5V0-23.20 Sample Questions Answers

NCP provides the following functionalities:

• Automatically creates an NSX-T Data Center logical topology for a Kubernetes cluster, and creates a separate logical network for each Kubernetes namespace.
• Implements Kubernetes Ingress with NSX-T layer 7 load balancer
• Connects Kubernetes pods to the logical network, and allocates IP and MAC addresses.
• Supports network address translation (NAT) and allocates a separate SNAT IP for each Kubernetes namespace.Note:When configuring NAT, the total number of translated IPs cannot exceed 1000.
• Implements Kubernetes network policies with NSX-T Data Center distributed firewall.
• Implements Kubernetes service of type ClusterIP and service of type LoadBalancer.

• The HAProxy virtual IP range where external services and DevOps users connect. In this configuration, HAProxy is deployed with two virtual NICs (Default configuration), one connected to the management network, and a second one connected to the Primary Workload Network. You must plan for allocating Virtual IPs on a separate subnet from the Primary Workload Network.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-1F885AAE-92FF-41E6-BF04-0F0FD4173BD9.html

Spherelet is a kubelet that is ported natively to ESXi. It allows the ESXi host to become part of a Kubernetes cluster. Spherelet performs the following functions:

• Communicates with the control plane VMs

• Manages node configuration

• Starts vSphere Pods

• Monitors vSphere Pods

Creating a Namespace

A vSphere administrator configures permissions and storage before a namespace can be used:

• Assign edit or view permissions to users. Users must be present in a configured single sign-on (SSO) identity source.

• Must assign a VM storage policy to the namespace.

• Can define resource limits (optional).

• Must add a content library to enable the Tanzu Kubernetes Grid Service.

The Workload Network, such as TKGS-VLAN1000, is where the Tanzu Kubernetes clusters run.

A workload network is a network construct that is used by supervisor control plane VMs and vSphere namespaces:

• The workload network is supported by a vSphere Distributed Switch port group.

• An IP range is defined to allocate an IP address for VMs attached to the workload network.

• A primary workload network must be selected.

• The supervisor control plane VMs attach to the primary workload networks port group.

A workload network can be used by multiple namespaces. A namespace can be assigned only one workload network.

VMware Harbor Registry

VMware Harbor Registry is an enterprise-class registry server that stores and distributes container images. Harbor allows you to store and manage images for use with VMware Tanzu Kubernetes Grid Integrated Edition (TKGI).

Overview

Harbor extends the open source Docker Distribution by adding the functionalities usually required by an enterprise, such as security, identity, and management. As an enterprise private registry, Harbor offers enhanced performance and security. Deploying a registry alongside the TKGI environment improves image management efficiency.

Virtual Machine Class Types for Tanzu Kubernetes Clusters

A virtual machine class defines the resource sizing for Tanzu Kubernetes cluster VMs: • CPU • Memory •

Storage

Virtual machine class types range from extra small (xsmall) to extra large (xlarge). Class types are categorized as guaranteed or best effort:

• Guaranteed: Reserve all CPU and memory allocations. • Best effort: Allocate the same CPU and memory but do not reserve the resources.

The class type guaranteed-small allocates 2 CPU, 4 GB of memory, and 16 GB of storage and reserves CPU and memory allocations. Custom virtual machine class types cannot be defined.

• VM storage policies are translated into Kubernetes storage classes.

• Developers can access all assigned VM storage policies in the form of storage classes. •

Developers cannot manage storage classes.

When using vSphere with Tanzu with vDS networking, HAProxy provides load balancing for developers accessing the Tanzu Kubernetes control plane, and for Kubernetes Services of Type Load Balancer. Review the possible topologies that you can implement for the HAProxy load balancer.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-1F885AAE-92FF-41E6-BF04-0F0FD4173BD9.html

The HAProxy appliance is an open-source solution developed by HAProxy Technologies and chosen by VMware as the first supported open-source load balancer for use with vSphere with Tanzu. With the HAProxy, external network traffic is routed to Kubernetes pods running in the vSphere with Tanzu environment.

Authenticating Using kubectl

In vSphere with Tanzu, authentication is performed using vCenter Single Sign-On. You run the command kubectl vsphere login to authenticate a user through vCenter Single Sign-On to Kubernetes clusters.

kubectl vsphere login --server -u

The --insecure-skip-tls-verify flag is required if the certificate presented by the vSphere with Tanzu control plane is not trusted by the client machine. The control plane is signed by the vCenter Server VMware CA by default. You can replace the control plane certificate with a trusted certificate if needed. Alternatively, install the vCenter Server VMware CA root certificate into your client machine to remove the need for the --insecure-skip-tls-verify flag.

vSphere Pods are only supported on Supervisor Clusters that use NSX-T Data Center as their networking stack.

Resource Management. vSphere DRS handles the placement of vSphere Pods on the Supervisor Cluster.

A context element in a kubeconfig file is used to group access parameters under a convenient name. Each context has three parameters: cluster, namespace, and user. By default, the kubectl command-line tool uses parameters from the current context to communicate with the cluster.

To choose the current context:

• kubectl config use-context ctx001

Static IPs for Kubernetes control plane VMs

Block of 5A block of 5 consecutive static IP addresses to be assigned to the Kubernetes control plane VMs in the Supervisor Cluster.

Prerequisites

• Configure a cluster with vSphere with Tanzu.
• Create users or groups for all DevOps engineers who will access the namespace.
• Create storage policies for persistent storage. Storage policies can define different types and classes of storage, for example, gold, silver, and bronze.
• Create VM classes and content libraries for stand-alone VMs.
• Create a content library for Tanzu Kubernetes releases for use with Tanzu Kubernetes clusters. See Creating and Managing Content Libraries for Tanzu Kubernetes releases.
• Required privileges:

• Create an example pod spec with the details about the private registry.