Nutanix NCP-CN - Nutanix Certified Professional - Cloud Native (NCP-CN-6.10)

As per theNKPA 6.10 documentation, the correct approach for deleting an entire NKP-managed cluster (including nodes and deployed applications) is to use the nkp delete cluster command with the cluster name and --kubeconfig parameter. The --self-managed flag ensures the deletion of resources provisioned by the cluster.

Exact extract:

“Use nkp delete cluster --cluster-name= --self-managed --kubeconfig= to delete a cluster and its associated resources.”

The NKP documentation recommends using a combination of RBAC assignments and exported manifests to manage access across multiple clusters. By exporting the role assignments to YAML, the engineer can consistently apply these settings across the different environments, ensuring the new team has the necessary resources and limits. This approach is especially useful for environments with multiple clusters and standardized configurations.

According to theNKPA 6.10 documentationand Nutanix licensing details, NKP Starter is bundled with theNCI Starterentitlement. This basic licensing tier includes essential capabilities for deploying and managing Kubernetes clusters within a Nutanix environment.

Key reference:

“NKP Starter is included with NCI Starter, providing foundational Kubernetes cluster lifecycle management features for small-scale or starter deployments.”

According to theNKPA 6.10 documentationunder the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image,include both the offline fips and fips overridesto ensure the image and components are built in compliance.

When deploying the cluster, includeFIPS-specific referencesfor both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

TheNKPA 6.10 documentationconfirms thatVelerois the built-in backup and recovery solution provided as part of the NKP platform. It provides cluster-level and namespace-level backup, restore, and migration capabilities.

Exact extract from the documentation:

“Velero is the integrated, out-of-the-box backup and restore solution in NKP. It supports scheduled backups, disaster recovery, and application migration workflows.”

NKP Platform Applications (e.g., Rook Ceph, Prometheus, Fluent Bit) are pre-integrated tools that can be deployed to Kubernetes clusters within a workspace to provide services like storage, monitoring, and logging. The NKPA course specifies that to deploy a platform application to all clusters in a workspace from the command line, the engineer uses thenkp create appdeploymentcommand. This command creates an application deployment resource that targets the specified workspace and clusters.

The required parameters include theapplication ID(to identify the platform application), theversion(to specify the desired version of the application), and theNKP workspace(to define the scope of clusters). For example: nkp create appdeployment --app-id prometheus --version 2.30.0 --workspace fin-vd. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “Use the nkp create appdeployment command to deploy platform applications, specifying the application ID, version, and target workspace to apply the deployment across all clusters in that workspace.”

Incorrect Options:

B. nkp deploy platform-app: This is not a valid NKP command. The correct command is nkp create appdeployment.

C. nkp deploy app: This is not a recognized command in the NKPA documentation.

D. kubectl create appdeployment: kubectl interacts with Kubernetes resources, not NKP-specific platform applications.

The NKPA course emphasizes that NKP supports multi-tenancy through workspaces, each of which can be configured with its own Identity Provider (IdP) for authentication. In this scenario, each group (Fin VD, Fin Insurance, Fin Travel) has its own IdP, and the engineer has created separate workspaces for them. To assign the Tenant Administrators role, the engineer must configure a dedicated IdP for each group’s workspace, enabling users to authenticate via their group-specific IdP and assume the Tenant Administrator role.

The course details that NKP uses Dex as the OIDC provider to integrate with external IdPs. For each workspace, the engineer configures a Dex connector to the group’s IdP, maps the IdP groups to NKP roles (e.g., Tenant Administrator), and assigns permissions via role bindings. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To assign Tenant Administrator roles in NKP, configure a dedicated IdP for each workspace using Dex connectors, mapping IdP groups to the appropriate roles for workspace management.” This ensures that each group’s administrators can access only their designated workspace.

Incorrect Options:

B. Create a role named admin-tenant-X: NKP uses predefined roles like Tenant Administrator, not custom roles with specific naming conventions.

C. Create a role binding and assign it: Role bindings are part of the process, but the primary step is configuring the IdP for authentication, as per the NKPA course.

D. Configure the global Active Directory: The scenario specifies separate IdPs per group, not a global Active Directory for all groups.

As per theNKPA 6.10 documentationand cluster autoscaler behavior, when nodes are scaled down in NKP (or any CAPI-managed environment), the node isdeletedfrom the infrastructure provider (vSphere, AWS, Nutanix, etc.). This effectively removes it from both the cluster and the underlying hypervisor or cloud provider, thus freeing up resources and reducing costs.