2V0-71.23 Questions and Answers

VMware Tanzu Kubernetes Grid is an enterprise-ready Kubernetes runtime that streamlines operations across multi-cloud infrastructure1. Tanzu Kubernetes Grid natively integrates with the following VMware products:

• NSX Advanced Load Balancer: A solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters. NSX Advanced Load Balancer can be used as the default load balancer provider for both management and workload clusters on vSphere, AWS, Azure, and other platforms2.
• NSX-T Data Center: A network virtualization and security platform that provides consistent networking and security for applications running across private and public clouds. NSX-T Data Center can be used as the default network plugin for both management and workload clusters on vSphere, AWS, Azure, and other platforms3.
• vSphere with VMware Tanzu: A solution that enables you to run Kubernetes workloads natively on a vSphere cluster, and to provision and manage Kubernetes clusters using the vSphere Client. vSphere with VMware Tanzu can be used as the platform to deploy Tanzu Kubernetes Grid management clusters and workload clusters4.

The other options are incorrect because:

• BOSH is an open-source tool that provides release engineering, deployment, lifecycle management, and monitoring of distributed systems. BOSH is not a VMware product, nor does it natively integrate with Tanzu Kubernetes Grid5.
• vRealize Network Insight is a solution that delivers intelligent operations for software-defined networking and security. It helps optimize network performance and availability with visibility and analytics across virtual and physical networks. vRealize Network Insight is not natively integrated with Tanzu Kubernetes Grid6.
• Tanzu Mission Control is a centralized management platform for consistently operating and securing your Kubernetes infrastructure and modern applications across multiple teams and clouds. Tanzu Mission Control is not natively integrated with Tanzu Kubernetes Grid, but rather works with it as a separate product7.

References: VMware Tanzu Kubernetes Grid Overview, NSX Advanced Load Balancer, NSX-T Data Center, vSphere with VMware Tanzu, BOSH, vRealize Network Insight, Tanzu Mission Control Overview

VMware Tanzu Service Mesh Advanced is the VMware product UI that allows browsing Global Namespace Topology. A Global Namespace is a logical group of services that span multiple clusters and clouds, providing consistent service discovery, security, and observability10. A Global Namespace Topology is a graphical representation of the services and their connections in a Global Namespace, showing the key metrics and health status of each service11. To browse the Global Namespace Topology, an administrator can use the Tanzu Service Mesh Console, which is the web-based user interface for managing Tanzu Service Mesh12.

The other options are incorrect because:

• NSX Advanced Load Balancer is a VMware product that provides load balancing, web application firewall, and container ingress services for applications across various data centers and clouds13. It does not allow browsing Global Namespace Topology.
• NSX is a VMware product that provides network virtualization and security for applications across various data centers and clouds. It does not allow browsing Global Namespace Topology.
• Tanzu Mission Control is a VMware product that provides centralized management and governance for Kubernetes clusters across multiple teams and clouds. It does not allow browsing Global Namespace Topology.

References: Global Namespaces, View the Topology of Services in a Global Namespace or a Cluster, Tanzu Service Mesh Console Overview, NSX Advanced Load Balancer Overview, [NSX-T Data Center Overview], [Tanzu Mission Control Overview]

The command that can be used to upgrade a VMware Tanzu Kubernetes Cluster that is managed by VMware Tanzu Mission Control is tmc cluster upgrade [version] . This command allows you to upgrade a managed cluster to a newer version of Kubernetes that is supported by Tanzu Mission Control5. The version flag is optional and specifies the target version of Kubernetes. If not specified, the command upgrades the cluster to the latest available version5. The clustername argument is required and specifies the name of the cluster to upgrade5. References: Upgrade Kubernetes on Your Cluster - VMware Docs

Antrea is the default CNI for new Tanzu Kubernetes Grid workload clusters8. Antrea is an open-source Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the data plane9. Antrea supports various features such as network policies, service load balancing, NodePortLocal, IPsec encryption, IPv6 dual-stack, and more10.

The other options are incorrect because:

• Multus CNI is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods11. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.
• Flannel is an open-source simple and easy-to-use overlay network that satisfies the Kubernetes requirements12. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.
• Calico is an open-source network and network security solution for containers, virtual machines, and native host-based workloads13. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

References: Tanzu Kubernetes Grid Cluster Networking, Antrea, Antrea Features, Multus CNI, Flannel, Calico

Two components that are installed on the target cluster when VMware Tanzu Mission Control Data Protection is enabled are Velero and data protection extension. VMware Tanzu Mission Control Data Protection is a feature that allows users to backup and restore Kubernetes resources and persistent volumes across clusters using a centralized management platform6. To enable data protection for a cluster, users need to install Velero and data protection extension on the cluster7. Velero is an open source tool that performs backup and restore operations using custom resource definitions and controllers6. Data protection extension is a component that enhances Velero’s functionality by providing additional features such as backup scheduling, retention policy, backup hooks, restore hooks, and backup encryption8. References: Data Protection - VMware Docs, Protecting Data - VMware Docs, Enable Data Protection for a Cluster - VMware Docs

To create a vSphere Namespace, the correct steps are to use the vSphere web client, select Workload Management, select Namespaces tab, and click Create Namespace. A vSphere Namespace is a logical grouping of Kubernetes resources that can be used to isolate and manage workloads on a Supervisor Cluster1. To create a vSphere Namespace, a user needs to have the vSphere Client and the required privileges to access the Workload Management menu and the Namespaces tab2. From there, the user can select the Supervisor Cluster where to place the namespace, enter a name for the namespace, configure the network settings, set the resource limits, assign permissions, and enable services for the namespace2. References: Create and Configure a vSphere Namespace - VMware Docs, vSphere with Tanzu Concepts - VMware Docs

The object in Kubernetes used to grant permissions to a cluster-wide resource is ClusterRoleBinding. A ClusterRoleBinding is a cluster-scoped object that grants permissions defined in a ClusterRole to one or more subjects, such as users, groups, or service accounts5. A ClusterRole is a cluster-scoped object that defines a set of permissions on cluster-scoped resources (like nodes) or namespaced resources (like pods) across all namespaces5. For example, a ClusterRoleBinding can be used to allow a particular user to run kubectl get pods --all-namespaces by granting them the permissions defined in a ClusterRole that allows listing pods in any namespace6. References: Using RBAC Authorization | Kubernetes, Cluster Roles and Cluster Roles Binding in Kubernetes | ANOTE.DEV

The statement that correctly describes a global namespace in VMware Tanzu Service Mesh is that it defines an application boundary and provides consistent traffic routing, connectivity, resiliency, and security for applications across multiple clusters. A global namespace is a logical abstraction of an application from the underlying infrastructure that spans across multiple clusters and clouds4. A global namespace connects the resources and workloads that make up the application into one virtual unit and manages their identity, discovery, connectivity, security, and observability4. A global namespace also enables automatic service discovery and cross-cluster communication within the application boundary4. References: Global Namespaces - VMware Docs

The command that has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI is tanzu cluster scale --controlplane-machine-count 5 --worker-machine-count 10. The tanzu cluster scale command allows users to manually scale the number of control plane and worker nodes in a cluster5. The --controlplane-machine-count flag specifies the desired number of control plane nodes, while the --worker-machine-count flag specifies the desired number of worker nodes5. The other commands are invalid because they either use incorrect flags or omit the namespace flag when required5. References: Scale Clusters - VMware Docs

VMware Tanzu Mission Control (TMC) is a centralized management platform for consistently operating and securing your Kubernetes infrastructure and modern applications across multiple teams and clouds1. TMC provides a catalog of curated open-source software packages that you can deploy to your clusters with a few clicks2. To deploy an application to a Kubernetes cluster using TMC catalog, you need to follow these steps3:

• From the TMC Console, navigate to Catalog.
• Select the package that you want to install from the list of available packages. You can filter the packages by name, provider, or category.
• Click Install Package to start the installation wizard.
• On the Installation Settings page, specify the following information:
• Click Install to confirm the installation settings and start the installation process.
• Wait for the installation to complete. You can monitor the progress and status of the installation on the Package Instances page.

The other options are incorrect because:

• From the TMC Console, in Catalog, from Available Tanzu Packages, specify the target cluster and the package to install is false. There is no such option as Available Tanzu Packages in the TMC Console. The correct option is Install Package.
• Using the Tanzu CLI, enter the command tanzu package install is false. The Tanzu CLI is a command-line tool that allows you to interact with Tanzu Kubernetes Grid clusters and packages4. It is not related to TMC or its catalog.
• Using the TMC CLI, enter the command tmc cluster tanzupackage create is false. There is no such command as tmc cluster tanzupackage create in the TMC CLI. The TMC CLI is a command-line tool that allows you to interact with TMC and its resources5. It does not support installing packages from the catalog.

References: VMware Tanzu Mission Control Overview, Catalog Overview, Install a Package from Catalog, Tanzu CLI Overview, TMC CLI Overview

The type of policy that can be used to enforce the container controls is image security. Image security policies allow users to define rules for validating container images before they are deployed on clusters. Users can specify image names, tags, signatures, or digests to whitelist or blacklist images based on their source and integrity. Users can also enable or disable image scanning for vulnerabilities and configure the severity threshold for admission decisions. References: Image Security Policy - VMware Docs, Image Policy - VMware Docs

Kubernetes observability is the ability to monitor and analyze the performance, health, and behavior of Kubernetes clusters and applications. It provides visibility into Kubernetes clusters for troubleshooting and impact assessment, by collecting logs, events, traces, and alerts from various sources. It also collects real-time metrics from all layers of Kubernetes, such as nodes, pods, containers, services, and network policies, and displays them in dashboards and charts. Kubernetes observability helps administrators and developers to identify and resolve issues, optimize resource utilization, and ensure service quality and reliability. References: VMware Tanzu Observability Documentation, What is Kubernetes Observability?

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps:

• Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1
• Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2

References: 1: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html  2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh-enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html