CKA Troubleshooting Practice

Scenario #1 — Pod Stuck in CrashLoopBackOff

A team reports that their application pod in namespace payments keeps restarting. Your job: diagnose and fix it.

Step 1 — Identify the failing pod

kubectl get pods -n payments

Simulated output:

NAME              READY   STATUS             RESTARTS   AGE
api-server        0/1     CrashLoopBackOff   12         5m

Step 2 — Describe the pod

kubectl describe pod api-server -n payments

Look for:

• Image pull errors
• Bad command/args
• Missing secrets
• Failed probes
• ConfigMap mount errors
• Permission issues

Simulated event snippet:

Warning  Failed     Error: secret "db-password" not found
Warning  BackOff    Back-off restarting failed container

Step 3 — Check logs

kubectl logs api-server -n payments

Simulated log:

FATAL: Unable to load DB password from /etc/creds/password

Diagnosis

The pod expects a secret named db-password, but it doesn’t exist.

Step 4 — Fix the issue

kubectl create secret generic db-password \
  --from-literal=password=SuperSecure123 \
  -n payments

kubectl delete pod api-server -n payments

Step 5 — Verify

kubectl get pods -n payments
kubectl logs api-server -n payments

Expected:

READY   STATUS    RESTARTS   AGE
1/1     Running   0          10s

Scenario #2 — Node NotReady (CNI Failure)

Step 1 — Check node status

kubectl get nodes

Simulated:

NAME       STATUS      ROLES    AGE   VERSION
worker-1   NotReady    <none>   12m   v1.29.3

Step 2 — Check kubelet logs

SSH into the node and run:

journalctl -u kubelet -f

Simulated error:

Failed to start CNI plugin: no such file or directory: /etc/cni/net.d

Diagnosis

The CNI plugin is missing or misconfigured.

Step 3 — Reinstall CNI

Example for Calico:

kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

Example for Weave:

kubectl apply -f https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')

Step 4 — Verify

kubectl get nodes
kubectl get pods -A

Expected: worker-1 becomes Ready.

Scenario #3 — PVC Stuck in Pending

Step 1 — Check PVC

kubectl get pvc -n analytics

Simulated:

NAME      STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS
data      Pending

Step 2 — Describe PVC

kubectl describe pvc data -n analytics

Simulated:

Warning  ProvisioningFailed: storageclass "fast" not found

Diagnosis

The StorageClass referenced by the PVC does not exist.

Step 3 — Create the missing StorageClass

kubectl apply -f - <<EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
EOF

Step 4 — Verify

kubectl get pvc -n analytics

Expected: data becomes Bound.