Nutanix NCP-CN - Nutanix Certified Professional - Cloud Native (NCP-CN-6.10)

A bastion host in a dark site environment serves as a secure entry point for managing the NKP deployment, providing access to the cluster infrastructure without direct Internet connectivity. The NKPA course outlines the prerequisites for preparing a Linux VM as a bastion host, focusing on secure access and time synchronization, which are critical for air-gapped Kubernetes deployments.

Get or create SSH Keys (Option B):The bastion host requires SSH keys to enable secure, passwordless access to the NKP cluster nodes and other infrastructure components (e.g., Nutanix AHV hosts). The NKPA course specifies that SSH keys must be generated or obtained and configured on the bastion host to facilitate secure communication during deployment and management tasks. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For a bastion host in an NKP dark site deployment, ensure SSH keys are created or obtained to enable secure access to cluster nodes and infrastructure.” The engineer can generate SSH keys using ssh-keygen and distribute the public key to the target systems.

Enable NTP Service (Option D):Time synchronization is essential in Kubernetes clusters to ensure consistent logging, certificate management, and scheduling. In a dark site with no Internet access, the bastion host must be configured to synchronize time with an internal NTP (Network Time Protocol) server or act as an NTP server itself. The NKPA course emphasizes enabling the NTP service on the bastion host to maintain accurate time across the air-gapped environment. The NCP-CN 6.10 Study Guide notes: “Enable the NTP service on the bastion host to ensure time synchronization in a dark site NKP deployment, as Kubernetes requires accurate time for proper operation.” The engineer can enable NTP using commands like systemctl enable ntpd and configure it to use an internal time source.

Incorrect Options:

A. Install LDAP Server: LDAP is used for centralized authentication, but it is not a requirement for a bastion host in an NKP dark site deployment. The course focuses on SSH access instead.

C. Install Docker: While Docker is needed on Kubernetes nodes for container runtimes, the bastion host’s role is to provide secure access and management, not to run containers.

The NKPA course details the process of creating an NKP cluster on vSphere using the NKP CLI, including the configuration of multiple node pools with specific worker node counts and CPU settings. The correct approach involves creating the cluster with the initial node pool and then adding additional node pools separately.

The steps in Option A align with this process:

nkp create cluster vsphere --worker-replicas 6 --worker-cpus 10: This command creates the NKP cluster on vSphere with the first node pool, consisting of 6 worker nodes, each with 10 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 8: This adds the second node pool to the cluster with 3 worker nodes, each with 8 CPUs.

nkp create nodepool vsphere --worker-replicas 3 --worker-cpus 6: This adds the third node pool with 3 worker nodes, each with 6 CPUs.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To create an NKP cluster with multiple node pools on vSphere, use nkp create cluster vsphere to define the first node pool, then add additional node pools with nkp create nodepool vsphere, specifying --worker-replicas and --worker-cpus for each pool.” This method ensures precise control over each node pool’s configuration.

Incorrect Options:

B: The second nkp create nodepool command uses --replicas and --cpus, which are not the correct flags. The NKPA course specifies --worker-replicas and --worker-cpus.

C: The --node-pools, --worker-replicas 6,3,3, and --worker-cpus 10,8,6 flags are not supported in a single nkp create cluster command. Node pools must be created separately.

D: There is no nkp create nodepools command; the correct command is nkp create nodepool. Additionally, --replicas and --cpus are incorrect flags.

The NKPA course outlines the default behaviors of NKP when deploying workload clusters within a workspace, regardless of the provisioning environment (e.g., AWS, Nutanix, Azure). When a workload cluster is deployed in AWS, NKP ensures consistency across the workspace by applying the following default behaviors:

The NKP workload cluster will receive all of the GitOps sources that have been assigned to the NKP workspace (Option A): NKP uses GitOps with Flux to manage cluster configurations and applications. The course explains that GitOps sources (e.g., Git repositories) assigned to a workspace are automatically applied to all clusters in that workspace, ensuring consistent configuration and application deployment. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “New workload clusters inherit all GitOps sources configured for the workspace, enabling Flux to synchronize configurations from the specified repositories.”

The NKP workload cluster will be deployed all of the applications that have been enabled on this NKP workspace (Option D): NKP Platform Applications (e.g., Prometheus, Rook Ceph) enabled in the workspace are automatically deployed to new workload clusters. The NKPA course notes: “When a workload cluster is created, NKP deploys all platform applications enabled in the workspace to ensure consistent functionality across clusters.”

Incorrect Options:

B. The NKP workload cluster will receive all of the NKP RBAC policy: RBAC policies are defined at the workspace or project level and applied to users or groups, not automatically to clusters. Clusters inherit RBAC through user access, not as a default deployment behavior.

C. The NKP workload cluster will also be assigned to all of the NKP projects: Clusters are assigned to specific projects manually, not automatically to all projects in a workspace.

The NKPA course addresses performance issues in NKP clusters, such as high CPU and memory consumption on worker nodes, by recommending scaling options to distribute workloads more effectively. The Kubernetes cluster in the scenario has 4 workers, each with 8 vCPUs and 32 GB RAM, and is running out of resources. The most effective solution is to add more workers to the cluster to increase overall capacity and balance the load, rather than modifying existing workers or reducing application replicas.

The correct action is to add one more worker using the command nkp scale nodepools ${NODEPOOL_NAME} --replicas=5 --cluster-name=${CLUSTER_NAME} -n ${CLUSTER_WORKSPACE} (Option D). This command scales the specified node pool to 5 replicas (from the current 4), adding one additional worker to the cluster. The new worker will have the same configuration (8 vCPUs, 32 GB RAM) as the existing workers, providing additional capacity to alleviate resource contention. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To address performance issues due to resource exhaustion in an NKP cluster, scale out by adding workers using nkp scale nodepools --replicas --cluster-name -n .”

Incorrect Options:

A. Call tech support to investigate: While support can help, the issue is clearly resource exhaustion, which can be resolved by scaling the cluster—a task the Platform Engineer can perform directly.

B. Ask developers to lower application replicas: Reducing replicas may decrease resource usage but could impact application availability or performance, which is not ideal for a development cluster.

C. Add more CPU and memory to workers with nkp scale --cpu 16 --memory 64: The nkp scale command does not support --cpu and --memory flags for resizing existing workers. Resizing VMs typically requires updating the node pool configuration and replacing nodes, which is more complex than adding new workers.

As per the NKPA 6.10 documentation, the correct approach for deleting an entire NKP-managed cluster (including nodes and deployed applications) is to use the nkp delete cluster command with the cluster name and --kubeconfig parameter. The --self-managed flag ensures the deletion of resources provisioned by the cluster.

Exact extract:

“Use nkp delete cluster --cluster-name= --self-managed --kubeconfig= to delete a cluster and its associated resources.”

Comprehensive and Detailed Explanation:

The correct procedure for deleting an NKP cluster involves using the nkp delete cluster command with the appropriate cluster name and namespace. This ensures that not only the Kubernetes resources but also the corresponding NKP resources (e.g., nodepools, Kommander integration) are deleted cleanly and consistently. Simply deleting the VMs does not clean up the associated NKP management objects. This approach is detailed in the NKP documentation for cluster lifecycle management, emphasizing the need to use the provided CLI commands for full removal.

The NKPA course covers user authentication for NKP clusters as part of Day 2 operations, emphasizing integration with external identity providers (IdPs) to manage user access securely. NKP uses Dex, an OpenID Connect (OIDC) identity provider, to facilitate authentication by acting as a connector between the Kubernetes cluster and external IdPs, such as LDAP, SAML, or OAuth-based systems.

The course explains that to set up user authentication, a Platform Engineer must configure a Dex connector to the user base’s identity provider. Dex integrates with the Kubernetes API server to enable OIDC-based authentication, allowing users to log in using their IdP credentials. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP supports user authentication through Dex, which provides OIDC integration with external identity providers, enabling single sign-on (SSO) for cluster access.” The process involves deploying Dex as a platform application, configuring the IdP connector (e.g., specifying client IDs, secrets, and endpoints), and updating the Kubernetes API server to use OIDC authentication.

Incorrect Options:

A. Enable Gatekeeper and create a connector to the user base’s identity provider: Gatekeeper is a Kubernetes policy engine used for enforcing admission control policies, not for authentication. The NKPA course does not associate Gatekeeper with user authentication.

B. Disable native NKP authentication, enable Traefik, and create a connector to the user base’s identity provider: Traefik is an ingress controller for managing external traffic, not authentication. Disabling native authentication is unnecessary, as NKP supports OIDC alongside native methods. The NKPA course does not mention Traefik in the context of authentication.

C. Create a MetalLB connector to the user base’s identity provider: MetalLB is a load balancer for bare-metal Kubernetes clusters, not an authentication component. This option is irrelevant, as per the NKPA course.

As stated in the NKPA 6.10 documentation, when using external storage (such as AWS S3) with Loki for log storage, AWS credentials must be provided securely. This typically involves creating a Kubernetes Secret containing the static AWS credentials (access key ID and secret access key), which are referenced in the override ConfigMap to authenticate Loki’s S3 storage backend.

Key reference from documentation:

“For Loki to store logs in an S3 bucket, AWS credentials must be created as a Kubernetes secret and referenced in the storage configuration.”

The exhibit shows the NKP UI with the "Create Cluster" option grayed out in a new workspace, indicating that a prerequisite for cluster creation is missing. The NKPA course explains that to create a new Kubernetes cluster in a workspace, an Infrastructure Provider must be configured for that workspace. An Infrastructure Provider defines the underlying infrastructure (e.g., Nutanix AHV, AWS, vSphere) where the cluster will be provisioned, and without it, the Create Cluster option remains disabled in the UI.

The NKP Ultimate license supports creating clusters across various infrastructures, but the workspace must be associated with an Infrastructure Provider to enable cluster creation. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Before creating a cluster in a new workspace, ensure an Infrastructure Provider is configured for the workspace in the NKP UI; otherwise, the Create Cluster option will be grayed out.” The engineer should navigate to the Infrastructure Providers section in the NKP UI (typically under the Global or Administration view), create a provider (e.g., for Nutanix AHV, AWS, or vSphere), and associate it with the workspace. Once this is done, the Create Cluster option will become available.

Incorrect Options:

A. Create the cluster only using YAML and not the GUI: The issue is not with the GUI itself but with the missing Infrastructure Provider, which affects both GUI and CLI cluster creation. YAML alone does not resolve this.

B. Attach existing clusters instead of creating a new cluster: Attaching existing clusters is an alternative but does not address the requirement to create a new cluster.

D. Ensure NKP is upgraded to a minimum version of 2.12: The NKP Ultimate license implies a recent version, and the course does not indicate that version 2.12 is specifically required for this functionality. The issue is configuration-related, not version-related.