kind lab — 12 tasks in 40 minutes
The practice tasks give you a scenario and a model answer, but no cluster to be wrong on.
This is the cluster. setup.sh builds a three-node kind cluster named cka
(context kind-cka, nodes cka-control-plane, cka-worker, cka-worker2), seeds the broken state the
troubleshooting tasks need, and check.sh grades all twelve the way the exam does — by end state, not by what you typed.
setup.sh check.sh
Needs kind, kubectl, and podman (RUNTIME=docker for Docker).
First run creates the cluster and installs Calico, so that task 6 is graded by a CNI that enforces NetworkPolicy — kindnet
does not.
chmod +x setup.sh check.sh
./setup.sh # create (first time) or reset, then seed
# ... 40 minutes ...
./check.sh # PASS/FAIL per task, with the reason
Budget: 40 minutes for 12 tasks, which is a little tighter than the real 7 minutes each — deliberately, because there is
no reading-the-prompt overhead here. Run the whole set in one sitting with the clock going; each row also links to its
timed version with the model solution. Re-running setup.sh resets everything, so the set can be drilled until the
troubleshooting pair takes under five minutes together.
| # | Domain | Task | Budget |
|---|---|---|---|
| 1 | workloads-scheduling | kind lab 1 · Deployment with requests In namespace apps, create Deployment api: image nginx:1.27-alpine, 3 replicas, container requests cpu 100m / memory 64Mi. | 3 min · 4 pt |
| 2 | workloads-scheduling | kind lab 2 · Rolling update, then roll back Roll Deployment api (namespace apps) to image nginx:1.28-alpine, wait for the rollout, then roll it back to the previous revision. | 2 min · 3 pt |
| 3 | workloads-scheduling | kind lab 3 · Pin a Pod to a node In namespace apps, create Pod pinned (image nginx:1.27-alpine) that must run on node cka-worker2. | 2 min · 3 pt |
| 4 | workloads-scheduling | kind lab 4 · Taint a node, tolerate it, land on it Taint node cka-worker with dedicated=db:NoSchedule. Then in namespace apps create Pod db (image redis:7-alpine) that tolerates that taint and runs on cka-worker. | 3 min · 4 pt |
| 5 | services-networking | kind lab 5 · Expose a Deployment Expose Deployment api (namespace apps) as a ClusterIP Service api-svc: Service port 8080, container port 80. | 2 min · 3 pt |
| 6 | services-networking | kind lab 6 · Allow one label, deny the rest Namespace secure has Pod web (label app=web) behind a Service. Write a NetworkPolicy so that only Pods labelled access=granted can reach web on port 80. All other ingress to web must be blocked. | 4 min · 6 pt |
| 7 | storage | kind lab 7 · PV → PVC → Pod, with a file to prove it Create a 1Gi hostPath PersistentVolume pv-data (path /mnt/data, accessMode ReadWriteOnce, storageClassName manual) and a PVC pvc-data in namespace storage that binds to it. Create Pod data-pod (busybox:1.36, command sleep 3600) mounting the PVC at /data, and make /data/hello.txt contain cka. | 5 min · 7 pt |
| 8 | workloads-scheduling | kind lab 8 · ConfigMap and Secret as env In namespace apps, create ConfigMap app-config with MODE=prod and Secret db-secret with password=s3cret. Create Pod cfg-pod (busybox:1.36, sleep 3600) with env var MODE from the ConfigMap key and DB_PASSWORD from the Secret’s password key. | 3 min · 4 pt |
| 9 | cluster-architecture | kind lab 9 · Least-privilege ServiceAccount In namespace apps, create ServiceAccount ci and give it — via a Role and RoleBinding — permission to create and list Deployments only. It must not be able to delete Pods or read Secrets. | 4 min · 5 pt |
| 10 | troubleshooting | kind lab 10 · Deployment down and Service dark In namespace trouble, Deployment broken has no Ready Pods and Service broken-svc receives no traffic. Fix both so that 2 Pods are Ready and the Service has 2 endpoints. | 5 min · 8 pt |
| 11 | troubleshooting | kind lab 11 · Node NotReady Node cka-worker2 is NotReady. Find the cause and return it to Ready. Node shell: podman exec -it cka-worker2 bash. | 4 min · 6 pt |
| 12 | cluster-architecture | kind lab 12 · etcd snapshot Save a snapshot of etcd to /var/lib/etcd/backup.db. The etcd certificates are in /etc/kubernetes/pki/etcd/. | 3 min · 5 pt |
How this differs from the exam
- Node access is
podman exec -it <node> bash, notssh. Everything you do inside the node is the same. etcdctlis not on the node. Run it inside the etcd Pod withkubectl -n kube-system exec etcd-cka-control-plane -- etcdctl …. The flags are identical.- kind has a default StorageClass
standard. Task 7 is written so that forgettingstorageClassNameproduces a Bound PVC on the wrong volume — the grader checks which volume. - The tasks are not independent, and 11 comes first.
cka-worker2is NotReady from the moment you start, so the Pod task 3 pins there stays Pending until you have fixed the kubelet. Solve 11 before 3. Beyond that: 2 depends on 1, 5 on 1, and 4 taints the node 3 does not use. The exam’s tasks are independent; treat the order here as given.