CKA Practice: Exam-Style Tasks
0%
k8s-lab, bash
Welcome to the DevOpsLesson Kubernetes Lab ⎈
This is a safe, simulated Kubernetes cluster. Nothing runs on your machine.
Follow the steps on the left. Type a kubectl command below, or type 'help' anytime.
Every command this lab teaches
CKA Practice: Exam-Style Tasks is 18 steps, about 45 minutes. Each one asks a question, you type the answer in the terminal above, and it is checked before you move on. Nothing is installed and nothing can break.
Beginner6 steps
- Create the namespace “exam”. The next tasks work inside it.
kubectl create namespace exam - Switch the current context’s namespace to “exam”.
kubectl config set-context --current --namespace=exam - Print a Pod manifest for “web” (image nginx) using a client-side dry run.
kubectl run web --image=nginx --dry-run=client -o yaml - Deployment “frontend”, image nginx:1.27, 3 replicas, namespace exam.
kubectl create deployment frontend --image=nginx:1.27 --replicas=3 -n exam - ConfigMap “app-config” in exam, key APP_MODE, value production.
kubectl create configmap app-config --from-literal=APP_MODE=production -n exam - Generic Secret “db-creds” in exam with the key DB_PASSWORD.
kubectl create secret generic db-creds --from-literal=DB_PASSWORD=s3cr3t -n exam
Intermediate5 steps
- Service “frontend” in exam, type NodePort, port 80.
kubectl expose deployment frontend --port=80 --type=NodePort -n exam - List pods across every namespace and find the failing ones.
kubectl get pods -A - Read the events for a failing pod in prod.
kubectl get events -n prod - Correct the image tag on the “api” Deployment. It should be nginx:1.27-alpine.
kubectl set image deployment/api nginx=nginx:1.27-alpine -n prod - Check the rollout status of “api” in prod.
kubectl rollout status deployment/api -n prod
Advanced7 steps
- Cordon the node “cka-worker2”.
kubectl cordon cka-worker2 - Drain “cka-worker2”. Every node runs kube-proxy as a DaemonSet.
kubectl drain cka-worker2 --ignore-daemonsets - Uncordon “cka-worker2”.
kubectl uncordon cka-worker2 - ServiceAccount “deployer” in the exam namespace.
kubectl create serviceaccount deployer -n exam - Role “pod-reader” in exam: verbs get, list, watch on pods.
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n exam - RoleBinding “deployer-pod-reader” in exam: Role pod-reader → ServiceAccount exam:deployer.
kubectl create rolebinding deployer-pod-reader --role=pod-reader --serviceaccount=exam:deployer -n exam - Use kubectl auth can-i, impersonating the deployer ServiceAccount.
kubectl auth can-i list pods -n exam --as=system:serviceaccount:exam:deployer