Mock Exams

apiVersion: v1
kind: Pod
metadata:
  name: mc-pod
  namespace: mc                  # use the namespace the task names (the task screenshot shows mc-namespace)
spec:
  volumes:
  - name: shared-volume
    emptyDir: {}                 # non-persistent; lives as long as the pod
  containers:
  - name: mc-pod-1
    image: nginx:1-alpine
    env:
    - name: NODE_NAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName   # Downward API
  - name: mc-pod-2
    image: busybox:1
    command: ["sh", "-c", "while true; do date >> /var/log/shared/date.log; sleep 1; done"]
    volumeMounts:
    - name: shared-volume
      mountPath: /var/log/shared
  - name: mc-pod-3
    image: busybox:1
    command: ["sh", "-c", "until [ -f /var/log/shared/date.log ]; do sleep 1; done; tail -f /var/log/shared/date.log"]
    volumeMounts:
    - name: shared-volume
      mountPath: /var/log/shared
  restartPolicy: Always

kubectl apply -f question1.yaml
kubectl logs mc-pod -n mc -c mc-pod-3 -f      # timestamps written by mc-pod-2 appear continuously
kubectl exec mc-pod -n mc -c mc-pod-1 -- env | grep NODE_NAME   # Beyond the course: check the env var

ssh bob@node01
sudo su -                                   # become root
cd /root && ls -l                           # find the package (the file name varies)
dpkg -i ./cri-dockerd_0.3.16.3-0.debian.deb # output: package configured, unit symlinks created
systemctl start cri-docker.service
systemctl enable cri-docker.service
systemctl status cri-docker.service                # expect: Active: active (running)
systemctl is-enabled cri-docker.service            # expect: enabled

kubectl get crd | grep -i vertical | awk '{print $1}' > /root/vpa-crds.txt
cat /root/vpa-crds.txt
# verticalpodautoscalercheckpoints.autoscaling.k8s.io
# verticalpodautoscalers.autoscaling.k8s.io

kubectl expose pod messaging --port=6379 --name=messaging-service   # type defaults to ClusterIP
kubectl get svc messaging-service
kubectl describe svc messaging-service      # Endpoints must show <messaging pod IP>:6379

kubectl create deployment hr-web-app --image=kodekloud/webapp-color --replicas=2
kubectl get deployment hr-web-app
kubectl get pods -l app=hr-web-app          # create deployment sets the label app=<name>
kubectl get deployment hr-web-app -o yaml > hr-web-app.yaml   # optional: keep a manifest

kubectl logs orange -c init-myservice       # shows the error
kubectl get pod orange -o yaml > question6.yaml
# edit: initContainers[init-myservice].command: sh -c "sleeeep 2;"  ->  "sleep 2;"
kubectl replace -f question6.yaml --force   # delete + recreate
kubectl get pod orange                      # Init completes, then Running

initContainers:
- name: init-myservice
  image: busybox
  command: ["sh", "-c", "sleep 2;"]

apiVersion: v1
kind: Service
metadata:
  name: hr-web-app-service
  labels:
    app: hr-web-app
spec:
  type: NodePort
  selector:
    app: hr-web-app          # must match the deployment's pod labels
  ports:
  - port: 8080
    targetPort: 8080         # webapp-color listens on 8080
    nodePort: 30082
    protocol: TCP

kubectl apply -f question7.yaml
kubectl describe svc hr-web-app-service     # NodePort: 30082/TCP, Endpoints = the 2 pod IPs

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-analytics
spec:
  capacity:
    storage: 100Mi
  volumeMode: Filesystem
  accessModes:
  - ReadWriteMany
  hostPath:
    path: /pv/data-analytics

kubectl apply -f question8.yaml
kubectl get pv pv-analytics                 # STATUS Available until a PVC binds to it

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: webapp-hpa
  namespace: default
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: kk-app-deploy
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 50
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300

kubectl apply -f webapp-hpa.yaml
kubectl get hpa webapp-hpa
kubectl describe hpa webapp-hpa

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: analytics-vpa
  namespace: default
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: analytics-deployment
  updatePolicy:
    updateMode: "Auto"        # VPA may evict and recreate pods to apply new requests

kubectl apply -f question10.yaml
kubectl get vpa
kubectl describe vpa analytics-vpa

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: web-gateway
  namespace: nginx-gateway
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    protocol: HTTP
    port: 80

kubectl apply -f question11.yaml
kubectl get gateway -n nginx-gateway
kubectl describe gateway web-gateway -n nginx-gateway   # status gets filled in once a controller programs it

helm list -n kk-ns                               # find the release and its current chart version
helm repo update
helm search repo kk-mock1 --versions             # optional: list available versions
helm search repo kk-mock1/nginx --versions       # when you know <repo>/<chart>
helm upgrade kk-mock1 kk-mock1/nginx --version 18.1.5 -n kk-ns
helm list -n kk-ns                               # CHART shows nginx-18.1.5
helm status kk-mock1 -n kk-ns

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-sc
  annotations:
    storageclass.kubernetes.io/is-default-class: "true"   # this annotation makes it the default class
provisioner: kubernetes.io/no-provisioner                 # manual/static provisioning
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
parameters: {}

kubectl apply -f question1.yaml     # storageclass.storage.k8s.io/local-sc created
kubectl get sc                      # Beyond the course: local-sc shows "(default)"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: logging-deployment
  namespace: logging-ns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: app-logger
  template:
    metadata:
      labels:
        app: app-logger
    spec:
      volumes:
        - name: log-volume
          emptyDir: {}
      containers:
        - name: app-container
          image: busybox:1.28
          command:
            - sh
            - -c
            - |
              mkdir -p /var/log/app
              while true; do
                echo "Log entry" >> /var/log/app/app.log
                sleep 5
              done
          volumeMounts:
            - name: log-volume
              mountPath: /var/log/app
        - name: log-agent
          image: busybox:1.28
          command: ["sh", "-c", "until [ -f /var/log/app/app.log ]; do sleep 1; done; tail -f /var/log/app/app.log"]
          volumeMounts:
            - name: log-volume
              mountPath: /var/log/app

kubectl create namespace logging-ns          # only if it does not exist
kubectl apply -f question2.yaml
kubectl get pods -n logging-ns
kubectl logs <pod-name> -c log-agent -n logging-ns -f   # "Log entry" lines

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  namespace: ingress-ns
spec:
  ingressClassName: nginx
  rules:
    - host: kodekloud-ingress.app
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webapp-svc
                port:
                  number: 80

kubectl create namespace ingress-ns   # only if absent
kubectl apply -f question3.yaml
kubectl get ingress -n ingress-ns
curl -s http://kodekloud-ingress.app/        # the client must resolve the host to the ingress IP (DNS or /etc/hosts)

kubectl create deployment nginx-deploy --image=nginx:1.16 --dry-run=client -o yaml > question4.yaml
kubectl apply -f question4.yaml
kubectl get deploy nginx-deploy
kubectl rollout history deployment nginx-deploy
kubectl set image deployment/nginx-deploy nginx=nginx:1.17     # container name "nginx" comes from the image name
kubectl rollout status deployment/nginx-deploy
kubectl rollout history deployment nginx-deploy                 # now 2 revisions
kubectl rollout history deployment nginx-deploy --revision=2    # shows image nginx:1.17

base64 -w0 john.csr        # single-line base64 -> goes into spec.request

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: john-developer
spec:
  signerName: kubernetes.io/kube-apiserver-client   # required in v1
  request: <BASE64_CSR>
  usages:
    - digital signature
    - key encipherment
    - client auth

kubectl apply -f question5-csr.yaml
kubectl get csr john-developer                     # Pending
kubectl certificate approve john-developer         # Approved,Issued
kubectl get csr john-developer -o jsonpath='{.status.certificate}' | base64 -d > john.crt

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer
  namespace: development
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["create", "list", "get", "update", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: john-developer-role-binding
  namespace: development
subjects:
  - kind: User
    name: john                    # = CN in the CSR
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f question5-rbac.yaml               # create the namespace first if it is missing
kubectl auth can-i create pods --as=john -n development   # yes
kubectl auth can-i create pods --as=john -n default       # no

kubectl run nginx-resolver --image=nginx --restart=Never
kubectl expose pod nginx-resolver --name=nginx-resolver-service --port=80 --target-port=80 --type=ClusterIP
kubectl get svc nginx-resolver-service

# Service lookup from a throwaway busybox pod; the output is saved locally
kubectl run test-nslookup --image=busybox:1.28 --rm -it --restart=Never -- nslookup nginx-resolver-service > nginx.svc

# Pod lookup: pod DNS name = <IP with dashes>.<ns>.pod.cluster.local
POD_IP=$(kubectl get pod nginx-resolver -o jsonpath='{.status.podIP}')
IP_DASH=$(echo $POD_IP | tr '.' '-')          # 172.17.1.18 -> 172-17-1-18
kubectl run test-nslookup2 --image=busybox:1.28 --rm -it --restart=Never -- nslookup ${IP_DASH}.default.pod.cluster.local > nginx.pod

kubectl run nginx-critical --image=nginx --restart=Never --dry-run=client -o yaml > static.yaml
# copy the manifest to the node (scp, or paste it into a file over ssh), then on cluster1-node01:
sudo mv static.yaml /etc/kubernetes/manifests/static.yaml
# back on the control plane:
kubectl get pod -o wide        # nginx-critical-cluster1-node01, NODE = cluster1-node01

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: backend-hpa
  namespace: backend
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: backend-deployment
  minReplicas: 3
  maxReplicas: 15
  metrics:
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 65

kubectl create namespace backend        # only if it does not exist
kubectl apply -f webapp-hpa.yaml
kubectl describe hpa backend-hpa -n backend

kubectl get nodes                       # connection refused
sudo systemctl status kubelet           # inactive (dead)
sudo systemctl start kubelet
sudo systemctl enable kubelet
crictl ps -a | grep kube-apiserver      # the API server container comes back
kubectl get pods -n kube-system
kubectl get nodes

kubectl get gateway -n cka5673 -o yaml > question10.yaml   # or: kubectl edit gateway web-gateway -n cka5673

spec:
  gatewayClassName: kodekloud        # keep the existing class
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      hostname: kodekloud.com
      tls:
        certificateRefs:             # Secret in the Gateway's namespace (mode defaults to Terminate)
          - name: kodekloud-tls
      allowedRoutes:
        namespaces:
          from: Same

kubectl apply -f question10.yaml
kubectl get gateway -n cka5673

helm list -A                                                        # every release, every namespace
helm get manifest <release-name> -n <namespace> | grep -i "kodekloud/webapp-color:v1"
helm uninstall <release-name> -n <namespace>                        # e.g. helm uninstall atlanta-page-apd -n atlanta-page-04

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: net-policy-3
  namespace: backend
spec:
  podSelector: {}                 # every pod in backend
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend      # only namespaces labelled name=frontend
      ports:
        - protocol: TCP
          port: 80                # and only TCP/80

kubectl apply -f net-pol-3.yaml

kubectl describe deployment backend-api
kubectl describe rs backend-api-<rs-suffix>        # FailedCreate ... exceeded quota
kubectl describe resourcequota cpu-mem-quota       # Used vs Hard
kubectl edit deployment backend-api                # lower spec.template.spec.containers[].resources.requests.memory, e.g. 90Mi
kubectl delete rs backend-api-6b6454f5cf           # optional: drop the old RS so its pods release quota
kubectl get deployment backend-api                 # READY 3/3

curl -O https://raw.githubusercontent.com/projectcalico/calico/v3.29.2/manifests/custom-resources.yaml
# edit: Installation spec.calicoNetwork.ipPools[0].cidr: 172.17.0.0/16
kubectl apply -f custom-resources.yaml

kubectl run web-app --image=nginx --restart=Never
kubectl get pod web-app -o wide
POD_IP=$(kubectl get pod web-app -o jsonpath='{.status.podIP}')
kubectl run test --rm -it --image=jrecord/nettools --restart=Never -- curl http://${POD_IP}/   # nginx welcome HTML

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.ipv4.ip_forward = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
sudo sysctl --system                         # apply now and on every boot
sysctl net.ipv4.ip_forward                   # = 1
sysctl net.bridge.bridge-nf-call-iptables    # = 1

# if net.bridge.* keys did not exist, load the module and APPLY AGAIN:
sudo modprobe br_netfilter
echo "br_netfilter" | sudo tee /etc/modules-load.d/br_netfilter.conf
sudo sysctl --system
sysctl net.bridge.bridge-nf-call-iptables

kubectl create serviceaccount pvviewer          # verify: kubectl get sa
kubectl create clusterrole pvviewer-role --resource=persistentvolumes --verb=list
kubectl create clusterrolebinding pvviewer-role-binding --clusterrole=pvviewer-role --serviceaccount=default:pvviewer
kubectl describe clusterrole pvviewer-role
kubectl describe clusterrolebinding pvviewer-role-binding

apiVersion: v1
kind: Pod
metadata:
  name: pvviewer
spec:
  serviceAccountName: pvviewer
  containers:
  - name: pvviewer
    image: redis

kubectl apply -f question2.yaml
kubectl get pod pvviewer                                       # Running
kubectl describe pod pvviewer                                  # Service Account: pvviewer
kubectl get pod pvviewer -o yaml | grep serviceAccountName    # pvviewer
kubectl auth can-i list persistentvolumes --as=system:serviceaccount:default:pvviewer   # Beyond the course: yes

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: rancher-sc
provisioner: rancher.io/local-path
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer   # binding waits until a pod uses the PVC

kubectl apply -f question3.yaml
kubectl get storageclass rancher-sc
kubectl describe storageclass rancher-sc

kubectl create configmap app-config -n cm-namespace \
  --from-literal=ENV=production \
  --from-literal=LOG_LEVEL=info
kubectl describe cm app-config -n cm-namespace
kubectl edit deploy cm-webapp -n cm-namespace       # add envFrom (below) under the container

spec:
  template:
    spec:
      containers:
      - name: <container-name>
        image: <image>
        envFrom:                 # imports every key as an env var
        - configMapRef:
            name: app-config

kubectl get pod -n cm-namespace                     # pods restart (new rollout)
kubectl describe pod -n cm-namespace -l app=cm-webapp
kubectl exec -n cm-namespace <pod-name> -- env | egrep 'ENV|LOG_LEVEL'

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: 50000
globalDefault: false
description: "Low priority class for test pods"

kubectl apply -f question5.yaml
kubectl get priorityclass
kubectl get pod lp-pod -n low-priority -o yaml > question5-pod.yaml
# edit: add spec.priorityClassName: low-priority ; delete the numeric spec.priority line
kubectl delete pod lp-pod -n low-priority
kubectl apply -f question5-pod.yaml          # or skip the delete: kubectl replace --force -f question5-pod.yaml
kubectl get pod -n low-priority

kubectl get pod --show-labels        # np-test-1 has run=np-test-1

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-np-test
  namespace: default
spec:
  podSelector:
    matchLabels:
      run: np-test-1
  policyTypes:
  - Ingress
  ingress:
  - ports:
    - protocol: TCP
      port: 80
    from:
    - podSelector: {}     # any pod in the SAME namespace

kubectl apply -f question6.yaml
kubectl get networkpolicy -n default
kubectl describe networkpolicy ingress-np-test -n default

kubectl taint node node01 env_type=production:NoSchedule
kubectl describe node node01 | grep -i taint
kubectl run dev-redis --image=redis:alpine --restart=Never   # will not be scheduled on node01

apiVersion: v1
kind: Pod
metadata:
  name: prod-redis
spec:
  tolerations:
  - key: env_type
    operator: Equal
    value: production
    effect: NoSchedule
  containers:
  - name: prod-redis
    image: redis:alpine

kubectl apply -f question7.yaml
kubectl get pod -o wide        # prod-redis on node01, dev-redis on another node

kubectl get pv
kubectl get pvc -n storage-ns
kubectl get pv app-pv -o yaml                       # compare accessModes, capacity, storageClassName
kubectl get pvc app-pvc -n storage-ns -o yaml > question8.yaml
# edit: spec.accessModes: [ReadWriteOnce]; delete status, resourceVersion, uid and other server-managed fields
kubectl delete pvc app-pvc -n storage-ns
kubectl apply -f question8.yaml
kubectl get pvc -n storage-ns                       # Bound to app-pv

kubectl get nodes --kubeconfig=/root/CKA/super.kubeconfig   # connection refused: controlplane:9999
cat /root/CKA/super.kubeconfig                              # look at clusters[].cluster.server
sudo netstat -tulnp | grep kube-apiserver                   # :::6443 LISTEN
# edit server: https://controlplane:9999  ->  https://controlplane:6443
kubectl get nodes --kubeconfig=/root/CKA/super.kubeconfig   # nodes listed

kubectl scale deploy nginx-deploy --replicas=3
kubectl get deploy nginx-deploy; kubectl get rs; kubectl get pods   # RS stuck at 1
kubectl get pod -n kube-system          # kube-controller-manager-* in ImagePullBackOff / CrashLoopBackOff
sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml      # fix the typo in image / command / volumes
kubectl get pod -n kube-system          # the kubelet recreates the static pod once the file is saved
kubectl get deploy nginx-deploy         # 3/3 once the controller reconciles

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
  namespace: api
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-deployment
  minReplicas: 1
  maxReplicas: 20
  metrics:
    - type: Pods                    # per-pod custom metric (not Resource)
      pods:
        metric:
          name: requests_per_second
        target:
          type: AverageValue
          averageValue: "1000"

kubectl apply -f question11.yaml
kubectl describe hpa api-hpa -n api   # metric shows <unknown> if no custom-metrics adapter serves it

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: web-route
  namespace: default
spec:
  parentRefs:
    - name: web-gateway
      namespace: default
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: web-service
          port: 80
          weight: 80
        - name: web-service-v2
          port: 80
          weight: 20

kubectl apply -f question12.yaml
kubectl get httproute -n default
kubectl describe httproute web-route -n default   # check that the parent shows Accepted

helm lint /root/new-version                          # must report 0 failures
helm install new-version-release /root/new-version   # install from the local chart directory
helm list
helm uninstall webpage-server-01
helm list

kubectl get node -o jsonpath='{.items[0].spec.podCIDR}' > /root/pod-cidr.txt          # first node
kubectl get node controlplane -o jsonpath='{.spec.podCIDR}' > /root/pod-cidr.txt       # a specific node
cat /root/pod-cidr.txt          # e.g. 172.17.0.0/24

kubectl config get-clusters                      # cluster1..cluster4
kubectl config use-context cluster3              # switch FIRST, for every question
kubectl get nodes                                # confirm which cluster you are on
kubectl get ns                                   # target namespace exists
kubectl get secrets -n beta-ns-cka14-arch        # beta-sec-cka14-arch  Opaque  1
kubectl get secret beta-sec-cka14-arch -n beta-ns-cka14-arch -o yaml   # data.secret: VGhpcyBpcyB0aGUgc2VjcmV0IQo=
echo 'VGhpcyBpcyB0aGUgc2VjcmV0IQo=' | base64 -d                       # This is the secret!
echo 'VGhpcyBpcyB0aGUgc2VjcmV0IQo=' | base64 -d > /opt/beta-sec-cka14-arch   # the file goes on the student node

kubectl --context cluster1 create serviceaccount student -n kube-system
kubectl --context cluster1 create clusterrole student --verb=get,list,watch --resource=pods
kubectl --context cluster1 create clusterrolebinding student --clusterrole=student --serviceaccount=kube-system:student
kubectl --context cluster1 auth can-i get pods --as=system:serviceaccount:kube-system:student   # yes