Certified Kubernetes Administrator (CKA) with v1.18

In the Kubernetes certifications (CKAD/CKA) it's important to be fast.
Before appearing to the exam please go and check out the Latest Kubernetes API version. Exam is based on the latest Kuberntes version only.
Some of the commands may be deprecated for the latest version and if you try those commands in exam then it will be a big chaos.
I am writing this blog on the latest version of Kubernetes v1.18 - Kindly ref to kubernetes.io before your exam.
For CKA you have enough time to solve all 24 questions in 3hrs so no need to alias for even kubectl=k or kubectl get po=kgpo
For kubernetes cluster installation of master and worker nodes - Do not go for KTHW (Kubernetes The Hard Way). It is clearly mentioned that install clusters with kubeadm only. So be handy only with kubeadm and kubeadm flags and options.
Before the exam please just ask the experienced one who appeared for the exam recently.
I found that bash autocompletion for commands were missing for both root and non-root terminal. Refer This
For copy and paste the blogs from docs you do not have a limit for copying and pasting that number of lines. Here to copy paste faster, use keyboard shortcuts copy - control + insert for paste - shift + insert keep this handy.
If you are a heavy linux user please avoid control + w this will close your browser session. Only the exam tab and one more tab (kubernetes.io and subdomain) is allowed to open in the browser.
Before appearing for the exam you should have a basic understanding of Linux and it's compulsory. i.e. vi/vim, cat, sudo, sudo su -, ssh, nslookup, ping, telnet, scp, mkdir, touch, awk, grep, find or redirection of output into a file, maybe file permission, access denied.
This is an actual hands-on practical exam. So please do not ask for dumps or questions that appear in the exam.
For exam instructions please go to cncf official website or you will get at the booking the exam slot.
Now let's start with actual exam preparation

Preparation

1. Deployment

Refer Deployment doc for more details Ref - kubernetes deployment
To create simple deployment
kubectl create deployment nginx-deploy --image=nginx
Custom deployment if you want to edit or modify. Open deployment.yaml make the changes and save it.
kubectl create deployment nginx-deploy --image=nginx -o yaml --dry-run=client > deployment.yaml
Once changes saved then,
kubectl apply -f deployment.yaml
To verify deployment,
kubectl get deployment
kubectl describe deployment nginx-deploy
To scale deployment = 2
kubectl scale deployment nginx-deploy --replicas=2
To expose deployment on port = 80 as a ClusterIP or accessing service within the Cluster
kubectl expose deployment nginx-deploy --name=nginx-service --port=80 --target-port=80 --type=ClusterIP
kubectl get svc
Here is the sample deployment using dry run
kubectl create deployment nginx --image=nginx:1.12 -o yaml --dry-run=client

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deploy
spec:
  selector:
    matchLabels:
      app: nginx-deply
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx-deploy
    spec:
      containers:
      - name: nginx
        image: nginx:1.12
        ports:
        - containerPort: 80

kubectl apply -f deployment.yaml

Deployment rollout and undo rollout
a. Deploying nginx:1.12
kubectl create deployment nginx-deploy --image=nginx:1.12
b. Updating image to 1.13 i.e. rollout
Check the name of nginx container
kubectl describe deployment nginx-deploy
kubectl set image deployment/nginx-deploy nginx=nginx:1.13 --record=true
c. Check rollout history
kubectl rollout history deployment nginx-deploy
d. Undo rollout
kubectl rollout undo deployment nginx-deploy

Note: Do not use `kubectl run nginx --image=nginx --restart=Always` to create deployment as it's been deprecated in v1.18

2. Pod

Create pod Ref - kubernetes pod
kubectl run nginx-pod --image=nginx
Edit or modify before runing pod by dry-run
kubectl run nginx-pod --image=nginx -o yaml --dry-run=client > pod.yaml

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: nginx
  name: nginx
spec:
  containers:
  - image: nginx
    name: nginx

Expose pod - please check deployment expose
Check exposed pod from another pod or accessing one pod from another pod
kubectl run tmp --image=busybox:1.28.0 --restart=Never --rm -it ping nginx-service
kubectl run tmp --image=busybox:1.28.0 --restart=Never --rm -it nslookup nginx-service
check with pod - check the pod ip consider here it is 10.0.0.1 and namespace = default
kubectl run tmp --image=busybox:1.28.0 --restart=Never --rm -it nslookup 10-0-0-1.default.pod
StaticPod Ref- kubernetes StaticPod
a. create pod by dry-run
kubectl run nginx-pod --image=nginx -o yaml --dry-run=client > staticpod.yaml
b. copy staticpod.yaml file by scp to worker node and keep in /etc/kubernetes/manifest or check staticPodPath path from config.yaml and place yaml file on the same
c. check pod is up or not
kubectl get pod
Multi-container pod with nginx and redis - copy spec from pod template

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: multicontainer
  name: multicontainer
spec:
  containers:
  - image: nginx
    name: nginx
  - image: redis
    name: redis

Troubleshoot over pod or deployment
a. Check pod logs
kubectl logs nginx
b. Check pod failure
kubectl describe pod nginx
c. Edit pod
kubectl edit pod nginx
d. login into pod
kubectl exec -it nginx sh

3. initContainer

Create a normal pod by dry-run and add initContainer spec in it. Here init container is downloading index.html before start of actual nginx container Ref - kubernetes initContainer

apiVersion: v1
kind: Pod
metadata:
  name: init-demo
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
    - containerPort: 80
    volumeMounts:
    - name: workdir
      mountPath: /usr/share/nginx/html
  # These containers are run during pod initialization
  initContainers:
  - name: install
    image: busybox
    command:
    - wget
    - "-O"
    - "/work-dir/index.html"
    - http://kubernetes.io
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  dnsPolicy: Default
  volumes:
  - name: workdir
    emptyDir: {}

4. DaemonSet

Create DaemonSet or Deploy DaemonSet so that every node contain at least have 1 pod running on it Ref - kubernetes DaemonSet

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-elasticsearch
  labels:
    k8s-app: fluentd-logging
spec:
  selector:
    matchLabels:
      name: fluentd-elasticsearch
  template:
    metadata:
      labels:
        name: fluentd-elasticsearch
    spec:
      containers:
      - name: fluentd-elasticsearch
        image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2

5. Secret

Create secret name=mysecret from username:testuser, password:iluvtests Ref - kubernetes secret
kubectl create secret generic mysecret --from-literal=username=testuser --from-literal=password=iluvtests
secret as a environment variables SECRET_USERNAME

apiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: redis
    env:
      - name: SECRET_USERNAME
        valueFrom:
          secretKeyRef:
            name: mysecret
            key: username

secret as a volume mount path /etc/foo

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: redis
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    secret:
      secretName: mysecret

6. PersistentVolume & PersistentVolumeClaim

Create pv Ref - kubernetes pv

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data"

kubectl get pv

Create pvc - it should be in a bound state once pvc is created. Remember storageClassName should be same as pv and also check for accessModes

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Gi

kubectl get pvc

Use above pvc in pod

apiVersion: v1
kind: Pod
metadata:
  name: task-pv-pod
spec:
  volumes:
    - name: task-pv-storage
      persistentVolumeClaim:
        claimName: task-pv-claim
  containers:
    - name: task-pv-container
      image: nginx
      ports:
        - containerPort: 80
          name: "http-server"
      volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: task-pv-storage

pod with emptyDir{} i.e. data should be deleted if pod delete and mount on /cache Ref - kubernetes emptyDir

apiVersion: v1
kind: Pod
metadata:
  name: test-pd
spec:
  containers:
  - image: k8s.gcr.io/test-webserver
    name: test-container
    volumeMounts:
    - mountPath: /cache
      name: cache-volume
  volumes:
  - name: cache-volume
    emptyDir: {}

7. Network policy

Here we need to understand the scenario and create a network policy or label pod. Ref - kubernetes network policy
kubectl get pods --show-labels
kubectl label pod redis role=db

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379

8. SecurityContext

Set capabilities for Container Ref - kubernetes security context

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-4
spec:
  containers:
  - name: sec-ctx-4
    image: gcr.io/google-samples/node-hello:1.0
    securityContext:
      capabilities:
        add: ["SYS_TIME"]

securityContext runAsUser: 1000 for pod

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

9. RBAC

csr and approve csr from .csr file Ref - kubernetes csr

apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: my-svc
spec:
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth

kubectl certificate approve my-svc

create role who can get, list, watch, update, delete the pod Ref - kubernetes rbac
kubectl create role devuser --verb=get,list,watch,update,delete --resource-name=pods
create rolebindings
kubectl create rolebinding newrole --clusterrole=view --serviceaccount=default:myapp --namespace=default

10. ETCD Backup

Taking backup Ref - kubernetes etcd backup

$export ETCDCTL_API=3
## check options with help command
$etcdctl --help
## copy the cert path from below command
$kubectl describe pod -n kube-system etcd-master
## please verify the path from above command 
$etcdctl snapshot save snapshotdb.db --endpoints=127.0.0.1:2379 --cacert="/etc/kubernetes/pki/etcd/ca.crt" --cert="/etc/kubernetes/pki/etcd/server.crt" --key="/etc/kubernetes/pki/etcd/server.key"

Verify snapshot
etcdctl --write-out=table snapshot status snapshotdb.db

11. Cluster Installation

kubeadm installation on both node Master and Worker Node. ssh to master and worker node for installation. Ref - kubernetes kubeadm installation

sudo apt-get update && sudo apt-get install -y apt-transport-https curl
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
cat <<EOF | sudo tee /etc/apt/sources.list.d/kubernetes.list
deb https://apt.kubernetes.io/ kubernetes-xenial main
EOF
sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl
systemctl daemon-reload
systemctl restart kubelet

kubeadm init to initialize cluster check if any arguments has asked while initialize the cluster - Master node only Ref - kubernetes kubeadm initialize

kubeadm init <args>
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

Join Worker node - Copy this from init command and run this on Worker node Only
kubeadm join <control-plane-host>:<control-plane-port> --token <token> --discovery-token-ca-cert-hash sha256:<hash>
Confirm nodes it should be in Ready state
kubectl get nodes

12. Cluster troubleshoot

Check master node and worker is running or not
Check all components are running or not. like ETCD, kubelet, kube scheduler, etc
Check all paths verifying all are on the correct path in config and actual. like cert path, config path, kubeconfig file
Check logs of master components which are failing.
If the component is running on system like kubelet then check in /var/log/messages or /var/log/syslog or journalctl -u kubelet

13. jsonpath

Examples Ref - kubernetes jsonpath

# Get the version label of all pods with label app=cassandra
kubectl get pods --selector=app=cassandra -o  jsonpath='{.items[*].metadata.labels.version}'
# Get ExternalIPs of all nodes
kubectl get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="ExternalIP")].address}'
# List Events sorted by timestamp
kubectl get events --sort-by=.metadata.creationTimestamp
# All images running in a cluster
kubectl get pods -A -o=custom-columns='DATA:spec.containers[*].image'
# sort by capacity
kubectl get pv --sort-by=.spec.capacity.storage

14. kubectl cheatsheet

Common Mistakes

Make sure that you have switched to correct context/cluster or not. That is mentioned on top of every question.
Wrong indentation in yaml file.
Deployment in wrong namespace.
Checking pod in wrong namespace.
Adding labels to deployment and pod.
Recheck or verify the deployment or pod by 1/1 or 2/2 in Ready state.
If you are applying any yaml file then check if all mandatory fields are present or not. Eg DaemonSet or Network Policy.
Check deployment for DaemonSet, whether it is running on all nodes or not.
For initContainer the container is up or not with 1/1 after Init1:1
For jsonpath output, check whether the output is in correct format or not as per question.
While storing output checks you have access to the mentioned location and once stored verify with cat command.
Do not waste your time solving any question where you stuck for a long time.
Instead of creating manual yaml files, use kubernetes.io and copy paste the block in the file editor.
For troubleshooting/installation of clusters, check nodes are up and running.
Most Important - Do not delete or recreate existing resources. You are only allowed to modify it. Do not try to export, delete and create those resources. Where you can create, delete, update your resources that have been asked in exam.

All the Best For your Exam!!

My CKA certificate

Creator

Do reach out to me for any query regarding the exam.

Apurva Bhandari

How to start ?

Check Learning Resources References

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CKA.md

CKA.md

Certified Kubernetes Administrator (CKA) with v1.18

Contents:

For creating any resource please use dry run at the end and save it in file so that it will be easy to deploy - pod, deployment, service, etc `-o yaml --dry-run=client`

In case if you want to change namespace `kubectl config set-context $(kubectl config current-context) --namespace=default`

Preparation

1. Deployment

Note: Do not use `kubectl run nginx --image=nginx --restart=Always` to create deployment as it's been deprecated in v1.18

2. Pod

3. initContainer

4. DaemonSet

5. Secret

6. PersistentVolume & PersistentVolumeClaim

7. Network policy

8. SecurityContext

9. RBAC

10. ETCD Backup

11. Cluster Installation

12. Cluster troubleshoot

13. jsonpath

14. kubectl cheatsheet

Common Mistakes

All the Best For your Exam!!

My CKA certificate

Creator

Files

CKA.md

Latest commit

History

CKA.md

File metadata and controls

Certified Kubernetes Administrator (CKA) with v1.18

Contents:

For creating any resource please use dry run at the end and save it in file so that it will be easy to deploy - pod, deployment, service, etc -o yaml --dry-run=client

In case if you want to change namespace kubectl config set-context $(kubectl config current-context) --namespace=default

Preparation

1. Deployment

Note: Do not use kubectl run nginx --image=nginx --restart=Always to create deployment as it's been deprecated in v1.18

2. Pod

3. initContainer

4. DaemonSet

5. Secret

6. PersistentVolume & PersistentVolumeClaim

7. Network policy

8. SecurityContext

9. RBAC

10. ETCD Backup

11. Cluster Installation

12. Cluster troubleshoot

13. jsonpath

14. kubectl cheatsheet

Common Mistakes

All the Best For your Exam!!

My CKA certificate

Creator

For creating any resource please use dry run at the end and save it in file so that it will be easy to deploy - pod, deployment, service, etc `-o yaml --dry-run=client`

In case if you want to change namespace `kubectl config set-context $(kubectl config current-context) --namespace=default`

Note: Do not use `kubectl run nginx --image=nginx --restart=Always` to create deployment as it's been deprecated in v1.18