CKA Practice Guide

Focus on speed, troubleshooting, and muscle memory.

1. Imperative Commands

Create Pod

kubectl run nginx --image=nginx

Create Deployment

kubectl create deployment nginx --image=nginx

Expose Deployment

kubectl expose deployment nginx --port=80 --target-port=80

Create Namespace

kubectl create ns practice

Generate YAML

kubectl create deployment nginx \
--image=nginx \
--dry-run=client -o yaml > deployment.yaml
Practice these until you can type them without looking.

2. RBAC

Create Service Account

kubectl create sa bob

Create Role

kubectl create role pod-reader \
--verb=get,list,watch \
--resource=pods

Create Role Binding

kubectl create rolebinding read-pods \
--role=pod-reader \
--serviceaccount=default:bob

Verify

kubectl auth can-i list pods \
--as=system:serviceaccount:default:bob
Create a service account that can only view pods.

3. Network Policies

Create Namespace

kubectl create ns netpol

Create Pods

kubectl run pod1 --image=busybox -n netpol -- sleep 3600
kubectl run pod2 --image=busybox -n netpol -- sleep 3600

Deny All Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Apply

kubectl apply -f deny.yaml
Practice allowing one pod while denying another.

4. Persistent Volumes and PVCs

Create PV

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv1
spec:
  capacity:
    storage: 1Gi
  accessModes:
  - ReadWriteOnce
  hostPath:
    path: /data

Create PVC

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc1
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 500Mi

Troubleshooting

kubectl get pv
kubectl get pvc
kubectl describe pvc pvc1
Create a pod using pvc1 and verify data persists.

5. Static Pods

Static Pods are managed by kubelet.

Location

/etc/kubernetes/manifests

Create Static Pod

cd /etc/kubernetes/manifests
vi nginx-static.yaml

Verify

kubectl get pods -A
Delete the file and watch the pod disappear.

6. Taints and Tolerations

View Nodes

kubectl get nodes

Add Taint

kubectl taint node worker1 role=database:NoSchedule

View Taints

kubectl describe node worker1

Remove Taint

kubectl taint node worker1 role=database:NoSchedule-

Toleration Example

tolerations:
- key: "role"
  operator: "Equal"
  value: "database"
  effect: "NoSchedule"
Taint a node and schedule a pod only using a toleration.

7. Node Selectors

Label Node

kubectl label node worker1 disk=ssd

Pod Spec

nodeSelector:
  disk: ssd

Verify

kubectl get pods -o wide
Schedule pods onto specific nodes.

8. etcd Backup and Restore

Health Check

ETCDCTL_API=3 etcdctl endpoint health \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key

Backup

etcdctl snapshot save /opt/backup.db

Verify Backup

etcdctl snapshot status /opt/backup.db -w table

Restore

etcdctl snapshot restore /opt/backup.db \
--data-dir=/var/lib/etcd-restored

Manifest Location

/etc/kubernetes/manifests/etcd.yaml
Locate certs from etcd.yaml without memorizing them.

Daily Drill (30 Minutes)

  1. Create Namespace
  2. Create Deployment
  3. Expose Service
  4. Create Service Account
  5. Create Role and RoleBinding
  6. Create PV and PVC
  7. Create Static Pod
  8. Add Taint
  9. Add Toleration
  10. Take etcd Snapshot
  11. Practice Restore Command

Remember