Docker Updated DCA Exam Questions and Answers by corey

= Creating a collection for each application is not a way to accomplish this. A collection is a term used by Ansible to describe a package of related content that can be used to automate the management of Kubernetes resources1. A collection is not a native Kubernetes concept and does not group resources together within the cluster. To group Kubernetes-specific resources, such as secrets, for each application, you need to use namespaces. A namespace is a logical partition of the cluster that allows you to isolate resources and apply policies to them2. You can create a namespace for each application and store the secrets and other resources in that namespace. This way, you can prevent conflicts and limit access to the resources of each application. To create a namespace, you can use the kubectl create namespace command or a yaml file2. To create a secret within a namespace, you can use the kubectl create secret command with the --namespace option or a yaml file with the metadata.namespace field3. References:

• Kubernetes Collection for Ansible - GitHub
• Namespaces | Kubernetes
• Secrets | Kubernetes
• Managing Secrets using kubectl | Kubernetes

The command docker inspect nodes will not list all nodes in a swarm cluster from the command line. This is because docker inspect requires one or more names or IDs of the objects to inspect1. To list all nodes in a swarm cluster, you need to use the command docker node ls2, which will display information such as node ID, hostname, status, availability, and role3. References:

• docker inspect | Docker Docs
• docker node ls | Docker Docs
• How to list nodes in a Docker swarm cluster

To trust a self-signed certificate from a Docker Trusted Registry (DTR), you need to place the certificate in the appropriate location on all cluster nodes and restart the Docker daemon. There are two possible locations for the certificate, depending on your OS and Docker version1:

•/etc/docker/certs.d/dtr.example.com/ca.crt: This is the preferred location for Linux systems and Docker versions 1.13 and higher. This directory is scanned by Docker for certificates and keys for each registry domain2.

•Your OS certificate path: This is the fallback location for other OSes and Docker versions. You need to find the certificate store for your OS and copy the certificate there. You also need to trust the certificate system-wide, which may require additional steps depending on your OS3.

The other options are not correct because:

•Passing '-trust-certificate ca.crt to the Docker client is not a valid option. There is no such flag for the Docker client4.

•Placing the certificate in ‘/etc/docker/dtr/dtr.example.com.crt’ is not a valid location. The certificate should be in the /etc/docker/certs.d directory, not the /etc/docker/dtr directory1.

•Passing – insecure-registry to the Docker client is not a recommended option. This flag disables the TLS verification for the registry, which makes the communication insecure and vulnerable to attacks.

References:

•Use self-signed certificates | Docker Docs

•Test an insecure registry | Docker Docs

•Add TLS certificates as a trusted root authority to the host OS | Docker Docs

•docker | Docker Docs

•[Deploy a registry server | Docker Docs]

= Mirroring the engineering/api repository to one of the user’s own private repositories will not grant them read/write access to the original repository. Mirroring is a feature that allows users to automatically sync images from one repository to another, either within the same DTR or across different DTRs. Mirroring does not affect the permissions or roles of the users or teams associated with the source or destination repositories. To grant a user read/write access to the engineering/api repository, the user needs to be added to a team that has the appropriate role for that repository, or the repository needs to be configured with the appropriate visibility and access settings. References:

• Mirror repositories
• Manage access to repositories
• Manage teams