KCNA - Container Orchestration (28% of the exam) - Section 2.1
Describe the Kubernetes networking model and how Services expose workloads.
The flat pod network requirement, Service types (ClusterIP, NodePort, LoadBalancer, ExternalName), kube-proxy, cluster DNS, and Ingress as layer-7 routing. Candidates should be able to pick the right Service type for a stated exposure requirement.
A platform engineer is comparing the pluggable interfaces Kubernetes relies on. One interface defines how Pod network connectivity is configured, including allocating each Pod an IP address and attaching it to the cluster network. Which interface provides this function?
AContainer Runtime Interface (CRI), the standard that lets the kubelet manage containers through pluggable container runtimes.
BContainer Storage Interface (CSI), the standard that lets external storage systems attach and mount persistent volumes into Pods.
CService Mesh Interface (SMI), the specification that standardises traffic policy and telemetry across service mesh implementations.
DContainer Network Interface (CNI), the standard that plugins implement to set up Pod network connectivity and IP allocation.check_circle Correct
Distinguish the Container Network Interface from CRI, CSI, and SMI as the interface responsible for Pod networking. Kubernetes itself does not implement pod networking; it calls a CNI plugin when a Pod is created, and that plugin allocates the Pod IP and wires the Pod into the cluster network defined by the CNI specification.
Why A is wrong: Tempting because CRI is another container-layer interface the kubelet depends on, but it governs starting and stopping containers, not assigning Pod IP addresses.
Why B is wrong: Tempting because CSI is a similarly named pluggable interface, but it handles persistent storage provisioning and mounting rather than network connectivity.
Why C is wrong: Tempting because SMI relates to network traffic, but it defines higher-level mesh policy and does not assign Pod IPs or configure the base pod network.
Why D is correct: Correct because Kubernetes delegates pod networking to CNI plugins, which assign each Pod an IP and connect it to the cluster network according to the CNI specification.
Answers that look right on this material and are not. Each one is a distractor from a different question in the KCNA bank for this domain.
kube-proxy, which programmes iptables or IPVS rules on each node to forward Service traffic to backing Pods.
errorWhy it is wrong: Tempting because kube-proxy is central to how Service traffic actually reaches Pods, but it forwards packets based on virtual IPs and never performs name-to-IP resolution.
A NodePort Service replaces the ClusterIP entirely, so the Service ends up with no in-cluster virtual IP of its own.
errorWhy it is wrong: Tempting because NodePort adds external reachability, but it is layered on top of a ClusterIP rather than replacing it, so the internal virtual IP still exists.
kube-proxy, which programs the node routing rules that back each Service virtual IP.
errorWhy it is wrong: kube-proxy is tempting because it underpins Service connectivity, but the virtual IP already works, which proves kube-proxy is routing correctly; the failure is turning a name into that IP, which is not kube-proxy's job.