CKAD quick review

Memory hook: Requests place; limits constrain; probes decide.

Must remember

Deployments manage ReplicaSets and rolling changes. StatefulSets supply stable ordinal identity and per-Pod storage patterns; DaemonSets place node-local workloads; Jobs run to completion and CronJobs schedule Jobs. Pick the controller that expresses the workload instead of creating unmanaged Pods.

Use kubectl rollout status, history and undo for Deployment progress and recovery. maxSurge permits extra Pods; maxUnavailable controls how many desired replicas can be unavailable during a rolling update. A rollback restores an earlier Pod template, not external database state.

Readiness determines eligibility for normal Service traffic; liveness can restart a failing container; startup delays the other probes while an application initializes. An overly aggressive liveness probe can turn a dependency outage into a restart storm. Resource requests influence scheduling; limits constrain use, with CPU throttling and possible memory termination.

Node selectors and required affinity constrain placement; preferred affinity expresses preference. Taints repel Pods without matching tolerations; a toleration permits placement but does not select a particular node. Topology spread and anti-affinity reduce correlated failures. Admission controls, namespace quotas and LimitRanges can reject or default Pod configuration before scheduling.

HPA scales replica counts from configured metrics; utilisation-based CPU scaling requires appropriate requests and metrics availability. Node autoscaling supplies node capacity rather than changing desired application replicas. A PodDisruptionBudget limits voluntary disruption; it cannot prevent every involuntary failure.

ConfigMaps store nonsecret settings; Secrets hold sensitive values but base64 encoding is not encryption. Protect API access and at-rest storage. Environment variables are captured at container start; mounted projected data can update with qualifications, including subPath limitations. Restart or reload the application when its consumption method requires it.

Choose under exam pressure

Traps

• A toleration is permission, not a placement guarantee.
• A readiness failure does not itself restart the container.

Practise this topic

Memory hook: Claim requests; class provisions; policy reclaims.

Must remember

A Pod's container filesystem is not durable application storage. emptyDir lives with the Pod and survives container restarts, but disappears when the Pod is removed. hostPath exposes a node path and ties behavior to that node; it is not a general portable persistent-storage design.

A PersistentVolume represents storage; a PersistentVolumeClaim requests capacity and access characteristics. A StorageClass identifies a provisioner and parameters for dynamic provisioning. With WaitForFirstConsumer, binding can wait for workload placement so topology and storage availability align. An immediate binding may otherwise choose storage in the wrong zone for a constrained Pod.

Access modes describe permitted mounting patterns: ReadWriteOnce is read-write by one node (potentially several Pods there), ReadOnlyMany is many-node read access, ReadWriteMany is multi-node read/write when the storage supports it, and ReadWriteOncePod restricts access to one Pod with supported CSI storage. Modes do not transform an underlying disk into a distributed filesystem.

Reclaim policy decides what happens after the claim releases a PV. Delete generally removes dynamically provisioned backing storage through the provisioner; Retain preserves it for manual recovery/reuse. Deleting a workload is not the same as deleting its PVC. Inspect the actual PV/class rather than assuming retention.

Expansion requires class and driver support; filesystem expansion behavior depends on the volume and driver. A larger claim can request growth, but Kubernetes does not provide ordinary volume shrinking. volumeMode: Block exposes a raw block device rather than a mounted filesystem.

Diagnose Pending claims through events, matching class, size, access modes, provisioner health and topology. Diagnose mount failures through CSI/controller/node logs, attachment limits, permissions and application paths. Never delete a data-bearing claim merely to make a warning disappear.

Choose under exam pressure

Traps

• ReadWriteOnce means one node, not universally one Pod.
• A Retain volume still needs a tested backup and recovery plan.

Practise this topic

Memory hook: One Pod shares a lifecycle; one image should have one clear purpose.

Must remember

A container image packages filesystem layers and startup metadata. Build from a controlled base, copy only required files, use multi-stage builds to leave compilers behind, and exclude credentials/build context secrets. Tags can move; a digest identifies specific content. Understand Dockerfile ENTRYPOINT and CMD, then how Kubernetes command and args override them.

Containers in a Pod share network identity and can share declared volumes, but their root filesystems are separate. Use an init container for prerequisites that must finish before normal application startup. A sidecar supplies a companion capability such as a proxy or log shipper; an adapter normalizes output and an ambassador mediates access to another service. Do not put unrelated applications in one Pod merely to share a node.

Native sidecars use restartable init-container behavior in supported versions. Their ordering/lifecycle differs from ordinary init containers and long-running app containers, so inspect the target API documentation. A one-shot init command that never exits can block startup indefinitely.

Kubernetes does not automatically interpret command/args as a shell script. Pipes, redirects and chained commands require an explicitly invoked shell, and the image must contain that shell. Native sidecars specify restartPolicy: Always on an init container; ordinary init containers must finish before the next starts. Do not confuse this per-container setting with the Pod's restart policy.

Choose a Deployment for interchangeable replicas, StatefulSet for stable identity/storage patterns, DaemonSet for node-local agents and Job/CronJob for finite/scheduled work. A Job's retry and completion settings do not make an external payment operation idempotent. CronJob concurrency and missed-run behavior need deliberate configuration.

For batch work, completions is the success target, parallelism bounds concurrently active Pods, and backoffLimit limits retry failures. CronJob concurrencyPolicy chooses Allow, Forbid or Replace for Jobs from that CronJob; startingDeadlineSeconds bounds how late a missed run may start. These controls do not provide exactly-once business processing.

Drill: explain how a shared emptyDir passes a generated configuration from an init container to an application, why it survives a container restart, and why deleting the Pod removes it. Then inspect the actual image, command, args and events when the app fails to start.

Choose under exam pressure

Traps

• A Pod shares a network namespace, not automatically every filesystem path.
• Image tags are not immutable identifiers.

Practise this topic

Memory hook: Render the intent, inspect the diff, verify the rollout.

Must remember

A Deployment rolling update replaces replicas according to surge/unavailability limits. Blue/green maintains distinct old/new environments and switches traffic. A canary exposes a limited share before wider promotion. Plain Kubernetes Services select matching Pods; precise percentage routing may require replica proportions or a capable ingress/service-mesh controller. A label alone does not implement weighted traffic.

Helm combines chart templates with values to create release resources. Inspect helm show values, helm template, release status/history and upgrade changes. A successful Helm command does not prove the application is healthy. Hooks and CRDs have lifecycle considerations; understand what uninstall retains. Avoid secrets in unprotected values files or command history.

Kustomize composes bases and overlays with patches, labels, image changes and generated configuration. kubectl kustomize PATH renders; kubectl apply -k PATH applies. Keep environment differences small and explicit. Do not hand-edit rendered output and assume the next render preserves it.

Before applying, verify context/namespace, intended image and the rendered diff. After applying, inspect rollout status, readiness, Service endpoints and an actual application request. Rollback restores workload configuration, not an incompatible database migration or deleted external data.

Choose under exam pressure

Traps

• Switching a tag does not prove every node runs the intended digest.
• Rollback needs data/schema compatibility.

Practise this topic

Memory hook: Context first; events next; change one cause.

Must remember

Start with kubectl config current-context and the requested namespace. Use get, describe and sorted events to identify the failing layer before editing. Verify the target context again when switching between tasks.

kubectl logs -c CONTAINER selects the right container; --previous reads a prior terminated instance. kubectl exec is useful when tools exist in the container; minimal images may lack a shell. Use an approved debug container or diagnostic Pod when appropriate, without assuming it has identical policy/identity to the failing workload.

On a node, systemctl status kubelet, journalctl -u kubelet and runtime tools such as crictl help when the API path is broken. Static control-plane Pod manifests are managed by the kubelet; keep backups outside its watched manifest directory to avoid accidental extra Pods.

kubectl top requires a metrics API and shows recent usage; it is not a full historical monitoring system. Compare usage with requests, limits and node allocatable capacity. Check DNS, Service endpoints, policies and routing in sequence for network failures.

Timed drill: diagnose a deliberately broken selector, an oversized request and a wrong image in a disposable cluster. State the observed cause, make the smallest correction, then verify the requested application behavior. A green Pod phase alone is not proof of success.

Choose under exam pressure

Traps

• Blind restarts can erase evidence and fail to fix the cause.
• Editing the wrong context can complete the wrong task perfectly.

Practise this topic

Memory hook: Selector finds endpoints; policy permits the path.

Must remember

Pods communicate using cluster networking supplied by the CNI. A Service gives stable discovery for a changing set of endpoints. Check labels/selectors, target ports and EndpointSlices when traffic reaches the Service but no application responds.

Ingress describes HTTP/S routing, but needs an Ingress controller. TLS certificates normally come from referenced Secrets; matching host/path and backend port matters. Gateway API separates infrastructure ownership (GatewayClass/controller), listeners (Gateway) and application routing (HTTPRoute). Inspect parent references, allowed routes, listener hostnames and cross-namespace ReferenceGrants where needed. Gateway resources also require an implementation.

CoreDNS resolves service names such as api.team.svc.cluster.local, with the actual cluster domain configurable. Test name resolution separately from network reachability. Check namespace search suffixes, CoreDNS Pods/Service, resolv.conf and DNS egress policy before blaming application code.

Gateway routing drill: inspect kubectl get gateway,httproute -n team -o yaml, then trace parentRefs to the listener and backendRefs to the Service. An HTTPRoute backend port is the Service port, not an arbitrary container port. Check host/path matching and the controller's status conditions before testing a request with the intended Host header. A route that exists but never attaches to its Gateway cannot deliver the requested traffic.

NetworkPolicy is enforced only by supporting networking implementations. Policies are additive allow lists. Once a Pod is isolated for ingress or egress, applicable allowed traffic must be specified; when both ends are isolated, both source egress and destination ingress must permit the connection. An empty selector selects all Pods in that namespace. Namespace and Pod selectors in the same peer entry are AND; separate entries are alternatives.

Practical drill: draw client → DNS → Service → endpoint → container. For each arrow, identify one read-only command and one possible configuration fault.

Choose under exam pressure

Traps

• Creating a LoadBalancer Service does not guarantee a load-balancer implementation exists.
• Default-deny egress can also block DNS.

Practise this topic

Memory hook: Authentication identifies; RBAC permits; admission validates.

Must remember

Authentication establishes the caller; authorization such as RBAC decides whether it may perform the API operation; admission may mutate or reject an otherwise authorized request. A valid token therefore does not guarantee the Pod will be admitted. Inspect the rejection message, namespace policies and requested fields.

A ServiceAccount is a namespaced workload identity. Use a dedicated account with only necessary grants, and disable automatic token mounting when the workload does not need API access. Modern projected tokens can be short-lived and audience-bound. A Secret containing base64 text is not encrypted merely because of that encoding; access and at-rest protection remain essential.

Check spec.serviceAccountName on the actual Pod before diagnosing its permissions. To test an allowed operation, an authorized administrator can use kubectl auth can-i get configmaps --as=system:serviceaccount:team:app -n team; repeat with a forbidden operation and expect no. RoleBindings grant access in their own namespace, while the ServiceAccount subject also carries its namespace. A grant in the wrong namespace cannot be repaired by changing only the token.

Security contexts control supported user/group IDs, privilege escalation, capabilities, read-only root filesystems and seccomp settings. Running as non-root is useful but not equivalent to isolation from every host risk. Namespace quotas limit aggregate usage; LimitRanges can default/restrict per-object resources. Requests drive scheduling and CPU utilization scaling calculations; limits constrain resource use.

CRDs add API resource types; an operator/controller supplies reconciliation behavior. Creating the CRD alone does not create all promised business behavior. Use kubectl api-resources and kubectl explain to discover supported fields. Deprecated API versions may later be removed; migrate manifests to served versions and check changed schemas/defaults before upgrading.

Drill: distinguish Forbidden from an admission-policy rejection and a Pending scheduling event. They occur at different layers and need different corrections; granting cluster-admin to fix all three is both ineffective and excessive.

Choose under exam pressure

Traps

• ServiceAccount scope and RoleBinding namespace matter.
• An operator needs controller logic, not only a custom resource definition.

Practise this topic