최신 EX316 무료덤프 - RedHat Red Hat Certified Specialist in OpenShift Virtualization
How do you remove an installed package (e.g., nano) from a VM?
정답:
See the Explanation.
Explanation:
1. For RHEL:
sudo dnf remove nano
2. For Ubuntu:
sudo apt remove nano
3. Confirm removal.
4. Verify
with:
which
nano
5. Path missing confirms removal.
Explanation:
1. For RHEL:
sudo dnf remove nano
2. For Ubuntu:
sudo apt remove nano
3. Confirm removal.
4. Verify
with:
which
nano
5. Path missing confirms removal.
How do you verify if Multus network interfaces are attached correctly to VM pods?
정답:
See the Explanation.
Explanation:
1. Run: oc get pod -l kubevirt.io/domain=<vm-name>
2. Inspect pod annotations:
oc get pod <pod-name> -o json | jq '.metadata.annotations["k8s.v1.cni.cncf.io/networks-status"]' | jq .
3. Verify presence of secondary network with IP.
4. Look for bridge or macvlan type.
5. Cross-check with VM's internal NICs.
Explanation:
1. Run: oc get pod -l kubevirt.io/domain=<vm-name>
2. Inspect pod annotations:
oc get pod <pod-name> -o json | jq '.metadata.annotations["k8s.v1.cni.cncf.io/networks-status"]' | jq .
3. Verify presence of secondary network with IP.
4. Look for bridge or macvlan type.
5. Cross-check with VM's internal NICs.
How do you configure anti-affinity to avoid placing two VMs on the same node?
정답:
See the Explanation.
Explanation:
1. Add to VM spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
vm-group:
group1
topologyKey: kubernetes.io/hostname
2. Label both VMs:
oc label vm vm1 vm-group=group1
oc label vm vm2 vm-group=group1
3. Start both VMs.
4. Confirm different nodes with oc get vmi -o wide.
Explanation:
1. Add to VM spec:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
vm-group:
group1
topologyKey: kubernetes.io/hostname
2. Label both VMs:
oc label vm vm1 vm-group=group1
oc label vm vm2 vm-group=group1
3. Start both VMs.
4. Confirm different nodes with oc get vmi -o wide.
How do you create a NodePort service to expose a VM externally?
정답:
See the Explanation.
Explanation:
1. Label the VM:
oc label vm <vm-name> app=nodeport-vm
2. Create service:
apiVersion: v1
kind: Service
metadata:
name: nodeport-svc
spec:
type: NodePort
selector:
kubevirt.io/domain: <vm-name>
ports:
- port: 22
targetPort: 22
nodePort: 30222
3. Apply with oc apply -f nodeport.yaml
4. Connect externally: ssh user@<node-ip> -p 30222
5. Ensure node firewall allows the port.
Explanation:
1. Label the VM:
oc label vm <vm-name> app=nodeport-vm
2. Create service:
apiVersion: v1
kind: Service
metadata:
name: nodeport-svc
spec:
type: NodePort
selector:
kubevirt.io/domain: <vm-name>
ports:
- port: 22
targetPort: 22
nodePort: 30222
3. Apply with oc apply -f nodeport.yaml
4. Connect externally: ssh user@<node-ip> -p 30222
5. Ensure node firewall allows the port.
How do you list all PVCs used by running VMs in a namespace?
정답:
See the Explanation.
Explanation:
1. List VMs: oc get vm
2. For each VM:
oc get vm <name> -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}'
3. Optionally use: oc get pvc -o wide to find binding.
4. Automate with a script for large environments.
5. Helpful for auditing storage usage.
Explanation:
1. List VMs: oc get vm
2. For each VM:
oc get vm <name> -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}'
3. Optionally use: oc get pvc -o wide to find binding.
4. Automate with a script for large environments.
5. Helpful for auditing storage usage.
How do you protect VM snapshots from accidental deletion?
정답:
See the Explanation.
Explanation:
1. Annotate the snapshot:
oc annotate vmsnapshot <name> snapshot.kubevirt.io/protected=true
2. Enforce via RBAC or automation to check annotations.
3. Prevent deletion unless annotation is removed.
4. Useful in production or backup policies.
5. Combine with Velero for full protection.
Explanation:
1. Annotate the snapshot:
oc annotate vmsnapshot <name> snapshot.kubevirt.io/protected=true
2. Enforce via RBAC or automation to check annotations.
3. Prevent deletion unless annotation is removed.
4. Useful in production or backup policies.
5. Combine with Velero for full protection.
How do you create a local shell script to manage a custom service?
정답:
See the Explanation.
Explanation:
1. In the VM, create a
script: vim
/usr/local/bin/hello.sh
2. Content:
#!/bin/bash
echo "Hello from service!"
3. Make executable:
chmod +x /usr/local/bin/hello.sh
4. Useful for custom jobs.
Explanation:
1. In the VM, create a
script: vim
/usr/local/bin/hello.sh
2. Content:
#!/bin/bash
echo "Hello from service!"
3. Make executable:
chmod +x /usr/local/bin/hello.sh
4. Useful for custom jobs.
How do you configure a VM to use a bridge network binding?
정답:
See the Explanation.
Explanation:
1. Define the network section with bridge:
interfaces:
- name:
nic1
bridg
e: {}
networks:
- name: nic1 multus:
networkName: bridge-net
2. Create a NetworkAttachmentDefinition for bridge-net.
3. Attach to VM and apply.
4. Restart the VM and verify with ip a.
Explanation:
1. Define the network section with bridge:
interfaces:
- name:
nic1
bridg
e: {}
networks:
- name: nic1 multus:
networkName: bridge-net
2. Create a NetworkAttachmentDefinition for bridge-net.
3. Attach to VM and apply.
4. Restart the VM and verify with ip a.
How do you create a Kubernetes NetworkPolicy to restrict VM ingress traffic?
정답:
See the Explanation.
Explanation:
1. Create policy YAML:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: default
spec:
podSelector:
matchLabels:
kubevirt.io: virt-launcher
policyTypes:
- Ingress
2. Apply: oc apply -f deny-ingress.yaml
3. This blocks all incoming traffic to the VM pods.
4. Use additional rules to allow selected ingress.
Explanation:
1. Create policy YAML:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: deny-all-ingress
namespace: default
spec:
podSelector:
matchLabels:
kubevirt.io: virt-launcher
policyTypes:
- Ingress
2. Apply: oc apply -f deny-ingress.yaml
3. This blocks all incoming traffic to the VM pods.
4. Use additional rules to allow selected ingress.
How do you view all the CRDs installed by the virtualization operator?
정답:
See the Explanation.
Explanation:
1. Run: oc get crds | grep kubevirt
2. Check CRDs from CDI: oc get crds | grep cdi
3. View SSP CRDs: oc get crds | grep ssp
4. List all CRDs from HCO:
oc get crds | grep -E 'kubevirt|cdi|ssp|vmimport'
5. Use oc explain <crd> for structure.
Explanation:
1. Run: oc get crds | grep kubevirt
2. Check CRDs from CDI: oc get crds | grep cdi
3. View SSP CRDs: oc get crds | grep ssp
4. List all CRDs from HCO:
oc get crds | grep -E 'kubevirt|cdi|ssp|vmimport'
5. Use oc explain <crd> for structure.
How do you install the NMState Operator on your OpenShift cluster?
정답:
See the Explanation.
Explanation:
1. Go to Web Console Operators OperatorHub.
2. Search for NMState and click Install.
3. Choose the target namespace (e.g., openshift-nmstate).
4. Wait for CSV status to show Succeeded: oc get csv -n openshift-nmstate
5. Confirm Operator pods are running: oc get pods -n openshift-nmstate
Explanation:
1. Go to Web Console Operators OperatorHub.
2. Search for NMState and click Install.
3. Choose the target namespace (e.g., openshift-nmstate).
4. Wait for CSV status to show Succeeded: oc get csv -n openshift-nmstate
5. Confirm Operator pods are running: oc get pods -n openshift-nmstate
How do you force a watchdog reboot for testing?
정답:
See the Explanation.
Explanation:
1. Access VM and disable watchdog
daemon: systemctl stop watchdog
2. Wait for timeout (~60 seconds).
3. Watchdog device will trigger a guest reboot.
4. Confirm with:
oc get vmi -o wide
5. VM should restart on the same or new node.
Explanation:
1. Access VM and disable watchdog
daemon: systemctl stop watchdog
2. Wait for timeout (~60 seconds).
3. Watchdog device will trigger a guest reboot.
4. Confirm with:
oc get vmi -o wide
5. VM should restart on the same or new node.
How do you make sure that a VM disk is encrypted at rest?
정답:
See the Explanation.
Explanation:
1. Use a storage class that supports encryption (e.g., Ceph or CSI driver).
2. Confirm with:
oc get sc <sc-name> -o yaml | grep encryption
3. Ensure PVC uses that class.
4. Use CSI secrets if required.
5. Validate with provider documentation.
Explanation:
1. Use a storage class that supports encryption (e.g., Ceph or CSI driver).
2. Confirm with:
oc get sc <sc-name> -o yaml | grep encryption
3. Ensure PVC uses that class.
4. Use CSI secrets if required.
5. Validate with provider documentation.
How do you schedule VMs to specific nodes?
정답:
See the Explanation.
Explanation:
1. Label node: oc label node worker-1 vm-node=yes
2. Add nodeSelector to VM:
spec:
template:
spec:
nodeSelector:
vm-node: "yes"
3. Apply changes and restart VM.
Explanation:
1. Label node: oc label node worker-1 vm-node=yes
2. Add nodeSelector to VM:
spec:
template:
spec:
nodeSelector:
vm-node: "yes"
3. Apply changes and restart VM.
How do you create a Multus NetworkAttachmentDefinition for a bridged external network?
정답:
See the Explanation.
Explanation:
1. Create the NAD YAML:
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
name: ext-bridge-net
namespace: default
spec:
config: '{
"cniVersion": "0.3.1",
"type": "bridge",
"bridge": "br-ext",
"ipam": {
"type": "dhcp"
}
}'
2. Apply it: oc apply -f nad.yaml
3. Confirm with: oc get net-attach-def
4. Validate bridge exists on node.
5. Check for DHCP connectivity later in VM.
Explanation:
1. Create the NAD YAML:
apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
name: ext-bridge-net
namespace: default
spec:
config: '{
"cniVersion": "0.3.1",
"type": "bridge",
"bridge": "br-ext",
"ipam": {
"type": "dhcp"
}
}'
2. Apply it: oc apply -f nad.yaml
3. Confirm with: oc get net-attach-def
4. Validate bridge exists on node.
5. Check for DHCP connectivity later in VM.