Container Network Interface (CNI) in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of a CNI plugin in Kubernetes?

Choose the best description of what a Container Network Interface (CNI) plugin does in a Kubernetes cluster.

A It schedules pods to nodes based on resource availability.

B It manages the network connectivity of containers, assigning IP addresses and setting up routes so pods can communicate.

C It stores container images and manages image versions.

D It monitors cluster health and restarts failed pods automatically.

💡 Hint

Think about how pods get their IP addresses and talk to each other.

The CNI plugin is responsible for setting up networking for containers, including IP address assignment and routing, enabling pod-to-pod communication.

💻 Command Output

intermediate

Output of 'kubectl get pods -o wide' with CNI plugin installed

What output would you expect from kubectl get pods -o wide if the CNI plugin is correctly installed and working?

Kubernetes

kubectl get pods -o wide

A

NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
app-1      1/1     Running   0          5m    10.244.1.5   node-1     <none>           <none>

B

NAME       READY   STATUS    RESTARTS   AGE   NODE       NOMINATED NODE   READINESS GATES
app-1      1/1     Running   0          5m    node-1     <none>           <none>

C Error from server (NotFound): pods not found

D

NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
app-1      0/1     Pending   0          5m    <none>       node-1     <none>           <none>

💡 Hint

Look for the presence of an IP address assigned to the pod.

When the CNI plugin is working, pods have IP addresses shown in the IP column. Without it, IP may be missing or pod status may be Pending.

❓ Configuration

advanced

Identify the error in this CNI configuration snippet

Given this CNI configuration JSON snippet, which option correctly identifies the error?

Kubernetes

{
  "cniVersion": "0.3.1",
  "name": "my-cni",
  "type": "bridge",
  "bridge": "cni0",
  "ipam": {
    "type": "host-local",
    "subnet": "10.244.0.0/16",
    "rangeStart": "10.244.0.10",
    "rangeEnd": "10.244.0.5",
    "routes": [{"dst": "0.0.0.0/0"}]
  }
}

A The rangeStart IP is greater than rangeEnd, which is invalid for IP allocation range.

B The routes field must be outside the ipam block.

C The cniVersion '0.3.1' is not supported by Kubernetes.

D The bridge name 'cni0' is reserved and cannot be used.

💡 Hint

Check the IP range values for logical order.

The IP range start must be less than or equal to the range end. Here, rangeStart is 10.244.0.10 but rangeEnd is 10.244.0.5, which is invalid.

❓ Troubleshoot

advanced

Troubleshooting pod network connectivity failure

A pod in your Kubernetes cluster cannot reach other pods on different nodes. You suspect a CNI plugin issue. Which command helps you check if the CNI plugin is installed and running on a node?

A kubectl get services

B kubectl get pods --all-namespaces

C kubectl describe node node-1

D kubectl get daemonset -n kube-system

💡 Hint

CNI plugins often run as daemonsets in the kube-system namespace.

Daemonsets in kube-system namespace usually run CNI plugins on all nodes. Checking daemonsets helps verify if the CNI plugin is deployed.

✅ Best Practice

expert

Best practice for upgrading a CNI plugin in a production cluster

What is the safest approach to upgrade a CNI plugin in a live Kubernetes cluster to avoid network downtime?

A Upgrade the CNI plugin on the master node only, then restart all worker nodes.

B Delete the existing CNI daemonset and immediately apply the new version to all nodes at once.

C Drain each node one by one, upgrade the CNI plugin daemonset, then uncordon the node before moving to the next.

D Stop all pods, upgrade the CNI plugin, then restart the cluster.

💡 Hint

Consider how to keep network available while upgrading nodes.

Draining nodes one at a time ensures pods are safely moved and network remains available. Upgrading daemonset per node avoids cluster-wide downtime.

Practice

1. What is the main purpose of the Container Network Interface (CNI) in Kubernetes?

easy

A. To manage storage volumes for containers

B. To provide IP addresses and networking for pods

C. To schedule pods on nodes

D. To monitor container resource usage

Solution

1. Step 1: Understand CNI role in Kubernetes

   CNI is responsible for setting up networking so pods can communicate.

2. Step 2: Identify correct function

   Providing IP addresses and network connectivity to pods is the core function of CNI.

3. Final Answer:

   To provide IP addresses and networking for pods -> Option B

4. Quick Check:

   CNI = Pod networking [OK]

Hint: CNI is about pod networking, not storage or scheduling [OK]

Common Mistakes:

• Confusing CNI with storage management
• Thinking CNI schedules pods
• Assuming CNI monitors resources

2. Which of the following is a valid CNI configuration file format?

easy

A. XML

B. CSV

C. INI

D. JSON

Solution

1. Step 1: Recall CNI config formats

   CNI plugins use JSON or YAML files to configure networking.

2. Step 2: Identify valid format

   JSON is the standard format for CNI configuration files.

3. Final Answer:

   JSON -> Option D

4. Quick Check:

   CNI config = JSON [OK]

Hint: CNI configs are JSON or YAML, not XML or INI [OK]

Common Mistakes:

• Choosing XML as config format
• Confusing INI or CSV with CNI config
• Not knowing CNI uses JSON

3. Given this CNI config snippet:

{
  "cniVersion": "0.4.0",
  "name": "mynet",
  "type": "bridge",
  "bridge": "cni0",
  "ipMasq": true,
  "ipam": {
    "type": "host-local",
    "subnet": "10.22.0.0/16"
  }
}

What IP subnet will pods get addresses from?

medium

A. 172.16.0.0/12

B. 192.168.1.0/24

C. 10.22.0.0/16

D. None, IPs are assigned dynamically

Solution

1. Step 1: Locate subnet in config

   The subnet is specified inside the "ipam" section as "10.22.0.0/16".

2. Step 2: Understand IP assignment

   Pods will get IPs from the defined subnet range in the config.

3. Final Answer:

   10.22.0.0/16 -> Option C

4. Quick Check:

   Subnet in ipam = 10.22.0.0/16 [OK]

Hint: Look inside "ipam" for subnet to find pod IP range [OK]

Common Mistakes:

• Ignoring the subnet field
• Choosing default Kubernetes pod subnet
• Thinking IPs are random without subnet

4. You installed a CNI plugin but pods cannot communicate across nodes. What is a likely cause?

medium

A. CNI config file missing or incorrect

B. Pods have no CPU limits set

C. Kubernetes API server is down

D. Node disk space is full

Solution

1. Step 1: Analyze pod network failure

   Pods not communicating across nodes usually means network setup is broken.

2. Step 2: Check CNI config

   If the CNI config file is missing or wrong, networking won't work properly.

3. Final Answer:

   CNI config file missing or incorrect -> Option A

4. Quick Check:

   Network issues = CNI config problem [OK]

Hint: Check CNI config file first for network issues [OK]

Common Mistakes:

• Blaming CPU limits for network problems
• Assuming API server affects pod networking directly
• Ignoring CNI config correctness

5. You want to deploy a new CNI plugin that supports network policies and IP address management. Which step is NOT required?

hard

A. Restart the Kubernetes API server

B. Create a CNI configuration file in /etc/cni/net.d/

C. Install the CNI plugin binaries on all nodes

D. Ensure kubelet is configured to use the new CNI

Solution

1. Step 1: Understand CNI plugin deployment steps

   You must install plugin binaries, add config files, and configure kubelet to use it.

2. Step 2: Identify unnecessary step

   Restarting the Kubernetes API server is not needed for CNI plugin changes.

3. Final Answer:

   Restart the Kubernetes API server -> Option A

4. Quick Check:

   API server restart NOT needed for CNI install [OK]

Hint: API server restart not needed when changing CNI [OK]

Common Mistakes:

• Thinking API server restart is required
• Forgetting to install plugin binaries
• Not placing config in correct directory