AI-200 practice: Deploy and manage applications to Azure Kubernetes Service (AKS) by using manifest files

Question 1

You are writing AKS manifests for a stateless embedding-generation service that must scale horizontally based on CPU load, has no need for stable network identities or per-replica persistent storage, and should be evenly load-balanced across replicas.

What should the manifest define?

Accepted Answer

A Deployment with a HorizontalPodAutoscaler targeting CPU utilization, fronted by a ClusterIP or LoadBalancer Service for even distribution

Answer

A StatefulSet with volumeClaimTemplates and a headless Service so each embedding replica keeps stable network identity and dedicated storage

Answer

A DaemonSet scheduled on every node so exactly one embedding replica runs per node regardless of observed CPU utilization across the cluster

Answer

A bare Pod manifest plus a manual kubectl scale workflow that operators update whenever CPU utilization exceeds an agreed operational threshold value

Question 2

You need a Kubernetes Job that runs a nightly data-cleanup task and must be retried up to 3 times on failure, then marked failed permanently.
```yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-cleanup
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      backoffLimit: 3
      template:
        spec:
          containers:
          - name: cleanup
            image: myregistry.azurecr.io/cleanup:1.0
          restartPolicy: OnFailure
```
The CronJob is deployed but jobs never appear to stop retrying even after failing many times over several days, consuming cluster resources. What is the likely root cause?

Accepted Answer

backoffLimit: 3 only applies within a single Job run; each new scheduled CronJob execution creates a fresh Job with its own retry budget, which is expected behavior — the real problem is missing successfulJobsHistoryLimit/failedJobsHistoryLimit, causing old Job objects to accumulate.

Answer

restartPolicy: OnFailure should be Always to allow the CronJob to eventually succeed.

Answer

backoffLimit is not a valid field for CronJobs and is silently ignored.

Answer

The schedule cron expression is invalid, causing Kubernetes to run the job continuously instead of once daily.

Question 3

You want zero-downtime rolling updates for a Deployment, ensuring at least 3 pods are always available (desired replicas = 4) and no more than 1 extra pod is created during the rollout.
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-frontend
spec:
  replicas: 4
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: ???
      maxSurge: ???
  template:
    spec:
      containers:
      - name: web
        image: myregistry.azurecr.io/web:2.0
```
Which values correctly satisfy "at least 3 always available" and "no more than 1 extra pod"?

Accepted Answer

maxUnavailable: 1, maxSurge: 1

Answer

maxUnavailable: 3, maxSurge: 1

Answer

maxUnavailable: 0, maxSurge: 0

Answer

maxUnavailable: 25%, maxSurge: 25%

Question 4

A pod fails to start with the following event:
```text
Warning  FailedScheduling  12s  default-scheduler  0/3 nodes are available:
3 node(s) had taint {sku=gpu:NoSchedule} that the pod didn't tolerate.
```
Pod spec:
```yaml
apiVersion: v1
kind: Pod
metadata:
  name: inference-pod
spec:
  containers:
  - name: inference
    image: myregistry.azurecr.io/inference:1.0
    resources:
      limits:
        nvidia.com/gpu: 1
```
What must be added to schedule this pod onto the GPU node pool?

Accepted Answer

A tolerations entry matching the node taint, e.g. tolerations: [{ key: "sku", operator: "Equal", value: "gpu", effect: "NoSchedule" }].

Answer

A nodeSelector matching the GPU node pool's label; taints and tolerations are unrelated to GPU scheduling.

Answer

Increase nvidia.com/gpu limit to 2 so the scheduler prioritizes GPU nodes.

Answer

Remove the taint from the GPU nodes using kubectl taint nodes --all sku-.

Question 5

You mount an Azure Files share into an AKS pod using the CSI driver for shared configuration data:
```yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-azurefile
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  csi:
    driver: file.csi.azure.com
    volumeHandle: uniqueid
    volumeAttributes:
      shareName: config-share
    nodeStageSecretRef:
      name: azure-secret
      namespace: default
  persistentVolumeReclaimPolicy: Retain
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-azurefile
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: ""
  resources:
    requests:
      storage: 5Gi
```
The PVC remains in Pending state indefinitely. What is the most likely cause?

Accepted Answer

The PVC is missing volumeName: pv-azurefile to explicitly bind to the statically provisioned PV, since storageClassName: "" disables dynamic provisioning and requires an explicit static binding reference.

Answer

ReadWriteMany is not supported by Azure Files; it must be ReadWriteOnce.

Answer

persistentVolumeReclaimPolicy: Retain prevents PVCs from ever binding to the PV.

Answer

The azure-secret referenced in nodeStageSecretRef must be named exactly azure-storage-secret for the CSI driver to recognize it.

Question 6

You configure liveness and readiness probes for a Node.js API that takes up to 45 seconds to warm up a large in-memory cache on startup:
```yaml
livenessProbe:
  httpGet:
    path: /healthz
    port: 3000
  initialDelaySeconds: 5
  periodSeconds: 10
  failureThreshold: 3
readinessProbe:
  httpGet:
    path: /ready
    port: 3000
  initialDelaySeconds: 5
  periodSeconds: 10
  failureThreshold: 3
```
The pod is repeatedly killed and restarted during the cache-warming phase, never reaching a healthy state. What is the best fix?

Accepted Answer

Add a startupProbe with a generous failureThreshold × periodSeconds (e.g., failureThreshold: 30, periodSeconds: 2 = 60s budget) targeting /healthz, which disables liveness and readiness probes until it succeeds.

Answer

Increase livenessProbe.initialDelaySeconds to 45 and increase readinessProbe.initialDelaySeconds to 45 as well.

Answer

Remove the livenessProbe entirely since it is causing restarts.

Answer

Set failureThreshold: 100 on the existing livenessProbe to give it more retries.

Question 7

You deploy a Helm chart for a microservice with standard defaults:
```yaml
# values.yaml (default)
replicaCount: 2
image:
  repository: myregistry.azurecr.io/orders-api
  tag: latest
```
Deployment template:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-orders-api
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    spec:
      containers:
      - name: orders-api
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
```
You execute:
```bash
helm upgrade --install orders ./orders-chart \
  --set image.tag=2.0 \
  -f values-prod.yaml
```
Where `values-prod.yaml` contains `replicaCount: 5` and no `image.tag` key. What image tag and replica count are actually applied?

Accepted Answer

image.tag=2.0, replicaCount=5 — --set and -f are merged, with values-prod.yaml overriding replicaCount and --set image.tag=2.0 overriding the image tag.

Answer

image.tag=latest, replicaCount=5 — because -f files always take precedence over --set flags.

Answer

image.tag=2.0, replicaCount=2 — because supplying any -f file causes Helm to ignore replicaCount from prod values.

Answer

The command fails because --set and -f cannot be combined in the same helm upgrade invocation.

Question 8

You need to deploy a set of Kubernetes resources (Deployment, Service, ConfigMap) to an AKS cluster from files checked into source control. Which command applies them?

Accepted Answer

kubectl apply -f manifests/

Answer

az aks create --manifest path

Answer

az acr import --manifest path

Answer

kubectl create cluster -f path

Question 9

Your AKS-hosted AI service needs to autoscale pods based on GPU utilization metrics that aren't exposed by the default Kubernetes Metrics Server. What should you implement?

Accepted Answer

Custom metrics adapter feeding the HPA

Answer

Vertical Pod Autoscaler for CPU only

Answer

Cluster Autoscaler without any HPA

Answer

CronJob that restarts pods every five

Question 10

Which command retrieves the credentials needed for kubectl to communicate with an AKS cluster?

Accepted Answer

az aks get-credentials --resource-group myRG --name myCluster

Answer

az aks show --resource-group myRG --name myCluster --output json

Answer

kubectl config get-contexts --output name for all contexts

Answer

az acr credential show --name myregistry --resource-group myRG

13 questions