5V0-23.20 Exam VMware vSphere with Tanzu Specialist

How can a vSphere administrator replace the Supervisor Cluster API endpoint certificate?

• Use the certificate-manager CLI utility to replace the Supervisor Cluster API endpoint certificate

• Use the vSphere Client to replace the Workload platform MTG certificate

• Use the vSphere Client to replace the NSX Load Balancer certificate

• Use kubectl to replace the Supervisor Cluster API endpoint certificate

Answer explanation

As a vSphere administrator, you can replace the certificate for the virtual IP address (VIP) to securely connect to the Supervisor Cluster API endpoint with a certificate signed by a CA that your hosts already trust. The certificate authenticates the Kubernetes control plane to DevOps engineers, both during login and subsequent interactions with the Supervisor Cluster.

Prerequisites

Verify that you have access to a CA that can sign CSRs. For DevOps engineers, the CA must be installed on their system as a trusted root.

Procedure

✑ In the vSphere Client, navigate to the Supervisor Cluster.

✑ Click Configure then under Namespaces select Certificates.

✑ In the Workload platform MTG pane, select Actions > Generate CSR.

✑ Provide the details for the certificate.

✑ Once the CSR is generated, click Copy.

✑ Sign the certificate with a CA.

✑ From the Workload platform MTG pane, select Actions > Replace Certificate.

✑ Upload the signed certificate file and click Replace Certificate.

✑ Validate the certificate on the IP address of the Kubernetes control plane

An administrator working in a vSphere with Tanzu environment wants to ensure that all persistent volumes configured by developers within a namespace are placed on a defined subset of datastores. The administrator has applied tags to the required datastores in the vSphere Client

Which action should the administrator take next to meet the requirement?

• Create a storage policy containing the tagged datastores. and apply it to the vSphere Namespace

• Create a storage class containing the tagged datastores. and apply it to the Supervisor Cluster

• Create a persistent volume claim containing the tagged datastores, and apply it to the vSphere Namespace

• Create a storage Policy containing the tagged datastores. and apply it to the Supervisor Cluster

Answer explanation

The vSphere administrator defines and assigns VM storage policies to a namespace:

• VM storage policies are translated into Kubernetes storage classes.

• Developers can access all assigned VM storage policies in the form of storage classes.

• Developers cannot manage storage classes.

Storage class names are created in the following way:

• Spaces in VM Storage Policy names are replaced with hyphens (-).

• Special characters are replaced with a digit. A VM Storage Policy called My Gold Policy $ is called my-gold-policy-0 as a storage class.

Which statement accurately describes the upgrade of a vSphere with Tanzu Supervisor Cluster?

• vCenter Server performs an in-place upgrade of the Supervisor Cluster control plane VMs

• vCenter Server orchestrates the rolling upgrade of Supervisory control plane VMs and upgrades the ESXi host spherelet component

• An administrator manually deploys new Supervisor Cluster control plane VMs and uses vSphere Lifecycle Manager to update the ESXi host spherelet component

• An administrator downloads and installs new RPMs to the Supervisor Cluster control plane VMs

How does Kubernetes implement the vSphere storage policy in vSphere with Tanzu?

• Storage class

• Paravirtual CSl

• Static Persistent Volume

• Persistent Volume

To which set of networks are the Supervisor Cluster nodes attached when deploying with an NSX-T network topology?

• Frontend and Workload

• Frontend and Management

• Management and NSX Overlay

• Workload and Management

Answer explanation

The Network Service has been extended to support the vSphere Distributed Switch (vDS). Start by configuring the switch with appropriate portgroups. Management will carry traffic between vCenter and the Kubernetes Control Plane (Supervisor Cluster control plane). As we will see in a moment, not having the built in Load Balancing capability of NSX means you will need to deploy your own load balancer externally from the cluster. We will give you a choice of integrated load balancers. The first one we support is HAProxy.

The Management network will also carry traffic between the supervisor cluster nodes and HAProxy. The Frontend network will carry traffic to the Load Balancer virtual interfaces. It must be routable from any device that will be a client for your cluster. Developers will use this to issue kubectl commands to the Supervisor cluster or their TKG clusters. You can have one or more Workload networks.

The primary Workload network will connect the cluster interfaces of the Supervisor cluster. Namespaces can be defined with their own Workload network allowing for isolation between development teams assigned different Namespaces. The Namespace assigned Workload Networks will connect the TKG cluster nodes in that Namespace.

What is the correct process to store images in a project on the Registry Service?

• Use the kubectl push command

• Use the docker push command

• Use the vSphere Client to upload the image the content library

• Use the vSphere Client to upload the image to the Registry Service

Answer explanation

Registry Service: Developers can store and manage Docker and OCI images using Harbor. Harbor is an open-source container image registry that secures images with role-based access control.

Procedure

✑ Login to Harbor Registry with the vSphere Docker Credential Helper. Note:While providing --user username is acceptable for login, you should use the UserPrincipalName (UPN) syntax ( --user [e-mail]) to login and use docker push commands.

✑ Tag the image that you want to push to the project in Harbor Registry with same name as the namespace, where you want to use it:

For example:

✑ uk.co.certification.simulator.questionpool.PList@d8e88b0

✑ To push an image to a project in Harbor, run the following command:Syntax: For example:

✑ uk.co.certification.simulator.questionpool.PList@d8e8960

Expected result.

✑ uk.co.certification.simulator.questionpool.PList@d8e89b0

A user needs to identify the namespaces that may be accessed.

Which command will provide the desired output?

• kubectl get storageclasses

• kubectl config use-context

• kubectl config get-contexts

• kubectl get contexts

Answer explanation

A user can have permissions on multiple namespaces. The kubectl commands are typically actioned against the current active namespace.

View the list of available namespaces:

kubectl config get-contexts

Change the current active namespace:

kubectl config use-context <namespace>

Which element defines the type of storage backing the Persistent Volume?

• Datastore Cluster

• Storage Class

• vVols

• Persistent Volume Claim

An organization is preparing to deploy vSphere with Tanzu and will be using the vSphere Networking stack.

How should the administrator allocate management network IP addresses for the Kubernetes Control Plane within the Supervisor Cluster?

• Four IP addresses are required, one for each of the Control Plane VMs and one spare for performing rolling cluster upgrades

• Three IP addresses are required, one for each of the Control Plane VMs

• Six IP addresses are required, one for each of the Control Plane VMs, one for the floating IP address of the Control Plane V one for performing rolling cluster upgrades and one for the image Registry V

• Five IP addresses are required, one for each of the Control Plane VMs. one for the floating IP address of the Control Plane VM, and one spare for performing rolling cluster upgrades

Answer explanation

Static IPs for Kubernetes control plane VMs

Block of 5A block of 5 consecutive static IP addresses to be assigned to the Kubernetes control plane VMs in the Supervisor Cluster

What is the minimum number of portgroups needed, in addition to the management portgroup. to provide connectivity for external services on a Supervisor Cluster?

• 1

• 4

• 3

• 2