docs: add Kubernetes CKS study notes

kubernetes/level 1/task-1.md

@@ -0,0 +1,95 @@
+# Assignment
+
+The Nautilus DevOps team is diving into Kubernetes for application management. One team member has a task to create a pod according to the details below:
+
+
+Create a pod named pod-httpd using the httpd image with the latest tag. Ensure to specify the tag as httpd:latest.
+
+Set the app label to httpd_app, and name the container as httpd-container.
+
+Note: The kubectl utility on the jump-host has been configured to work with the Kubernetes cluster.
+
+# Solution
+
+# Kubernetes Pod — `pod-httpd`
+
+A single pod running the `httpd:latest` image, with an `app: httpd_app` label and a
+named container. Applied inline via a heredoc — no manifest file on disk.
+
+## Apply (heredoc → kubectl)
+
+```bash
+kubectl apply -f - <<'EOF'
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-httpd
+  labels:
+    app: httpd_app
+spec:
+  containers:
+    - name: httpd-container
+      image: httpd:latest
+EOF
+```
+
+## How it works
+
+### The heredoc apply pattern
+
+- **`kubectl apply -f -`** — the `-f -` tells kubectl to read the manifest from
+  **stdin** instead of a file. The heredoc feeds the YAML straight in, so nothing is
+  written to disk.
+- **`<<'EOF'` (delimiter quoted)** — quoting `EOF` disables shell expansion inside the
+  body, so any `$VAR`, backticks, or `$(...)` in a manifest stay literal rather than
+  being interpreted by the shell. For Kubernetes YAML this is almost always what you
+  want. Use unquoted `<<EOF` only when you deliberately want the shell to interpolate a
+  variable into the manifest before it reaches kubectl.
+- **Indentation still matters** — YAML inside the heredoc must keep exact indentation,
+  spaces not tabs.
+
+### The manifest, field by field
+
+- **`apiVersion: v1` / `kind: Pod`** — a Pod is a core (`v1`) object, the smallest
+  deployable unit in Kubernetes: one or more containers sharing a network namespace and
+  storage.
+- **`metadata.name: pod-httpd`** — the pod's name, exactly as required.
+- **`metadata.labels.app: httpd_app`** — the required label. Labels are key/value tags
+  used by selectors (Services, ReplicaSets, `kubectl get -l`) to target the pod, so
+  `kubectl get pods -l app=httpd_app` will match this pod.
+- **`spec.containers`** — the list of containers in the pod, here a single entry:
+  - **`name: httpd-container`** — the container name, exactly as required. This is the
+    name you'd pass to `kubectl logs` / `kubectl exec -c`.
+  - **`image: httpd:latest`** — the Apache HTTP Server image at the `latest` tag,
+    specified explicitly as required. Writing just `httpd` would default the tag to
+    `latest` anyway, but the task asks for the tag to be stated, so it's spelled out.
+
+### Label vs. name — two different things
+
+Easy to conflate, but distinct:
+- the **pod name** (`pod-httpd`) uniquely identifies the pod in its namespace, and
+- the **`app` label** (`httpd_app`) is a selector tag that can be shared across many
+  pods.
+
+They live in different manifest fields (`metadata.name` vs `metadata.labels`) and serve
+different purposes.
+
+## Verify
+
+```bash
+# Pod is running with the correct name
+kubectl get pod pod-httpd -o wide
+
+# Label is set
+kubectl get pod pod-httpd --show-labels
+
+# Container name and image are correct
+kubectl get pod pod-httpd \
+  -o jsonpath='{.spec.containers[0].name}{"  "}{.spec.containers[0].image}{"\n"}'
+```
+
+Expected — `pod-httpd` in `Running` status, labels showing `app=httpd_app`, and the
+jsonpath printing `httpd-container  httpd:latest`.
+
+> If the pod sits in `ImagePullBackOff`, the node may be offline or rate-limited on the
+> pull. `kubectl describe pod pod-httpd` shows the pull events under `Events:`.