fleet management, air-gapped deployments, and additional platform services (e.g., monitoring, logging, backup/restore). These services are deployed on the Management cluster and require sufficient resources to operate effectively. A key prerequisite is tosize the Control Plane nodes appropriately to support the installation of default platform services(Option C).

The Control Plane nodes in the NKP Management cluster run critical components like the API server, controller manager, and Kommander, as well as platform services such as Prometheus, Grafana Loki, and Velero. The Ultimate license increases resource demands due to the expanded functionality, and undersized Control Plane nodes can lead to performance issues or failed deployments. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before upgrading to an NKP Ultimate license, ensure the Control Plane nodes of the Management cluster are sized appropriately (e.g., sufficient CPU, memory, and storage) to support the additional default platform services enabled by the license.” For example, Control Plane nodes might need to be scaled to at least 4 vCPUs and 16 GB RAM, depending on the workload.

Incorrect Options:

A. Size the Sidecar containers appropriately: Sidecar containers are typically used for specific workloads (e.g., logging agents), not for platform services deployment, and are not a licensing prerequisite.

B. Size the ETCD nodes appropriately: While etcd is part of the Control Plane, the course refers to the Control Plane nodes as a whole, not etcd specifically, as the sizing requirement.

D. Size the Worker nodes appropriately: Worker nodes run user workloads, not the platform services, which are deployed on the Control Plane in the Management cluster.

The NKPA course emphasizes that NKP supports multi-tenancy through workspaces, each of which can be configured with its own Identity Provider (IdP) for authentication. In this scenario, each group (Fin VD, Fin Insurance, Fin Travel) has its own IdP, and the engineer has created separate workspaces for them. To assign the Tenant Administrators role, the engineer must configure a dedicated IdP for each group’s workspace, enabling users to authenticate via their group-specific IdP and assume the Tenant Administrator role.

The course details that NKP uses Dex as the OIDC provider to integrate with external IdPs. For each workspace, the engineer configures a Dex connector to the group’s IdP, maps the IdP groups to NKP roles (e.g., Tenant Administrator), and assigns permissions via role bindings. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To assign Tenant Administrator roles in NKP, configure a dedicated IdP for each workspace using Dex connectors, mapping IdP groups to the appropriate roles for workspace management.” This ensures that each group’s administrators can access only their designated workspace.

Incorrect Options:

B. Create a role named admin-tenant-X: NKP uses predefined roles like Tenant Administrator, not custom roles with specific naming conventions.

C. Create a role binding and assign it: Role bindings are part of the process, but the primary step is configuring the IdP for authentication, as per the NKPA course.

D. Configure the global Active Directory: The scenario specifies separate IdPs per group, not a global Active Directory for all groups.