🔍
Linux Foundation / CNCFAdvancedLinux FoundationCNCFKubernetesCluster Administration

Certified Kubernetes Administrator

CKA

The Certified Kubernetes Administrator exam validates practical Kubernetes administration skills across cluster architecture, workloads, services, networking, storage, and troubleshooting. Work through hands-on simulation tasks with command-line solutions and concise explanations.

Practice 23 hands-on tasks📖 Browse all 23 questions & answers

Work through each task in a Kubernetes environment, then reveal the suggested commands and explanation.

Questions

View all →
  1. 1SIMULATION - Context - You have been asked to create a new ClusterRole for a deployment pipeline and bind it to a specific ServiceAccount scoped to a specific namespace. Task - Create a new ClusterRole named deployment-clusterrole, which only allows to create the following resource types: • Deployment • Stateful Set • DaemonSet Create a new ServiceAccount named cicd-token in the existing namespace app-team1. Bind the new ClusterRole deployment-clusterrole to the new ServiceAccount cicd-token, limited to the namespace app-team1.
  2. 2SIMULATION - Task - Set the node named ek8s-node-0 as unavailable and reschedule all the pods running on it.
  3. 3SIMULATION - Task - Given an existing Kubernetes cluster running version 1.22.1, upgrade all of the Kubernetes control plane and node components on the master node only to version 1.22.2. Be sure to drain the master node before upgrading it and uncordon it after the upgrade. You are also expected to upgrade kubelet and kubectl on the master node.
  4. 4SIMULATION - Task - First, create a snapshot of the existing etcd instance running at https://127.0.0.1:2379, saving the snapshot to /var/lib/backup/etcd-snapshot.db. Next, restore an existing, previous snapshot located at /var/lib/backup/etcd-snapshot-previous.db.
  5. 5SIMULATION - Task - Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace fubar. Ensure that the new NetworkPolicy allows Pods in namespace internal to connect to port 9000 of Pods in namespace fubar. Further ensure that the new NetworkPolicy: • does not allow access to Pods, which don't listen on port 9000 • does not allow access from Pods, which are not in namespace internal
  6. 6SIMULATION - Task - Reconfigure the existing deployment front-end and add a port specification named http exposing port 80/tcp of the existing container nginx. Create a new service named front-end-svc exposing the container port http. Configure the new service to also expose the individual Pods via a NodePort on the nodes on which they are scheduled.
  7. 7SIMULATION - Task - Scale the deployment presentation to 3 pods.
  8. 8SIMULATION - Task - Schedule a pod as follows: • Name: nginx-kusc00401 • Image: nginx • Node selector: disk=ssd
  9. 9SIMULATION - Task - Check to see how many nodes are ready (not including nodes tainted NoSchedule) and write the number to /opt/KUSC00402/kusc00402.txt.
  10. 10SIMULATION - Task - Schedule a Pod as follows: • Name: kucc8 • App Containers: 2 • Container Name/Images: - nginx - consul