VMware 2V0-71.23 - VMware Tanzu for Kubernetes Operations Professional

Velero is an open source tool that can safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes. Velero can capture both the Kubernetes objects and the persistent volumes associated with an application, and restore them in a different cluster or namespace. Velero also supports different storage providers to store its backups, such as AWS S3, Azure Blob Storage, Google Cloud Storage, and more.

References:

1: https://middleware.io/blog/kubernetes-observability/

2: https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-0A1AEC6A-3E5C-424F-8EBC-1DDFC14D2688.html

3: https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-EB507AAF-5F4F-400F-9623-BA611233E0BD.html

The control plane nodes are the nodes that run the Kubernetes control plane components, such as the API server, the scheduler, the controller manager, and etcd. The control plane nodes are responsible for managing the cluster state and orchestrating workload operations. The possible counts of control plane nodes in a Tanzu Kubernetes Grid workload cluster are 1 or 3. The control plane must have an odd number of nodes to ensure quorum and high availability. A single control plane node is suitable for development or testing purposes, while three control plane nodes are recommended for production clusters23.

References: Deploy Workload Clusters - VMware Docs, Concepts and References - VMware Docs

The statement that describes Harbor accurately is that Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted. Harbor is a cloud native repository for Kubernetes that provides features such as image management, vulnerability scanning, content signing, access control, replication, and quota management3. Harbor is a graduated project of the Cloud Native Computing Foundation (CNCF) and is integrated with VMware Tanzu products and services4. References: Harbor, Harbor - CNCF

A NetworkPolicy is a Kubernetes object that controls what traffic is allowed to and from selected pods and network endpoints6. NetworkPolicy objects contain the following information:

The pods that are affected by this policy (the pod selector)

The traffic that is allowed for these pods (the ingress and egress rules)

The network entities that are allowed or denied for this traffic (the selectors and IP blocks)

By default, all pods in a cluster can communicate with each other and with any external network endpoint. A NetworkPolicy allows you to restrict this behavior by defining rules for pod isolation and network access. A NetworkPolicy is enforced by a network plugin that supports it6.

The other options are incorrect because:

An Ingress is a Kubernetes object that manages external access to services in a cluster, typically HTTP7. It does not control what traffic is allowed to and from selected pods and network endpoints.

A PodSecurityPolicy is a Kubernetes object that controls security-sensitive aspects of pod specification, such as running as privileged or using host networking8. It does not control what traffic is allowed to and from selected pods and network endpoints.

A Secret is a Kubernetes object that stores sensitive information, such as passwords or keys, in an encrypted form9. It does not control what traffic is allowed to and from selected pods and network endpoints.

References: Network Policies, Ingress, Pod Security Policies, Secrets

VMware Aria Operations for Applications (formerly known as Tanzu Observability) is a unified observability platform that provides full-stack visibility using metrics, traces, and logs across distributed applications, application services, container services, and multi-cloud environments. Some of the capabilities of VMware Aria Operations for Applications are:

Create alerts: Users can monitor for certain behaviors and get smart notifications based on query conditions. Users can create alerts independently or directly from charts, and use advanced and accurate alerting powered by AI/analytics and query language1.

Create charts and dashboards: Users can visualize their data based on query results in various chart types (such as line plot, point plot, table, pie chart, etc.) and organize them in dashboards. Users can also interact with charts and dashboards in real time, such as zoom in, zoom out, change the time window, change the focus, and so on1.

Create queries: Users can use the Wavefront Query Language (WQL) to extract the information they need from their data. Users can use the Chart Builder for easy query creation or the Query Editor for advanced query editing. Users can also use functions, operators, variables, macros, and expressions to manipulate their data1.

References: VMware Aria Operations for Applications Documentation, Unified Observability Platform by VMware Aria Operations for Applications

ClusterIP and NodePort are two Kubernetes Service types that are fulfilled natively by Kubernetes without requiring external integrations. ClusterIP exposes a service on a cluster-internal IP address that can only be accessed from within the cluster. NodePort exposes a service on a static port on each node’s IP address, and forwards the traffic to the corresponding ClusterIP service. Both ClusterIP and NodePort services are created by Kubernetes using iptables rules on the nodes, and do not depend on any external load balancers or DNS providers. References: Kubernetes Service Types Overview, Service | Kubernetes

The Tanzu CLI is a command-line tool that enables users to interact with VMware Tanzu products and services. It must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster, as it provides commands to create, configure, scale, upgrade, and delete management clusters on different platforms. The Tanzu CLI also allows users to create workload clusters from the management cluster, and to perform various operations on both types of clusters. References: VMware Tanzu CLI Documentation, [Deploying Management Clusters with the Tanzu CLI]

The purpose of setting ENABLE_AUDIT_LOGGING=true during a cluster deployment is to log metadata about all requests made to the Kubernetes API server. This enables auditing of the cluster activities and helps with security and compliance. The audit logs are stored in /var/log/kubernetes/audit.log on the control plane node and can be accessed by the cluster administrator. The audit logs are generated based on an audit policy file that defines what events should be recorded and what data they should include12

References: 1: https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-troubleshooting-tkg-audit-logging.html  2: https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/