KCNA Exam Dumps : Kubernetes and Cloud Native Associate

The READY column in the output of kubectl get pods indicates how many containers in a Pod are currently considered ready to serve traffic, compared to the total number of containers defined in that Pod. A value of 0/1 means that the Pod has one container, but that container is not yet marked as ready. The Kubernetes feature responsible for determining this readiness state is the readiness probe.

Readiness probes are used by Kubernetes to decide when a container is ready to accept traffic. These probes can be configured to perform HTTP requests, execute commands, or check TCP sockets inside the container. If a readiness probe is defined and it fails, Kubernetes marks the container as not ready, even if the container is running successfully. As a result, the READY column will show 0/1, and the Pod will be excluded from Service load balancing until the probe succeeds.

Option A (Node Selector) is incorrect because node selectors influence where a Pod is scheduled, not whether its containers are considered ready after startup. Option C (DNS Policy) affects how DNS resolution works inside a Pod and has no direct impact on readiness reporting. Option D (Security Contexts) define security-related settings such as user IDs, capabilities, or privilege levels, but they do not control the READY status shown by kubectl.

Readiness probes are particularly important for applications that take time to initialize, load configuration, or warm up caches. By using readiness probes, Kubernetes ensures that traffic is only sent to containers that are fully prepared to handle requests. This improves reliability and prevents failed or premature connections.

According to Kubernetes documentation, a container without a readiness probe is considered ready by default once it is running. However, when a readiness probe is defined, its result directly controls the READY state. Therefore, the presence and behavior of readiness probes is the verified and correct reason why a Pod may show 0/1 in the READY column, making option B the correct answer.

Kubernetes provides “virtual clusters” within a single physical cluster primarily through Namespaces, so A is correct. Namespaces are a logical partitioning mechanism that scopes many Kubernetes resources (Pods, Services, Deployments, ConfigMaps, Secrets, etc.) into separate environments. This enables multiple teams, applications, or environments (dev/test/prod) to share a cluster while keeping their resource names and access controls separated.

Namespaces are often described as “soft multi-tenancy.” They don’t provide full isolation like separate clusters, but they do allow administrators to apply controls per namespace:

RBAC rules can grant different permissions per namespace (who can read Secrets, who can deploy workloads, etc.).

ResourceQuotas and LimitRanges can enforce fair usage and prevent one namespace from consuming all cluster resources.

NetworkPolicies can isolate traffic between namespaces (depending on the CNI).

Containers are runtime units inside Pods and are not “virtual clusters.” Hypervisors are virtualization components for VMs, not Kubernetes partitioning constructs. cgroups are Linux kernel primitives for resource control, not Kubernetes virtual cluster constructs.

While there are other “virtual cluster” approaches (like vcluster projects) that create stronger virtualized control planes, the built-in Kubernetes mechanism referenced by this question is namespaces. Therefore, the correct answer is A: Namespaces.

=========

Kubernetes commonly authenticates users using OpenID Connect (OIDC) when JSON Web Tokens (JWTs) are involved, so A is correct. OIDC is an identity layer on top of OAuth 2.0 that standardizes how clients obtain identity information and how JWTs are issued and validated.

In Kubernetes, authentication happens at the API server. When OIDC is configured, the API server validates incoming bearer tokens (JWTs) by checking token signature and claims against the configured OIDC issuer and client settings. Kubernetes can use OIDC claims (such as sub, email, groups) to map the authenticated identity to Kubernetes RBAC subjects. This is how enterprises integrate clusters with identity providers such as Okta, Dex, Azure AD, or other OIDC-compliant IdPs.

Options B, C, and D are fabricated phrases and not real frameworks. Kubernetes documentation explicitly references OIDC as a supported method for token-based user authentication (alongside client certificates, bearer tokens, static token files, and webhook authentication). The key point is that Kubernetes does not “invent” JWT auth; it integrates with standard identity providers through OIDC so clusters can participate in centralized SSO and group-based authorization.

Operationally, OIDC authentication is typically paired with:

RBAC for authorization (“what you can do”)

Audit logging for traceability

Short-lived tokens and rotation practices for security

Group claim mapping to simplify permission management

So, the verified framework Kubernetes uses with JWTs for user authentication is OpenID Connect.

=========