14 KiB
CKA Mock Exam Pack v1 — full 120-minute simulation
Format-matched to the real thing: 17 weighted tasks, 120 minutes, 66% to pass. Domain distribution ≈ real curriculum: Troubleshooting ~30%, Cluster Architecture ~25%, Services & Networking ~20%, Workloads & Scheduling ~15%, Storage ~10%. Range: kind cluster
drills(1 CP + 2 workers, Calico, Gateway API CRDs, metrics-server, helm).Kind-isms (read once, then forget): the real exam says
ssh nodeX— here it'sdocker exec -it drills-worker bash(ordrills-worker2,drills-control-plane). Real exam switches kubectl contexts per task — here it's one context; the discipline you're simulating is reading the target of every task carefully.
EXAM PROTOCOL
- Run the entire MASTER SETUP below. Do not read it — it contains spoilers (it breaks things on purpose). Pipe it to a file and execute blind:
copy the block into
/tmp/setup.sh, thenbash /tmp/setup.sh > /tmp/setup.log 2>&1. - Set a hard 120:00 timer. No pauses, no notes, no Claude.
- Solve in any order. Flag anything stuck >8 min and move on. Reserve the last 10 minutes for a verification lap.
- When the timer dies: run the VALIDATION blocks, fill the score sheet, compute your percentage from the weights.
- Paste score sheet + your command history to Claude for the autopsy.
MASTER SETUP (do not read — paste and run)
#!/usr/bin/env bash
set +e
# --- namespaces
for ns in ex-neptune ex-mars ex-venus ex-pluto ex-saturn ex-mercury ex-titan ex-io ex-rescue; do kubectl create ns $ns; done
# Q1: kill kubelet on worker2
docker exec drills-worker2 systemctl stop kubelet
# Q5: broken deployment — missing CM + bad image tag
kubectl -n ex-neptune create deploy web-portal --image=nginx:1.99-fake --replicas=2
kubectl -n ex-neptune set env deploy/web-portal --from=configmap/portal-config 2>/dev/null
kubectl -n ex-neptune patch deploy web-portal --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/envFrom","value":[{"configMapRef":{"name":"portal-config"}}]}]'
# Q6: service with selector mismatch
kubectl -n ex-mars create deploy api-backend --image=nginx --replicas=2
kubectl -n ex-mars label deploy api-backend app=api-backend --overwrite
kubectl -n ex-mars apply -f - <<'EOF'
apiVersion: v1
kind: Service
metadata: {name: api-svc, namespace: ex-mars}
spec:
selector: {app: api-backent}
ports: [{port: 80, targetPort: 80}]
EOF
# Q16: crashing pod
kubectl -n ex-rescue run data-proc --image=busybox --restart=Never -- sh -c 'echo "FATAL: config /etc/proc/settings.ini not found" >&2; exit 1'
# Q17: broken static pod on worker
docker exec drills-worker bash -c 'mkdir -p /etc/kubernetes/manifests && cat > /etc/kubernetes/manifests/edge-cache.yaml <<EOF
apiVersion: v1
kind: Pod
metadata: {name: edge-cache}
spec:
containers:
- name: cache
image: redis:7-alpinee
ports: [{containerPort: 6379}]
EOF'
# Q4: gateway for httproute task
kubectl apply -f - <<'EOF'
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata: {name: exam-class}
spec: {controllerName: example.com/exam}
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: {name: main-gate, namespace: ex-venus}
spec:
gatewayClassName: exam-class
listeners: [{name: http, port: 80, protocol: HTTP}]
EOF
kubectl -n ex-venus create deploy web-v1 --image=hashicorp/http-echo -- /http-echo -text=v1 -listen=:5678
kubectl -n ex-venus create deploy web-v2 --image=hashicorp/http-echo -- /http-echo -text=v2 -listen=:5678
kubectl -n ex-venus expose deploy web-v1 --port=5678
kubectl -n ex-venus expose deploy web-v2 --port=5678
# Q3: netpol targets
kubectl -n ex-pluto run frontend --image=nginx --labels=role=frontend --port=80
kubectl -n ex-pluto run backend --image=nginx --labels=role=backend --port=80
kubectl -n ex-pluto run cache --image=nginx --labels=role=cache --port=80
# Q7: rbac targets
kubectl -n ex-saturn create sa deploy-bot
# Q11: rollout history to inspect
kubectl -n ex-mercury create deploy release-app --image=nginx:1.25
kubectl -n ex-mercury set image deploy/release-app nginx=nginx:1.26
kubectl -n ex-mercury set image deploy/release-app nginx=nginx:1.27-bogus
# Q12: scheduling
kubectl taint node drills-worker tier=critical:NoSchedule --overwrite
kubectl label node drills-worker zone=east --overwrite
kubectl label node drills-worker2 zone=west --overwrite
# Q13/Q14: storage
kubectl apply -f - <<'EOF'
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata: {name: local-manual}
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
EOF
docker exec drills-worker mkdir -p /opt/vol-alpha
kubectl -n ex-io create deploy metrics-writer --image=busybox -- sleep 3600
echo "SETUP DONE"
THE EXAM — 120:00 starts now
Q1 — 8% — Troubleshooting
Node drills-worker2 is NotReady. Find the cause, fix it, make the node Ready again. Write the name of the failed component into /tmp/exam/q1-component.txt.
Q2 — 8% — Cluster Architecture
Create a snapshot of the cluster's etcd database and save it inside the control-plane node at /root/etcd-backup.db. Then verify the snapshot and write the number of keys/revision info into /tmp/exam/q2-status.txt on your host.
(Hint allowed by the real exam's phrasing: certs live where kubeadm puts them. Enter the CP with docker exec -it drills-control-plane bash.)
Q3 — 6% — Services & Networking
In ex-pluto: Pods role=backend must accept ingress only from Pods role=frontend in the same namespace on port 80. Traffic from role=cache (and everything else) must be denied. Name the policy backend-shield. Egress stays open.
Q4 — 7% — Services & Networking
In ex-venus, attached to the existing Gateway main-gate, create HTTPRoute release-route: all requests to path prefix / go to web-v1:5678, except requests with header X-Version: v2 (exact) which go to web-v2:5678. Spec-level correctness counts (no dataplane on this range).
Q5 — 7% — Troubleshooting
Deployment web-portal in ex-neptune has 0/2 ready. There are two independent faults. Fix both. Desired end state: 2/2 Ready, env sourced from a ConfigMap named portal-config containing key MODE=production.
Q6 — 6% — Troubleshooting
Service api-svc in ex-mars returns no endpoints. Diagnose and repair the service (the deployment is correct). Prove endpoints exist afterward.
Q7 — 7% — Cluster Architecture
In ex-saturn, using imperative commands only: allow ServiceAccount deploy-bot to create, list, and delete Deployments in ex-saturn — nothing else, namespace-scoped. Verify with kubectl auth can-i (one positive, one negative check) and save both outputs to /tmp/exam/q7-cani.txt.
Q8 — 6% — Cluster Architecture
Using Helm: install chart bitnami/redis as release cache-layer in namespace ex-titan, chart version one minor behind latest, with architecture=standalone and auth disabled (auth.enabled=false) set via CLI. Then upgrade to the latest chart version preserving both overrides. Record helm history output to /tmp/exam/q8-history.txt.
Q9 — 4% — Cluster Architecture
A base kustomization exists at /tmp/drill-kz/base (from drill pack v1; recreate it if you cleaned it). Create overlay /tmp/drill-kz/overlays/exam that deploys into namespace ex-titan with name prefix exam- and image nginx:1.27. Apply it with -k.
Q10 — 5% — Workloads & Scheduling
Create HPA writer-hpa in ex-io for deployment metrics-writer: min 1, max 4, target 70% average CPU. Scale-down stabilization window 240s. (The deployment lacks CPU requests — part of the task is making the HPA functional.)
Q11 — 5% — Workloads & Scheduling
Deployment release-app in ex-mercury is stuck mid-rollout on a bad image. Roll it back to the previous working revision, then record: current image and the revision number you rolled back to → /tmp/exam/q11-rollback.txt.
Q12 — 5% — Workloads & Scheduling
Create deployment edge-daemon (image busybox, sleep 3600, 2 replicas) in namespace ex-io that runs only on drills-worker: tolerate its taint and pin via nodeAffinity on the zone=east label. Both replicas must land there.
Q13 — 5% — Storage
Create PV vol-alpha: 2Gi, RWO, storageClassName local-manual, hostPath /opt/vol-alpha. Create PVC claim-alpha in ex-io requesting 1Gi, same class. Explain in one line inside /tmp/exam/q13-why.txt why the PVC is Pending at this point. Then mount it in a pod vol-user (nginx) at /data and confirm Bound.
Q14 — 5% — Storage
Make local-manual the default StorageClass of the cluster. Then create PVC claim-default in ex-io with no storageClassName and prove (one command's output to /tmp/exam/q14-proof.txt) that it was assigned local-manual automatically.
Q15 — 5% — Services & Networking
In ex-mars, create an Ingress api-ingress (imperative generator allowed): host api.exam.local, path /v1 (Prefix) → service api-svc:80, ingressClassName nginx. The controller isn't installed — spec-level correctness counts. Ensure pathType is explicitly Prefix.
Q16 — 6% — Troubleshooting
Pod data-proc in ex-rescue is failing. Save its complete logs (the error line included) to /tmp/exam/q16-logs.txt, then recreate the pod so it runs successfully with the same name and image, sleeping 1 hour instead of crashing.
Q17 — 5% — Troubleshooting
A static pod edge-cache was configured on node drills-worker but never appears in kubectl get pods. Enter the node, find the fault, fix it, and get the mirror pod visible and Running in the default namespace.
VALIDATION (run only after the timer — expected outputs in comments)
EXAM_DIR="${EXAM_DIR:-./exam}"
mkdir -p "$EXAM_DIR"
# Q1
kubectl get node drills-worker2 # Ready
cat "$EXAM_DIR/q1-component.txt" # kubelet
# Q2
docker exec drills-control-plane ls -la /root/etcd-backup.db # exists, >1MB
cat "$EXAM_DIR/q2-status.txt" # snapshot status table/json
# Q3
PIP=$(kubectl -n ex-pluto get pod backend -o jsonpath='{.status.podIP}')
kubectl -n ex-pluto exec frontend -- curl -s -m 2 $PIP | head -1 # HTML (allowed)
kubectl -n ex-pluto exec cache -- curl -s -m 2 $PIP; echo EXIT=$? # EXIT=28 (blocked)
# Q4
kubectl -n ex-venus get httproute release-route -o yaml
# header match in same rule-entry as its path; default rule present; parentRef=main-gate
# Q5
kubectl -n ex-neptune get deploy web-portal # 2/2
kubectl -n ex-neptune get cm portal-config -o jsonpath='{.data.MODE}' # production
# Q6
kubectl -n ex-mars get endpoints api-svc # two pod IPs
# Q7
cat "$EXAM_DIR/q7-cani.txt" # yes + no
kubectl auth can-i delete deployments --as=system:serviceaccount:ex-saturn:deploy-bot -n ex-saturn # yes
kubectl auth can-i create pods --as=system:serviceaccount:ex-saturn:deploy-bot -n ex-saturn # no
# Q8
helm list -n ex-titan # cache-layer, latest chart
helm get values cache-layer -n ex-titan # architecture: standalone, auth.enabled: false
cat "$EXAM_DIR/q8-history.txt" # rev1 + rev2
# Q9
kubectl -n ex-titan get deploy exam-portal -o jsonpath='{.spec.template.spec.containers[0].image}' # nginx:1.27
# Q10
kubectl -n ex-io get hpa writer-hpa -o yaml | grep -E 'averageUtilization|stabilizationWindowSeconds'
# 70 + 240 under scaleDown; deploy now has cpu requests
# Q11
kubectl -n ex-mercury get deploy release-app -o jsonpath='{.spec.template.spec.containers[0].image}' # nginx:1.26
cat "$EXAM_DIR/q11-rollback.txt"
# Q12
kubectl -n ex-io get pods -l app=edge-daemon -o wide # both on drills-worker
# Q13
kubectl -n ex-io get pvc claim-alpha # Bound
cat "$EXAM_DIR/q13-why.txt" # WaitForFirstConsumer explanation
# Q14
kubectl get sc local-manual -o jsonpath='{.metadata.annotations.storageclass\.kubernetes\.io/is-default-class}' # true
cat "$EXAM_DIR/q14-proof.txt" # claim-default → local-manual
# Q15
kubectl -n ex-mars get ingress api-ingress -o jsonpath='{.spec.rules[0].http.paths[0].pathType}' # Prefix
# Q16
grep FATAL "$EXAM_DIR/q16-logs.txt" # the error line
kubectl -n ex-rescue get pod data-proc # Running
# Q17
kubectl get pod edge-cache-drills-worker # Running
Configurable path: the validation block reads/writes under
$EXAM_DIR(defaults to/tmp/exam). Override by exporting it before running, e.g.EXAM_DIR=/tmp/exam-attempt2 bash -c '...'orexport EXAM_DIR=/tmp/exam-attempt2beforehand. The exam task descriptions above still reference the literal/tmp/exam/...paths — either keep writing there during the exam, or export the sameEXAM_DIRvalue before starting the timer and use$EXAM_DIR/...for every task's output path too.
SCORE SHEET
| Q | Weight | Domain | Pass? | Time |
|---|---|---|---|---|
| 1 | 8 | TS | ||
| 2 | 8 | CA | ||
| 3 | 6 | SN | ||
| 4 | 7 | SN | ||
| 5 | 7 | TS | ||
| 6 | 6 | TS | ||
| 7 | 7 | CA | ||
| 8 | 6 | CA | ||
| 9 | 4 | CA | ||
| 10 | 5 | WS | ||
| 11 | 5 | WS | ||
| 12 | 5 | WS | ||
| 13 | 5 | ST | ||
| 14 | 5 | ST | ||
| 15 | 5 | SN | ||
| 16 | 6 | TS | ||
| 17 | 5 | TS |
Score = sum of passed weights. Pass line: 66.
RESET (between attempts)
for ns in ex-neptune ex-mars ex-venus ex-pluto ex-saturn ex-mercury ex-titan ex-io ex-rescue; do kubectl delete ns $ns --wait=false; done
kubectl delete gatewayclass exam-class; kubectl delete pv vol-alpha
kubectl taint node drills-worker tier=critical:NoSchedule- 2>/dev/null
kubectl label node drills-worker zone- ; kubectl label node drills-worker2 zone-
kubectl patch sc local-manual -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}'
docker exec drills-worker rm -f /etc/kubernetes/manifests/edge-cache.yaml
docker exec drills-worker2 systemctl start kubelet 2>/dev/null
kubectl delete pod edge-cache-drills-worker --force 2>/dev/null