Container Network Interface (CNI) in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of a CNI plugin in Kubernetes?

Choose the best description of what a Container Network Interface (CNI) plugin does in a Kubernetes cluster.

A It schedules pods to nodes based on resource availability.

B It manages the network connectivity of containers, assigning IP addresses and setting up routes so pods can communicate.

C It stores container images and manages image versions.

D It monitors cluster health and restarts failed pods automatically.

💡 Hint

Think about how pods get their IP addresses and talk to each other.

The CNI plugin is responsible for setting up networking for containers, including IP address assignment and routing, enabling pod-to-pod communication.

💻 Command Output

intermediate

Output of 'kubectl get pods -o wide' with CNI plugin installed

What output would you expect from kubectl get pods -o wide if the CNI plugin is correctly installed and working?

Kubernetes

kubectl get pods -o wide

A

NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
app-1      1/1     Running   0          5m    10.244.1.5   node-1     <none>           <none>

B

NAME       READY   STATUS    RESTARTS   AGE   NODE       NOMINATED NODE   READINESS GATES
app-1      1/1     Running   0          5m    node-1     <none>           <none>

C Error from server (NotFound): pods not found

D

NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
app-1      0/1     Pending   0          5m    <none>       node-1     <none>           <none>

💡 Hint

Look for the presence of an IP address assigned to the pod.

When the CNI plugin is working, pods have IP addresses shown in the IP column. Without it, IP may be missing or pod status may be Pending.

❓ Configuration

advanced

Identify the error in this CNI configuration snippet

Given this CNI configuration JSON snippet, which option correctly identifies the error?

Kubernetes

{
  "cniVersion": "0.3.1",
  "name": "my-cni",
  "type": "bridge",
  "bridge": "cni0",
  "ipam": {
    "type": "host-local",
    "subnet": "10.244.0.0/16",
    "rangeStart": "10.244.0.10",
    "rangeEnd": "10.244.0.5",
    "routes": [{"dst": "0.0.0.0/0"}]
  }
}

A The rangeStart IP is greater than rangeEnd, which is invalid for IP allocation range.

B The routes field must be outside the ipam block.

C The cniVersion '0.3.1' is not supported by Kubernetes.

D The bridge name 'cni0' is reserved and cannot be used.

💡 Hint

Check the IP range values for logical order.

The IP range start must be less than or equal to the range end. Here, rangeStart is 10.244.0.10 but rangeEnd is 10.244.0.5, which is invalid.

❓ Troubleshoot

advanced

Troubleshooting pod network connectivity failure

A pod in your Kubernetes cluster cannot reach other pods on different nodes. You suspect a CNI plugin issue. Which command helps you check if the CNI plugin is installed and running on a node?

A kubectl get services

B kubectl get pods --all-namespaces

C kubectl describe node node-1

D kubectl get daemonset -n kube-system

💡 Hint

CNI plugins often run as daemonsets in the kube-system namespace.

Daemonsets in kube-system namespace usually run CNI plugins on all nodes. Checking daemonsets helps verify if the CNI plugin is deployed.

✅ Best Practice

expert

Best practice for upgrading a CNI plugin in a production cluster

What is the safest approach to upgrade a CNI plugin in a live Kubernetes cluster to avoid network downtime?

A Upgrade the CNI plugin on the master node only, then restart all worker nodes.

B Delete the existing CNI daemonset and immediately apply the new version to all nodes at once.

C Drain each node one by one, upgrade the CNI plugin daemonset, then uncordon the node before moving to the next.

D Stop all pods, upgrade the CNI plugin, then restart the cluster.

💡 Hint

Consider how to keep network available while upgrading nodes.

Draining nodes one at a time ensures pods are safely moved and network remains available. Upgrading daemonset per node avoids cluster-wide downtime.