Exam 3V0-24.25 Topic 1 Question 78 Discussion

Actual exam question for VMware's 3V0-24.25 exam
Question #: 78
Topic #: 1

A VKS Administrator is troubleshooting a failed package installation. A developer attempted to install the fluent-bit package, but the PackageInstall resource status reports a reconciliation failure.
The administrator inspects the PackageRepository status:
$ kubectl get packagerepository -n tkg-system
NAME AGE DESCRIPTION
private-repo 10m Reconcile failed: Error: Imgpkg: Fetching image:
Head "https://private-reg.corp.local/repo/packages:v1":
x509: certificate signed by unknown authority
The environment uses a private Harbor registry (private-reg.corp.local) signed by an internal Corporate Root CA.
What is the correct procedure to resolve this trust issue and allow the cluster to pull packages? (Choose
2.)

A. Reconfigure the TKG cluster by updating its TanzuKubernetesCluster spec to include the trust.additionalTrustedCAs field with the Corporate Root CA name/data. B. Disable TLS verification on the kapp-controller deployment by editing the deployment spec. C. Manually copy the CA certificate to /etc/ssl/certs on every worker node and reboot them. D. Obtain the Corporate Root CA certificate in PEM format. E. Create a Kubernetes Secret of type Opaque (or generic) in the tkg-system namespace containing the CA certificate (key ca.crt), then reference this secret in the spec.fetch.imgpkgBundle.secretRef (or appropriate CA trust field if supported by the specific API version) of the PackageRepository YAML. Self- Correction/Refinement: The standard TKG way to trust a registry CA for the whole cluster (including containerd and kapp) is typically at cluster creation via the TkgServiceConfiguration or ClusterClass, OR by patching the cluster. However, for kapp-controller specific trust, referencing a CA secret or ensuring the node trusts it is key.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business