C_KYMD_01 Practice Exam Questions with Answers SAP Certified Development Associate - Side-by-Side Extensibility based on SAP BTP, Kyma runtime Certification

The kube-scheduler is a control plane process that assigns pods to nodes based on scheduling principles, such as resource requirements, affinity, anti-affinity, and more. The kube-scheduler watches for newly created pods that have no node assigned and selects an optimal node for each pod to run on. The kube-scheduler does not start pods, scale nodes, or schedule Cron Jobs. These are the responsibilities of other components, such as the kubelet, the cluster autoscaler, and the kube-controller-manager. References: Kubernetes Scheduler, kube-scheduler

 In a Kubernetes cluster, services are assigned a DNS name based on the following pattern: ..svc.cluster.local. This allows pods to access services within the same namespace or across namespaces using the fully qualified domain name (FQDN). The svc.cluster.local part is the default domain for the cluster, but it can be customized by the cluster administrator. References: Kubernetes Services, DNS for Services and Pods

Kubernetes is a powerful open-source system for managing containerized applications in a clustered environment. It was originally developed by Google, based on its experience of running production workloads at scale. Google open-sourced Kubernetes in 2014 and donated it to the Cloud Native Computing Foundation (CNCF), a vendor-neutral organization that promotes the development of cloud-native technologies. Since then, Kubernetes has become one of the most popular and widely adopted container orchestration platforms, with a large community of contributors and users. The other options are not correct, as they are not the original developers of Kubernetes, although they may have contributed to or used the project in some ways. References: The History of Kubernetes on a Timeline - RisingStack Engineering, How Kubernetes came to be: A co-founder shares the story - Google Cloud

Namespaces are used to isolate groups of resources in a Kubernetes cluster1. Namespaces provide a logical scope for resources, such as pods, services, deployments, and secrets. Namespaces can be used to separate different environments, teams, projects, or applications within the same cluster. Namespaces also enable resource quota management, access control, and service discovery within the cluster2. Namespaces are not the same as organizations and spaces, which are concepts used in Cloud Foundry to manage applications and services3. Semantic versioning is a convention for assigning version numbers to software releases, not a method for isolating resources. Object groups are not a native Kubernetes concept, but a term used in some tools or frameworks to group related resources. References: 1(https://learn.microsoft.com/en-us/azure/aks/operator-best-practices-cluster-isolation),  2(https://stackoverflow.com/questions/68314160/kubernetes-how-best-to-isolate-resources-based-on-environment-labels-and-sele),  3(https://packetpushers.net/4-methods-of-kubernetes-isolation/), ,

SAP BTP, Kyma runtime uses the following open-source projects to expose and analyze in-cluster telemetry data:

• Loki: Loki is a log aggregation system that collects logs from various sources and stores them in a scalable and queryable way. Loki is integrated with Grafana to provide a unified interface for log analysis1.
• Prometheus: Prometheus is a time-series database that collects metrics from instrumented applications and stores them in a time-series database. Prometheus is a pull-based system, which means that applications need to expose an endpoint from which Prometheus can scrape the metrics2.
• Grafana: Grafana is a visualization and analysis tool to visualize and query time-series data. With Grafana, you can create dashboards that show the current state of your applications. Grafana can easily visualize data from Prometheus, Loki, and other sources2.

References:

• 1: Accessing the built-in observability tools of Kyma runtime
• 2: Describing Observability in Kyma

 Jaeger and Kiali are part of the open-source Kyma project, but not of SAP BTP, Kyma runtime. Jaeger is a distributed tracing system that provides end-to-end visibility into the performance and behavior of microservices. Kiali is a service mesh observability and configuration tool that provides a graphical view of the topology and health of the services in the mesh. SAP BTP, Kyma runtime does not include these components, but instead relieson SAP BTP Application Logging and SAP BTP Application Monitoring services for observability and tracing. Prometheus and Istio, on the other hand, are both part of the open-source Kyma project and SAP BTP, Kyma runtime. Prometheus is a monitoring system that collects metrics from various sources and stores them in a time-series database. Istio is a service mesh that provides a uniform way to connect, secure, control, and observe services. References: 

https://learning.sap.com/learning-journey/deliver-side-by-side-extensibility-based-on-sap-btp-kyma-runtime

https://www.credly.com/org/sap/badge/sap-certified-development-associate-side-by-side-ex

SAP BTP, Kyma runtime provides a vendor-neutral integration point for traces, metrics, and logs, mainly using the OpenTelemetry Protocol (OTLP). For this option, the system you want to connect must support OTLP natively. The observability tools that support OTLP are Loki and Jaeger. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. Jaeger is a distributed tracing system that monitors and troubleshoots transactions in complex distributed systems. Kiali and Grafana are not part of the observability architecture of SAP BTP, Kyma runtime, but they can be installed separately if needed. References: From Observability to Telemetry – a strategy shift in SAP BTP, Kyma Runtime, Accessing the built-in observability tools of Kyma runtime, SAP Help Portal - SAP Online Help

 A one off/non parallel job is a workload type that runs a single task to completion and then terminates. This is suitable for running a database migration on SAP BTP, Kyma runtime, as it does not require scaling, persistence, or parallelism. A parallel job, on the other hand, is a workload type that runs multiple tasks in parallel and then terminates. This is useful for batch processing or data analysis, but not for database migration. A StatefulSet is a workload type that runs one or more pods that maintain a stable identity and persistent storage. This is useful for stateful applications such as databases or message brokers, but not for database migration. A DaemonSet is a workload type that runs one pod on each node in the cluster. This is useful for providing node-level services such as logging or monitoring, but not for database migration. References: Workload Concepts, Kubernetes Workloads

Stateless workloads are workloads that do not store any data or application state on the host that serves the requests. Instead, they rely on the information provided by the client or an external service, such as a database, to process each request independently. Stateless workloads do not keep any references to past transactions or interactions, and they can be handled by any available server. Stateless workloads are more scalable, fault-tolerant, and easier to manage than stateful workloads, which require persistent storage and session management. Some examples of stateless workloads are web servers, print servers, or microservices. References: Stateful vs stateless - Red Hat, Create stateless workloads | Google Distributed Cloud Hosted - Google Cloud, Stateless vs Stateful Kubernetes - WEKA

• The kyma-gateway is a custom-configured Istio Ingress Gateway that is installed in the kyma-system namespace. It is the central point of contact for all external traffic that enters the Kyma cluster.
• The kyma-gateway uses the Envoy Proxy as an application-based service proxy to handle the traffic and to forward it to the correct Service. Envoy Proxy is a high-performance proxy developed in C++ to mediate all inbound and outbound traffic for all services in the service mesh.
• Envoy Proxy supports dynamic service discovery, load balancing, TLS termination, HTTP/2 and gRPC proxies, health checks, staged rollouts, fault injection, and rich metrics.

References:

• Using the API Gateway to Expose Services
• Extending on-premise systems via Kyma runtime
• SAP BTP, Kyma Runtime API Gateway future architecture based on Istio
• Exposing a Service in Kyma with API Rules

Kubernetes provides several primitives to manage storage in a cluster, such as Volumes, Persistent Volumes, Storage Classes, and Volume Snapshot Classes. Volumes are the basic unit of storage that can be attached to a Pod and provide data persistence across Pod restarts. Persistent Volumes are cluster-wide resources that represent a piece of storage that has been provisioned by an administrator or dynamically using Storage Classes. Storage Classes are a way for administrators to describe the classes of storage they offer and allow users to request a specific class for their Persistent Volume Claims. Volume Snapshot Classes are a way to specify different policies for creating volume snapshots, such as retention, encryption, or replication. References: https://kubernetes.io/docs/concepts/storage/storage-classes/

https://kubernetes.io/docs/concepts/storage/persistent-volumes/

Istio is a service mesh that provides a uniform way to secure, connect, and monitor microservices running on different platforms and environments1. SAP BTP, Kyma runtime uses Istio as the default service mesh solution to enable the following benefits2:

• Networking is decoupled from the application logic. Istio handles the network traffic between services using a data plane composed of Envoy proxies that are injected as sidecars to each service Pod. This way, the application code does not need to deal with networking aspects such as routing, load balancing, authentication, or encryption3.
• Mutual TLS is supported for service to service communication. Istio enables mutual TLS (mTLS) by default for all services in the mesh, ensuring that the traffic is encrypted and authenticated. Istio also manages the certificates and keys for mTLS using a control plane component called Istiod4.
• Traffic management between services can be controlled. Istio allows defining and applying traffic policies, such as timeouts, retries, circuit breakers, fault injection, mirroring, or routing rules, using custom resources such as VirtualServices and DestinationRules. These policies can be dynamically configured and updated without requiring service restarts.

References:

• 1: Discovering Istio - SAP Learning
• 2: Upcoming breaking change in SAP BTP, Kyma Runtime: Enabling the Istio CNI plugin | SAP Blogs
• 3: Istio / The Istio service mesh
• 4: Istio / Secure your service mesh
• [5]: Istio / Traffic management overview

 The service mesh solution in SAP BTP, Kyma runtime is based on Istio, which is one of the most popular service mesh solutions. Istio uses the Sidecar proxy pattern, which means that a proxy is deployed as a sidecar container next to each service. This way, the proxy can intercept and manage the traffic between the services, without requiring any changes in the application code. The proxy also communicates with the Istio control plane, whichprovides configuration and policies for the service mesh. The other options are not valid proxy patterns for the service mesh solution in SAP BTP, Kyma runtime. References: Discovering the Service Mesh - SAP Learning, Istio Documentation - What is Istio?