Linux Foundation CKA - Certified Kubernetes Administrator (CKA) Program

kubectl create namespace development

kubectl run nginx --image=nginx --restart=Never -n development

Solution:

vi pvc.yaml

storageclass pvc

apiVersion: v1

kind: PersistentVolumeClaim

metadata:

name: pv-volume

spec:

accessModes:

- ReadWriteOnce

volumeMode: Filesystem

resources:

requests:

storage: 10Mi

storageClassName: csi-hostpath-sc

# vi pod-pvc.yaml

apiVersion: v1

kind: Pod

metadata:

name: web-server

spec:

containers:

- name: web-server

image: nginx

volumeMounts:

- mountPath: "/usr/share/nginx/html"

name: my-volume

volumes:

- name: my-volume

persistentVolumeClaim:

claimName: pv-volume

# craete

kubectl create -f pod-pvc.yaml

#edit

kubectl edit pvc pv-volume --record

Task Summary

SSH into the correct node: cka000049

Find the highest existing user-defined PriorityClass

Create a new PriorityClass high-priority with a value one less

Patch Deployment busybox-logger (in namespace priority) to use this new PriorityClass

Step-by-Step Solution

1️⃣ SSH into the correct node

bash

CopyEdit

ssh cka000049

⚠️ Skipping this = zero score

2️⃣ Find the highest existing user-defined PriorityClass

Run:

bash

CopyEdit

kubectl get priorityclasses.scheduling.k8s.io

Example output:

vbnet

CopyEdit

NAME VALUE GLOBALDEFAULT AGE

default-low 1000 false 10d

mid-tier 2000 false 7d

critical-pods 1000000 true 30d

Exclude system-defined classes like system-* and the default global one (e.g., critical-pods).

Let's assume the highest user-defined value is 2000.

So your new class should be:

Value = 1999

3️⃣ Create the high-priority PriorityClass

Create a file called high-priority.yaml:

cat < high-priority.yaml

apiVersion: scheduling.k8s.io/v1

kind: PriorityClass

metadata:

name: high-priority

value: 1999

globalDefault: false

description: "High priority class for user workloads"

EOF

Apply it:

kubectl apply -f high-priority.yaml

4️⃣ Patch the busybox-logger deployment

Now patch the existing Deployment in the priority namespace:

kubectl patch deployment busybox-logger -n priority \

--type='merge' \

-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'

5️⃣ Verify your work

Confirm the patch was applied:

kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}'

✅ You should see:

high-priority

Also, confirm the class exists:

kubectl get priorityclass high-priority

Final Command Summary

ssh cka000049

kubectl get priorityclass

# Create the new PriorityClass

cat < high-priority.yaml

apiVersion: scheduling.k8s.io/v1

kind: PriorityClass

metadata:

name: high-priority

value: 1999

globalDefault: false

description: "High priority class for user workloads"

EOF

kubectl apply -f high-priority.yaml

# Patch the deployment

kubectl patch deployment busybox-logger -n priority \

--type='merge' \

-p '{"spec": {"template": {"spec": {"priorityClassName": "high-priority"}}}}'

# Verify

kubectl get deployment busybox-logger -n priority -o jsonpath='{.spec.template.spec.priorityClassName}'

kubectl get priorityclass high-priority

kubectl run nginx --image=nginx --restart=Never --port=80

solution

F:\Work\Data Entry Work\Data Entry\20200827\CKA\10 B.JPG

F:\Work\Data Entry Work\Data Entry\20200827\CKA\10 C.JPG

Task Summary

SSH into the correct node: cka000037

Modify existing deployment synergy-leverager

Add a sidecar container:

Name: sidecar

Image: busybox:stable

Command:

/bin/sh -c "tail -n+1 -f /var/log/synergy-leverager.log"

Use a shared volume mounted at /var/log

Don't touch existing container config except adding volume mount

Step-by-Step Solution

1️⃣ SSH into the correct node

ssh cka000037

⚠️ Skipping this will result in a zero score.

2️⃣ Edit the deployment

kubectl edit deployment synergy-leverager

This opens the deployment YAML in your default editor (vi or similar).

3️⃣ Modify the spec as follows

🔽 Inside the spec.template.spec, do these 3 things:

✅ A. Define a shared volume

Add under volumes: (at the same level as containers):

volumes:

- name: log-volume

emptyDir: {}

✅ B. Add volume mount to the existing container

Locate the existing container under containers: and add this:

volumeMounts:

- name: log-volume

mountPath: /var/log

🛑 Do not change any other configuration for this container.

✅ C. Add the sidecar container

Still inside containers:, add the new container definition after the first one:

- name: sidecar

image: busybox:stable

command:

- /bin/sh

- -c

- "tail -n+1 -f /var/log/synergy-leverager.log"

volumeMounts:

- name: log-volume

mountPath: /var/log

spec:

containers:

- name: main-container

image: your-existing-image

volumeMounts:

- name: log-volume

mountPath: /var/log

- name: sidecar

image: busybox:stable

command:

- /bin/sh

- -c

- "tail -n+1 -f /var/log/synergy-leverager.log"

volumeMounts:

- name: log-volume

mountPath: /var/log

volumes:

- name: log-volume

emptyDir: {}

Save and exit

If using vi or vim, type:

bash

CopyEdit

wq

5️⃣ Verify

Check the updated pods:

kubectl get pods -l app=synergy-leverager

Pick a pod name and describe it:

kubectl describe pod

Confirm:

2 containers running (main-container + sidecar)

Volume mounted at /var/log

ssh cka000037

kubectl edit deployment synergy-leverager

# Modify as explained above

kubectl get pods -l app=synergy-leverager

kubectl describe pod

Task Summary

SSH into cka000022 ✅

Modify an existing Deployment:

Namespace: spline-reticulator

Deployment: front-end

Container: nginx

Expose: port 80/tcp

Create a Service:

Name: front-end-svc

Type: NodePort

Port: 80 → container port 80

✅ Step-by-Step Solution

1️⃣ SSH into the correct node

ssh cka000022

⚠️ Skipping this = zero score

2️⃣ Edit the Deployment to expose port 80

kubectl edit deployment front-end -n spline-reticulator

Under containers: → nginx, add this if not present:

ports:

- containerPort: 80

protocol: TCP

✅ This enables the container to accept traffic on port 80.

3️⃣ Create a NodePort Service

Create a file named front-end-svc.yaml:

cat < front-end-svc.yaml

apiVersion: v1

kind: Service

metadata:

name: front-end-svc

namespace: spline-reticulator

spec:

type: NodePort

selector:

app: front-end

ports:

- port: 80

targetPort: 80

protocol: TCP

EOF

⚠️ Make sure the Deployment has a matching label selector like app: front-end. You can verify with:

kubectl get deployment front-end -n spline-reticulator -o yaml | grep labels -A 2

4️⃣ Apply the service

kubectl apply -f front-end-svc.yaml

5️⃣ Verify

Check if the service is created and has a NodePort assigned:

kubectl get svc front-end-svc -n spline-reticulator

✅ You should see something like:

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

front-end-svc NodePort 10.96.0.123 80:3XXXX/TCP 10s

Where 3XXXX is your automatically assigned NodePort (between 30000–32767).

Final Command Summary

ssh cka000022

kubectl edit deployment front-end -n spline-reticulator

# Add:

# ports:

# - containerPort: 80

cat < front-end-svc.yaml

apiVersion: v1

kind: Service

metadata:

name: front-end-svc

namespace: spline-reticulator

spec:

type: NodePort

selector:

app: front-end

ports:

- port: 80

targetPort: 80

protocol: TCP

EOF

kubectl apply -f front-end-svc.yaml

kubectl get svc front-end-svc -n spline-reticulator

Task Summary

SSH into cka000054

Install a CNI plugin that supports NetworkPolicies

Two CNI options provided:

Flannel v0.26.1 (❌ does NOT support NetworkPolicies)

Calico v3.28.2 ✅ (does support NetworkPolicies)

❗ Decision Point: Which CNI to choose?

✅ Choose Calico, because only Calico supports enforcing NetworkPolicies natively. Flannel does not.

✅ Step-by-Step Solution

1️⃣ SSH into the correct node

ssh cka000054

⚠️ Required. Skipping this results in zero score.

2️⃣ Install Calico CNI (v3.28.2)

Use the official manifest provided:

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml

This installs the Calico Operator, which then deploys the full Calico CNI stack.

3️⃣ Wait for Calico components to come up

Check the pods in tigera-operator and calico-system namespaces:

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

✅ You should see pods like:

calico-kube-controllers

calico-node

calico-typha

tigera-operator

Wait for all to be in Running state.

✅ (Optional) 4️⃣ Confirm CNI is enforcing NetworkPolicies

You can check:

kubectl get crds | grep networkpolicy

You should see:

networkpolicies.crd.projectcalico.org

This confirms Calico's CRDs are installed for policy enforcement.

Final Command Summary

ssh cka000054

kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml

kubectl get pods -n tigera-operator

kubectl get pods -n calico-system

kubectl get crds | grep networkpolicy

kubectl get pods -o=jsonpath="{.items[*]['metadata.name'

, 'metadata.namespace']}"