Bookmarks
Bookmarks bar
CKA
0 · First 60 seconds
- kubectl quick reference
- The alias/completion block, and every imperative one-liner. The single highest-value page in the set.
- kubectl create — subcommands
- "Can I generate this instead of writing YAML?" — the list of what `create` can produce.
- API reference — object fields
- An exact field name or its nesting, when `kubectl explain --recursive` is not enough.
- kubectl for Docker users / command index
- You know the verb but not the flag, and the quick reference did not have it.
1 · Troubleshooting — 30%
- Cluster is broken — where to look
- Nodes NotReady, control-plane component down, API server unreachable.
- Static Pod manifests (control plane)
- apiserver/etcd/scheduler won't start — the manifest path and how the kubelet picks it up.
- crictl — containers below kubectl
- The API server itself is down and you need the container logs anyway.
- kubelet config file
- A kubelet flag or path is wrong and you need to know which file to fix.
- Node status and conditions
- Reading `describe node`: DiskPressure, MemoryPressure, what each condition means.
- Application not running
- Pending, CrashLoopBackOff, ImagePullBackOff — the triage order.
- Debug Pods
- A Pod is Pending or restarting and `describe` has not told you why yet.
- kubectl debug / ephemeral containers
- The image has no shell, or you need to poke at a running Pod from inside.
- Service has no endpoints
- Service exists, `get endpoints` is empty — the selector/port checklist.
- DNS resolution debugging
- Name resolution fails inside Pods; CoreDNS Pods or config suspect.
- metrics-server / kubectl top
- `kubectl top` errors, or the task asks you to report resource usage.
- Container logs and streams
- "Write the output stream of container X to a file" — where the logs actually live.
- System component logs
- journalctl vs /var/log — which component logs where.
2 · Cluster architecture — 25%
- etcd — BACK UP
- `etcdctl snapshot save` with the three TLS flags. Do not type this from memory.
- etcd — RESTORE
- `snapshot restore --data-dir`, then repoint the static Pod manifest.
- kubeadm upgrade — control plane
- Drain → unhold → plan → apply → kubelet → restart → uncordon, in that order.
- kubeadm upgrade — worker nodes
- `kubeadm upgrade node` — the step people skip after upgrading the control plane.
- Drain a node safely
- `--ignore-daemonsets`, `--delete-emptydir-data`, and when drain hangs.
- kubeadm join / create a cluster
- Add a node; regenerate a join token; where admin.conf goes.
- kubeadm token — new join command
- The join token expired: `kubeadm token create --print-join-command`.
- HA control-plane topologies
- Stacked vs external etcd — the distinction a question can turn on.
- kubeadm certificate renewal
- Expired control-plane certs; `kubeadm certs check-expiration`.
- RBAC — Role / RoleBinding YAML
- verbs, apiGroups, resourceNames — the exact spec shape.
- RBAC — imperative + auth can-i
- `create role/rolebinding` flags, and how to prove the binding works.
- ServiceAccount for a Pod
- Bind a role to a ServiceAccount and attach it to a workload.
- CertificateSigningRequest (user access)
- "Create a user and grant it access" — CSR YAML, approve, build the kubeconfig.
- kubeconfig — contexts and users
- `set-credentials` / `set-context` when you must hand back a working kubeconfig.
- CRDs — define a custom resource
- Install or inspect a CRD; `kubectl get crd`, scope, versions.
- Operator pattern
- A question frames a controller-plus-CRD as an operator.
- Extension interfaces — CNI / CSI / CRI
- Which interface owns what; where a CNI config file lives.
- Container runtimes (CRI setup)
- cgroup driver, containerd config, the socket path.
3 · Services & networking — 20%
- NetworkPolicy — the resource
- podSelector / ingress / egress / ports. Copy, then cut.
- NetworkPolicy — default deny
- "Deny all traffic except…" — the empty-selector policies.
- NetworkPolicy — walkthrough
- You want the worked example rather than the reference.
- Service — types and ports
- ClusterIP / NodePort / LoadBalancer; targetPort vs port vs nodePort.
- Endpoints and EndpointSlices
- Verifying a Service actually selected Pods.
- Ingress — the resource
- Path rules, pathType, backend service — the YAML to copy.
- IngressClass
- The Ingress is created but no controller picks it up.
- Gateway API (Kubernetes docs)
- GatewayClass → Gateway → HTTPRoute, on the allowed kubernetes.io domain.
- Gateway API — official site
- The upstream docs. Allowed for CKA only. Deep links move between releases — enter through the root.
- Gateway API — guides
- A worked HTTPRoute; simple gateway; traffic splitting.
- DNS for Services and Pods
- The FQDN form: svc.namespace.svc.cluster.local.
- CoreDNS customisation
- Editing the CoreDNS Corefile ConfigMap.
- Connect applications with a Service
- Expose a Deployment end to end, verified from a client Pod.
4 · Workloads & scheduling — 15%
- Deployment — rollout and rollback
- `rollout undo --to-revision`, `rollout history`, `rollout status`.
- Deployment — update strategy
- maxSurge / maxUnavailable placement in the spec.
- ConfigMap into a Pod
- envFrom vs valueFrom vs volume mount — all three shapes on one page.
- Secrets with kubectl
- `create secret generic --from-literal`, and reading one back.
- Probes — liveness / readiness / startup
- The probe block, including initialDelaySeconds and the exec form.
- Requests and limits
- resources: block; units for cpu and memory.
- HPA — walkthrough
- "Configure workload autoscaling" — `kubectl autoscale`, then verify.
- HPA — how it decides
- The v2 spec with metrics, if a target other than CPU is asked for.
- Taints and tolerations
- NoSchedule / PreferNoSchedule / NoExecute, and the toleration block.
- nodeSelector and node affinity
- required vs preferred — the nesting nobody remembers.
- Scheduling reference
- Pod affinity/anti-affinity and topologySpreadConstraints.
- PodDisruptionBudget
- minAvailable / maxUnavailable, usually paired with a drain task.
- DaemonSet
- One Pod per node, and why a drain needs --ignore-daemonsets.
- CronJob and Job
- schedule, restartPolicy, backoffLimit — `create cronjob` gets you most of it.
- Init containers
- A Pod must wait on something before its main container starts.
- ResourceQuota
- Pods in a namespace suddenly fail admission. Once a quota constrains cpu or memory, every Pod there must declare matching requests and limits.
- LimitRange — namespace defaults
- The other half of the quota trap: a LimitRange supplies the defaults that stop a quota rejecting every Pod.
5 · Storage — 10%
- PV and PVC — binding lifecycle
- The PVC is Pending: accessModes, size, storageClassName must all agree.
- PV / PVC YAML to copy
- A minimal volume spec you can edit down in seconds.
- PV walkthrough (hostPath)
- The full PV → PVC → Pod chain, which is the usual exam task.
- StorageClass
- provisioner, reclaimPolicy, volumeBindingMode.
- Change the default StorageClass
- The is-default-class annotation, exactly as spelled.
- Dynamic provisioning
- A PVC should create its PV rather than match an existing one.
- Volume types
- emptyDir, hostPath, configMap and secret volumes.
6 · Helm & Kustomize
- Kustomize with kubectl
- kustomization.yaml; `kubectl apply -k`; `kubectl kustomize` to preview.
- Helm — using Helm
- install / upgrade / rollback / uninstall and what each does.
- helm install
- `--set`, `-f values.yaml`, `--namespace --create-namespace`.
- helm upgrade
- `--install`, `--reuse-values`, and rolling a release forward.
- helm repo add
- Add and update a chart repository before installing from it.
- helm template
- "Show what this chart would apply" without touching the cluster.
- Charts — values and structure
- Where values.yaml sits and how overrides resolve.