Certified Kubernetes Administrator (CKA) with Practice Tests

We start with the core concepts, outlining the cluster architecture at a high level. We then introduce API primitives such as pods, replica sets, deployments, and services.

Explore the overall Kubernetes cluster architecture, from master and worker nodes to etcd, the kube API server, scheduler, controllers, kubelet, and kube proxy, with insights into container runtimes like Docker.

Trace the evolution from docker to containerd, the cri interface, and the docker shim removal, then learn nerdctl as a docker-like tool for containerd management.

Explain Docker deprecation in Kubernetes and how containerd as the CRI-compatible runtime enables Kubernetes to run without Docker, noting you can replace Docker commands with the node control command.

Explore etcd as a distributed, reliable key value store, compare it with relational and document stores, and learn to install and use etcd cuddle to put and get keys.

Discover how etcd stores Kubernetes cluster data—nodes, pods, configs, secrets, roles—and how deployment methods (from scratch or via kubeadm) affect etcd setup, TLS, and high availability.

Operate the kube api server as the central manager that authenticates and validates requests, updates etcd, and coordinates pod creation through the scheduler and kubelet.

Discover how the Kubernetes controller manager runs and configures controllers, including the node controller and replication controller, to monitor and remediate nodes and pods via the API server and options.

Discover how the kube scheduler decides which pod goes to which node, filters out incompatible nodes, and ranks candidates with a 0–10 score.

Explore the cubelet, the captain of a Kubernetes worker node, handling cluster registration, container loading, runtime interaction, and status reporting; learn manual kubelet installation, process checks, and TLS bootstrap basics.

Explore kube proxy in a Kubernetes cluster, enabling service access across nodes by iptables rules forwarding traffic from service IPs to backend pods; deployed as a daemonset on node.

Understand how pods encapsulate containers in Kubernetes, usually one container per pod, and scale by adding pods. Learn to deploy pods with kubectl and pull images from Docker Hub.

Create a pod using a yaml configuration with apiVersion, kind, metadata, and spec; define a single nginx container and deploy with kubectl, then check pods and describe the pod.

Create a pod via a yaml definition file, specifying apiVersion v1, kind pod, metadata with name and labels, and a single nginx container; apply with kubectl and verify.

Navigate the practice test portal to load labs, work in a live terminal, and complete topic quizzes that reinforce Kubernetes commands and configurations.

Demonstrate pod management with kubectl by listing, describing, and inspecting containers and images; create and edit pod definitions with yaml and fix image errors to run Redis.

Understand how replica sets manage pod replicas across nodes for high availability and load balancing, and learn to create, scale, and monitor them with kubectl.

Explore hands-on troubleshooting of replica sets in Kubernetes, diagnosing pod readiness, correcting the API version to apps/v1, aligning selectors with template labels, and scaling to manage pod counts.

Explore how Kubernetes deployments enable rolling updates and pause-resume upgrades for production environments. Create deployments from a deployment definition file, track replica sets and pods, and undo changes with kubectl.

Learn to manage Kubernetes deployments with kubectl: observe pods and replica sets, identify readiness, fix case-sensitive kinds, and create an httpd front end deployment with 3 replicas.

Explore how Kubernetes services enable pod-to-pod and external communication, mapping node ports to pod ports via selectors, and supporting node port, cluster IP, and load balancer types.

Learn how cluster IP services group front-end, back-end, Redis, and MySQL pods into a stable, name-based interface for internal pod communication.

Use the load balancer service type to present a single external URL for frontend apps, routing traffic from node ports to voting and result pods on supported cloud platforms.

This lecture walks through the Kubernetes services lab, analyzes the default cluster IP service, its target port 6443 and endpoints, and demonstrates creating a node port web app service.

Master Kubernetes namespaces, including default, kube-system, and kube-public, and learn to isolate resources, apply quotas, and enable cross-namespace service access via DNS.

Shows using kubectl to count namespaces, inspect pods in research, create a pod in finance, locate the blue pod in marketing, and access DB service across namespaces with full DNS.

Compare imperative and declarative approaches in Kubernetes, highlighting kubectl apply with configuration files. Learn how kubectl create, edit, replace, and delete differ from declarative management using YAML and apply.

Learn to use kubectl explain to inspect resource fields in the terminal, list resources with kubectl api resources, and view complete fields with the recursive flag to generate YAML files.

Practice imperative kubectl commands to create pods, services, and deployments, including labeling, exposing with cluster IP, and managing namespaces for exam preparation.

Learn how kubectl apply compares local configuration, live object state, and the last applied configuration to create or update Kubernetes objects declaratively, while tracking changes via a last applied annotation.

Stay focused on the course labs and videos to maximize learning efficiency, avoiding premature local setup until the course completes, and follow a clear path to success.

Explore scheduling in Kubernetes by configuring multiple schedulers, manually scheduling pods, and using daemon sets, labels, selectors, and resource requests and limits.

Learn to manually schedule pods without a scheduler by setting the node name at creation or creating a binding object via the pod binding API, and convert YAML to JSON.

Schedule engine x pod manually by adding node name property, delete and replace pod, and use watch to confirm it moves from pending to running on a control plane node.

Explore how labels and selectors group and filter Kubernetes objects such as pods, replica sets, and services using app and color criteria, and understand how annotations store extra details.

Walk through practice tests on labels and selectors in Kubernetes, using kubectl to filter pods by env and BU, count results, and fix a replica set template label mismatch.

Apply taints to nodes and add tolerations to pods to control which pods can land on which nodes, using no schedule, prefer no schedule, and no execute effects.

Practice taints and tolerations in Kubernetes, tainting a node, creating pods with and without tolerations, and observing scheduling on the control plane and node zero one.

Discover how node selectors use node labels to place pods on larger nodes, label nodes with size=large, and apply a simple size-based constraint.

Explore Kubernetes node affinity to place pods on specific nodes using required and preferred scheduling, with operators like in, not in, and exists; learn how execution handles label changes.

Demonstrates configuring node affinity and labeling with kubectl to place deployments blue and red on node01 and the control plane, using nginx images and label existence.

Learn how taints and tolerations and node affinity can be combined to dedicate nodes for specific pods, preventing other pods from landing on those nodes.

Explore how Kubernetes schedules pods using resource requests and limits for CPU and memory. Set limits, requests, limit ranges, and quotas to manage cluster resource usage.

Explore resource limits and requests in Kubernetes by diagnosing cpu requests, memory limits, and oomkilled failures, then practice adjusting limits and recreating pods with kubectl replace -F.

Explain how daemonsets deploy one pod per node in a Kubernetes cluster, automatically adding or removing pods with node changes, and common use cases like monitoring agents and kube proxy.

Inspect daemon sets across all namespaces, identifying two in the cube system (cube flannel ds and cube proxy) and their pod images and scheduling. Learn to create a daemon set by converting a deployment via a dry-run workflow.

Explore how static pods let the kubelet run pods on a node without an API server. The kubelet uses the pod manifest path to load and restart pods.

Identify static pods in a Kubernetes cluster by checking pod names and owner references, locate static pod manifests in /etc/kubernetes/manifests, and create, modify, and delete static pods using dry-run YAML.

Define and apply priority classes to Kubernetes pods, ensuring higher priority workloads preempt lower ones; system components receive the highest priorities, with a global default and optional never preemption.

Learn how to deploy multiple schedulers in a Kubernetes cluster, including a custom scheduler with its own config and name. Use schedulerName to assign pods to the correct scheduler.

Explore a practice test for multiple schedulers by identifying the kube-scheduler-control-plane pod, its image case.gcr.io/kube-scheduler version 1.23.0, and deploying a custom scheduler via a ConfigMap and a dedicated pod.

configure multiple scheduler profiles within a single Kubernetes scheduler to customize plugins across prefilter, filter, score, and bind extension points, leveraging priority sort and node resources fit to optimize scheduling.

Explore how admission controllers enforce cluster security by validating and shaping requests, from authentication and authorization through RBAC to automatic namespace provisioning and policy enforcement.

Admission controllers do not handle authentication. Learn to manage plugins via kube-apiserver.yaml: enable-admission-plugins and disable-admission-plugins, noting NodeRestriction, NamespaceAutoProvision, NamespaceLifecycle, and DefaultStorageClass.

Learn to distinguish mutating and validating admission controllers in Kubernetes, see how the default storage class mutates requests, and configure external admission webhooks with a deployed server and webhook configuration.

Demonstrates mutating and validating admission controllers, their invocation flow, and hands-on lab tasks to deploy a webhook, a TLS secret, and run-as-non-root security policies.

Explore various logging and monitoring options for Kubernetes clusters and applications, learn to view and manage logs for cluster components and apps, and apply through practical exercises.

Monitor a Kubernetes cluster by collecting node and pod metrics with the metrics server, including cpu and memory usage. The metrics server is in memory only; for history, use Prometheus.

Deploy the metric server and use kubectl top to monitor pods elephant, lion, and rabbit, identifying the control plane as the top cpu and rabbit as the top memory user.

Explore logging in Docker and Kubernetes by streaming logs with Docker logs and kube control logs, viewing pod-specific output, and specifying container names for multi-container pods.

Inspect and diagnose application logs from pods and containers to identify issues like account lockouts and out of stock errors. Learn to specify container names when viewing logs.

master application lifecycle management in kubernetes by exploring rolling updates and rollbacks, configuring and scaling applications, and examining health-related primitives.

Explore rolling updates and rollbacks in Kubernetes deployments, including rollout revisions and replica sets, while monitoring status and history and using apply, set image, and undo to upgrade or revert.

Demonstrate rolling updates and rollbacks on a front-end deployment by upgrading from v1 to v3, observing blue, green, and red versions while testing with curl.

Examine commands, arguments, and entry points in a pod definition and docker images, including how cmd and entry point determine startup, override, and default behavior with examples.

Explore commands and arguments in a Kubernetes pod, showing how docker run options map to pod definitions and how command and args override entrypoint and cmd in the docker file.

Explore commands and arguments in Kubernetes, showing how to specify command versus args, override entry points, and run pods with kubectl run for color-configured web apps.

Learn to set environment variables in a Kubernetes pod using the env array with name and value, and note that configmaps and secrets will be covered in future lectures.

Learn to manage Kubernetes configuration data with ConfigMaps by creating them imperatively or declaratively. Inject ConfigMaps into pods as environment variables or as files, enabling centralized configuration.

Learn to manage environment variables and config maps in Kubernetes by inspecting a pod, updating colors from pink to green to dark blue, and applying env from a config map.

Learn how to securely store sensitive data in Kubernetes using secrets, including imperative and declarative creation, encoding with base64, and injecting values into pods as environment variables or mounted files.

Inspect default namespace secrets, create a generic secret with db credentials, and load them as environment variables for the web app to connect to MySQL.

Demonstrate encrypting secret data at rest in etcd by configuring encryption provider settings and mounting the config in kube-apiserver, then verify with etcdctl.

Explore multi-container pods in Kubernetes to run a web server and main app together, sharing lifecycle, network space, and storage, so each app instance scales with its paired web server.

Explore multi-container pod design patterns, including co-located containers, init containers, and sidecar containers, and learn how startup order and lifecycle affect logging with examples like Elasticsearch, Kibana, and Filebeat.

Identify pods with init containers, noting blue uses busybox and completed, while purple has two init containers; learn to fix orange by correcting the sleep typo.

Explore autoscaling from a Kubernetes perspective, covering horizontal pod autoscaling (HPA) and vertical pod autoscaling (VPA) and the distinction between scaling workloads and scaling the cluster infrastructure. Learn manual and automated approaches, including kubectl scale and edit, kubeadm join, cluster autoscaler, and the roles of HPA and VPA.

Explore how the horizontal pod autoscaler in Kubernetes automatically scales deployments using CPU utilization from the metrics server, with min and max replicas and declarative definitions.

Explore in-place pod resizing in Kubernetes, enabled by the in-place pod vertical scaling flag, to resize cpu and memory without restart, while noting alpha status and limitations.

Learn how vertical pod autoscaling (VPA) monitors usage, recommends CPU and memory, and restarts pods via the recommender, updater, and admission controller for efficient per-pod tuning.

Learn cluster maintenance for Kubernetes: perform operating system upgrades, manage node loss or removal, execute end-to-end upgrades with best-practice versioning, and practice backup, disaster recovery, and restore with live applications.

Safely upgrade nodes by draining workloads, cordoning unschedulable nodes, and rebooting, ensuring replica-set pods migrate while non-replicated pods may be lost if a node stays down beyond eviction timeout.

Understand Kubernetes release versioning with major, minor, and patch numbers, plus alpha, beta, and stable stages, and explore release notes for etcd and core DNS.

Upgrade Kubernetes clusters step by step using kubeadm, upgrading the control plane first and then worker nodes, while managing version skew and planning incremental upgrades.

Follow a kubeadm-based upgrade from 1.28 to 1.29, including repository changes, upgrade planning, upgrading the control plane first, draining nodes, and upgrading kubelet on workers.

Learn backup and restore strategies for Kubernetes, including etcd snapshots and exporting resource configurations via declarative files or kubectl. Use Arc or Valero for automated cluster backups and practice restoration.

Explore Kubernetes security primitives, authentication mechanisms, and TLS certificates, then master authorization with role-based access controls, image security, security contacts, and network policies through practice tests.

Explore Kubernetes security primitives, from securing cluster hosts and API server access to authentication, authorization, TLS encryption, and network policies that govern pod communication.

Secure a Kubernetes cluster by authenticating administrators and developers through the API server using static tokens, certificates, or ldap and kerberos.

Explore TLS certificates and their role in securing Kubernetes clusters, learn fundamentals, certificate authorities, and practical troubleshooting to master certificates in Kubernetes.

Explore TLS basics, including public and private keys, asymmetric and symmetric encryption, and certificates. Learn how certificate authorities sign certs, CSRs, and the PKI framework for securing SSH and HTTPS.

Secure a Kubernetes cluster with TLS by using server and client certificates signed by a CA, covering the API server, etcd, kubelet, and admin, scheduler, and proxy clients.

Generate CA and client certificates with OpenSSL, sign them with the CA key, and configure Kubernetes components such as the API server, etcd, kubelet, and admin users via kubeconfig.

Identify and audit all certificates in a kubeadm-provisioned Kubernetes cluster by listing files, inspecting each with OpenSSL to verify names, SANs, issuer, and expiry, and review logs for issues.

Analyze and fix kube-apiserver and etcd certificate configurations by identifying certs under /etc/kubernetes/pki, including apiserver, etcd client, and ca files, to restore kubectl access.

Explore how Kubernetes uses the built-in certificates api to sign CSRs, rotate CA keys, and issue user certificates via the controller manager.

Demonstrates creating, converting to base64, and approving a Kubernetes certificate signing request for Akshay, then reviewing pending CSRs, denying the Agent Smith CSR, and deleting it.

Explore kubeconfig fundamentals in Kubernetes: manage clusters, users, and contexts, switch contexts and namespaces, and securely store certificates and authentication details for kubectl.

Identify and fix kubeconfig issues by locating the default config at root/.cube/config, review clusters, contexts, and users, switch to dev user for test cluster one, and fix client certificate path.

Discover how Kubernetes API groups organize the core and named groups, with resources like pods and deployments and verbs such as list, get, create, and delete.

Explore Kubernetes authorization mechanisms like node authorizer, ABAC, RBAC, and webhook, and how policies, namespaces, and service accounts restrict access. Learn how multiple modes are chained and configured.

Create a role with api groups, resources such as pods and configmaps, and verbs like list, get, create, and delete; bind it to a user and test permissions in namespace.

Verify kube api server authorization modes (node and rbac), inspect roles across namespaces, and adjust role bindings to enable dev user deployments in the blue namespace.

Create and bind cluster roles to manage cluster-wide resources such as nodes and persistent volumes, linking users via cluster role bindings for cross-namespace access.

Explore cluster roles and cluster role bindings, learn they are not namespaced, and practice creating cluster roles and bindings to grant Michelle access to nodes and storage.

Discover service accounts in Kubernetes, their tokens, and how pods authenticate to the Kubernetes API. Create and attach service accounts, mount tokens, and use them with external tools.

Identify default namespace service accounts and tokens, create and mount a dashboard-sa service account with RBAC, and verify Kubernetes API access via the dashboard.

Secure image deployments by understanding Docker image naming, using private registries, and configuring Kubernetes to pull from private registries via image pull secrets.

Explore image security in kubernetes by creating a docker-registry secret, configuring a deployment to pull from a private registry, and validating image pull secret integration during rolling updates.

Explore docker security fundamentals, including namespaces, root versus non-root users, and linux capabilities. Learn to enforce limits with docker run options like cap add, cap drop, and the privileged flag.

Configure security contexts in Kubernetes by setting the run as user and capabilities at the pod or container level. Learn how container settings override pod defaults to secure Docker containers.

Explore how to configure security contexts in Kubernetes pods and containers, including runAsUser settings, pod and container level overrides, and adding capabilities such as SYS_TIME and NET_ADMIN.

Explore how to implement Kubernetes network policies to allow ingress from the API pod to the database pod on port 3306, using pod selectors.

Configure Kubernetes network policies to protect the database pod. Allow ingress only from the API pod on port 3306 using pod, namespace, and IP block selectors.

Explore Kubernetes network policies: payroll policy allows ingress to port 8080 from the internal pod, while egress remains unrestricted; an internal policy enables egress to payroll 8080 and MySQL 3306.

Explore how Kubernetes resources, deployment controllers, and etcd store drive deployments, and learn to create a custom resource definition for a flight ticket with schema validations.

Master building a Kubernetes custom controller with Go, using a custom resource definition and etcd-stored flight ticket objects, to automate bookings via the Kubernetes API.

Explore how the operator framework packages a CRD and a custom controller into a single operator that deploys and manages etcd in Kubernetes via operator hub, with backups and restores.

Learn the Kubernetes storage basics by exploring persistent volumes, persistent volume claims, and access modes, and configure applications with persistent storage while relating solutions to third-party options.

Explore how storage works with containers by examining Docker storage drivers and volume driver plugins, building a foundation for understanding Kubernetes storage.

Docker stores image and container data under /var/lib/docker in a layered architecture with a read-only image and a writable container layer, while volumes or bind mounts persist data.

Understand how storage drivers differ from volume driver plugins, since volumes are managed by volume drivers. Explore local volumes and cloud-backed drivers that attach container data to storage services.

The container storage interface defines RPCs for Kubernetes to create and delete volumes via CSI drivers, enabling a universal standard that works with any container orchestration tool.

Learn how volumes in Kubernetes persist data from transient pods by attaching and mounting storage, using hostpath and cloud options such as AWS EBS and Google Persistent Disk.

Learn how persistent volumes create a cluster-wide storage pool administered centrally, with users claiming storage via persistent volume claims, starting from host path and kubectl, moving to EBS.

Create and bind a persistent volume claim to a persistent volume, detailing binding rules, capacity, access modes, and the 1-1 PVC to volume relationship, including pending and bound states.

Set up a host path persistent volume and a matching pvc, resolve access mode constraints, and mount the claim in the web app pod to persist logs on the host.

Enable dynamic provisioning of volumes through storage classes in Kubernetes, using provisioners like Kubernetes.io/gce to create PVs automatically when a PVC is used on Google Cloud and other providers.

Explore storage classes in a Kubernetes cluster, including dynamic provisioning, provisioners, and the wait-for-first-consumer binding mode, then create and bind PVCs to local PVs using a pod.

Explore Kubernetes networking concepts, from IP and DNS basics to pods, cluster DNS, and ingress, and learn how CNI and Docker network namespaces support pod communication.

Develop core networking skills by exploring switching, routing, gateways, and DNS, then configure Linux networking, DNS settings, and IP forwarding to enable inter-network communication.

Learn how to configure and troubleshoot DNS in linux by editing /etc/hosts, setting resolv.conf, and using nslookup and dig, while understanding domain names and name resolution.

Learn how Linux network namespaces isolate containers, connect namespaces with veth pairs and a bridge, configure routing and gateway, and apply iptables nat for internet access and port forwarding.

Explore docker networking basics, including non-network, host, and bridge modes, and see how containers connect via bridge with network namespaces and iptables NAT for port mapping.

Learn how the container networking interface (CNI) standard unifies plugin-based networking for containers, detailing bridge networks, IP assignment, and interactions with Kubernetes and other runtimes.

Explore Kubernetes cluster networking by configuring master and worker interfaces, hostnames, and required ports such as 6443, 10250, 10257, 10259, 30000-32767, 2379, and 2380.

Identify the cluster nodes and network details with kubectl and ip commands, including internal IPs, eth0 and cni0 interfaces, and etcd and scheduler ports and MAC addresses.

Explore pod networking in Kubernetes by implementing per-pod IP addresses, bridging on each node, and configuring routes, then automate with CNI that adds and deletes container interfaces.

Configure Kubernetes to use CNI plugins for pod networking by detailing container runtimes, the CNI bin and net.d directories, and bridge, gateway, IPAM, and NAT settings.

Inspect the kubelet runtime endpoint, locate CNI binaries at /opt/cni/bin, identify available plugins, confirm the configured CNI is flannel, and note the kubelet runs flannel and portmap.

Explore IP address management in Kubernetes through CNI plugins, including pod IP assignment, subnet handling, and avoiding duplicate addresses with iPam configuration.

Discover how cluster-wide service networking exposes pods via cluster ip and node port, with kube proxy and iptables routing traffic to the right pods.

Identify the node subnet and pod subnet from the cluster using weave: 192.6.10.0/24 and 10.244.0.0/16. Confirm service range 10.96.0.0/12, two kube-proxy pods, iptables proxy, deployed as a daemonset.

Kubernetes deploys a built-in DNS server by default to resolve names. Service names map to IPs, letting pods reach services within namespaces as webservice.svc.cluster.local.

Explore how Kubernetes implements DNS with CoreDNS, including the Kubernetes plugin, pod and service records, and automatic resolv.conf configuration for seamless cluster name resolution.

Explore CoreDNS in Kubernetes and configure dns with corefile, CoreDNS config map, and service access across default and payroll namespaces, including HR web service and payroll MySQL connectivity.

Explore how ingress in Kubernetes enables URL-based routing and SSL termination via an ingress controller (nginx) to route traffic to multiple services with DNS and a single external URL.

Learn to configure an ingress controller across namespaces and apps, mapping paths such as wear, watch, stream, eat, and pay. Apply rewrite annotations to route traffic correctly and handle 404s.

Deploy an nginx ingress controller in the ingress space, configure a configmap and service account, expose the controller, and create an ingress with rewrite target annotations to prevent ssl redirects.

Explore gateway api, a declarative, annotation-free routing model for layer four and seven, enabling multi-tenant, tls-enabled traffic with http, tcp, udp, and grpc routes.

Design a Kubernetes cluster by answering deployment questions, choosing between managed and self-hosted options, and planning node roles, high availability, and storage for various workloads.

Choose the right Kubernetes infrastructure by comparing local and cloud deployments, turnkey versus hosted solutions, and multi-node setups, with examples like Minikube, kubeadm, and Google Kubernetes Engine (GKE).

Explore high availability in Kubernetes by using multiple master nodes, a load balancer, leader election, and external vs stacked etcd topologies to avoid single points of failure.

Configure etcd in a high availability setup using Raft for leader election and majority-based writes, choosing an odd number of nodes such as three, five, or seven to preserve quorum.