Nutanix Certified Professional (NCP) NCP-CN Release Date

The scenario describes an isolated environment in Antarctica, implying an air-gapped NKP deployment where the bastion host serves as the primary management point for deploying and managing NKP clusters without Internet access. The NKPA course outlines the essential tools that must be installed on a bastion host to facilitate NKP deployment and management in such environments.

The required programs are kubectl and nkp:

kubectl: This is the Kubernetes command-line tool used to interact with Kubernetes clusters, essential for managing cluster resources, debugging, and applying configurations during and after deployment.

nkp: The NKP CLI (nkp) is the primary tool for deploying, managing, and scaling NKP clusters, including creating bootstrap clusters, deploying clusters, and managing platform applications. In an air-gapped setup, the nkp CLI is critical for executing deployment commands using the Air-Gapped Bundle.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For an air-gapped NKP deployment, ensure the bastion host has kubectl and the nkp CLI installed to manage the deployment process and interact with the resulting Kubernetes clusters.” These tools are sufficient for the engineer to deploy and operate NKP in an isolated environment.

Incorrect Options:

A. awscli and nkp: The awscli is specific to AWS environments, but the question does not specify AWS infrastructure. Additionally, in an isolated environment, awscli is less relevant without Internet access.

B. oc and kubectl: oc is the OpenShift CLI, not used for NKP deployments. NKP uses nkp CLI instead.

C. oc and az: az is the Azure CLI, and oc is for OpenShift—neither is relevant to NKP deployment.

The NKPA course outlines the specifics of integrating Azure Kubernetes Service (AKS) with NKP, focusing on fleet management and the deployment architecture. The correct statements are:

Existing AKS clusters must be attached to the Management cluster (Option A):NKP does not provision AKS clusters directly because AKS is a managed Kubernetes service. Instead, NKP attaches existing AKS clusters to its management plane for centralized management. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For AKS integration, existing AKS clusters must be attached to the NKP Management cluster using the Attach Cluster functionality, as NKP does not provision AKS clusters.” This involves creating a service account with cluster-admin permissions in the AKS cluster and providing its kubeconfig to NKP.

NKP Management cluster with the Kommander component must be installed before installing NKP on AKS cluster (Option C):The Kommander component is part of the NKP Management cluster and provides the centralized management plane for fleet management, including AKS clusters. The NKPA course specifies that an NKP Management cluster with Kommander must be deployed before attaching or managing external clusters like AKS. The NCP-CN 6.10 Study Guide notes: “An NKP Management cluster with Kommander must be installed prior to integrating AKS clusters, as Kommander enables the fleet management capabilities for external clusters.”

Incorrect Options:

B. AKS best practices encourage building customized images: AKS best practices recommend using the default node images provided by Azure, which are optimized for AKS features like autoscaling and security. Custom images can lead to loss of functionality, as noted in previous questions (e.g., Q91).

D. AKS clusters can be deployed as Management or Pro NKP clusters: AKS clusters are attached, not deployed, by NKP. Additionally, AKS clusters cannot serve as NKP Management clusters; the Management cluster must be deployed on supported infrastructure like Nutanix AHV, AWS, or vSphere. “Pro NKP clusters” is not a valid term in NKP documentation—Pro refers to a license tier, not a cluster type.

As per the NKPA 6.10 documentation, the standard and supported approach for installing Kommander on an NKP cluster is using the NKP CLI. The CLI provides commands for deploying Kommander and associated platform components as part of the cluster lifecycle management workflow.

Key Reference:

“The recommended approach to deploy Kommander is by using the nkp CLI, which ensures compatibility and streamlined installation with the rest of the Nutanix Kubernetes Platform stack.”

The NKPA course covers user authentication for NKP clusters as part of Day 2 operations, emphasizing integration with external identity providers (IdPs) to manage user access securely. NKP uses Dex, an OpenID Connect (OIDC) identity provider, to facilitate authentication by acting as a connector between the Kubernetes cluster and external IdPs, such as LDAP, SAML, or OAuth-based systems.

The course explains that to set up user authentication, a Platform Engineer must configure a Dex connector to the user base’s identity provider. Dex integrates with the Kubernetes API server to enable OIDC-based authentication, allowing users to log in using their IdP credentials. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP supports user authentication through Dex, which provides OIDC integration with external identity providers, enabling single sign-on (SSO) for cluster access.” The process involves deploying Dex as a platform application, configuring the IdP connector (e.g., specifying client IDs, secrets, and endpoints), and updating the Kubernetes API server to use OIDC authentication.

Incorrect Options:

A. Enable Gatekeeper and create a connector to the user base’s identity provider: Gatekeeper is a Kubernetes policy engine used for enforcing admission control policies, not for authentication. The NKPA course does not associate Gatekeeper with user authentication.

B. Disable native NKP authentication, enable Traefik, and create a connector to the user base’s identity provider: Traefik is an ingress controller for managing external traffic, not authentication. Disabling native authentication is unnecessary, as NKP supports OIDC alongside native methods. The NKPA course does not mention Traefik in the context of authentication.

C. Create a MetalLB connector to the user base’s identity provider: MetalLB is a load balancer for bare-metal Kubernetes clusters, not an authentication component. This option is irrelevant, as per the NKPA course.