docs: add CKA exam preparation guide and cheat sheet

Co-authored-by: Junie <junie@jetbrains.com>

CKA_EXAM_GUIDE.md

@@ -0,0 +1,116 @@
+# CKA Exam Preparation & Scenario Decision Guide
+
+This guide is designed for fast mental retrieval during exam scenarios. It outlines **which command to choose based on the situation**, the exact syntax to run, and the official documentation shortcuts permitted during the exam.
+
+---
+
+## 1. Quick Environment Setup & Muscle Memory
+
+Run these first on every terminal/node session in the exam:
+
+```bash
+# Core aliases & shell variables
+alias k=kubectl
+export do="--dry-run=client -o yaml"
+export now="--force --grace-period=0"
+
+# Shell auto-completion with alias support
+source <(kubectl completion bash)
+complete -o default -F __start_kubectl k
+
+# Vim configuration (~/.vimrc)
+cat << 'EOF' > ~/.vimrc
+set tabstop=2
+set shiftwidth=2
+set expandtab
+set number
+syntax on
+EOF
+```
+
+---
+
+## 2. Situation-to-Command Decision Matrix
+
+| Situation / Task | First-Choice Command / Action | Key Flags / Syntax |
+| :--- | :--- | :--- |
+| **Create a single pod** | `k run <name> --image=<img...>` | `$do > pod.yaml` |
+| **Expose a pod/deployment as Service** | `k expose <pod/deploy> <name>` | `--port=80 --target-port=8080 --type=NodePort/ClusterIP` |
+| **Create Deployment** | `k create deploy <name> --image=<img>` | `--replicas=3 $do > deploy.yaml` |
+| **Create Job / CronJob** | `k create job <name> --image=<img>` <br> `k create cj <name> --image=<img>` | `--schedule="*/5 * * * *"` |
+| **Create Secret / ConfigMap** | `k create secret generic <name>` <br> `k create cm <name>` | `--from-literal=key=val` <br> `--from-file=config.txt` |
+| **Create ServiceAccount & Token** | `k create sa <name>` <br> `k create token <name>` | (Kubernetes 1.24+ standard) |
+| **Create RBAC Role & RoleBinding** | `k create role <name>` <br> `k create rolebinding <name>` | `--verb=get,list,watch --resource=pods,deployments` <br> `--role=<role> --serviceaccount=<ns>:<sa>` |
+| **Create ClusterRole & ClusterRoleBinding** | `k create clusterrole <name>` <br> `k create clusterrolebinding <name>` | `--verb=get,list --resource=nodes,pv` <br> `--clusterrole=<cr> --user=<user>` |
+| **Create Ingress** | `k create ingress <name>` | `--rule="host/path*=svc:port"` <br> `--class=nginx --annotation=...` |
+| **Check API permissions** | `k auth can-i <verb> <res>` | `--as=system:serviceaccount:<ns>:<sa> -n <ns>` |
+| **Find YAML syntax / field paths** | `k explain <resource>.<field>` | `k explain pod.spec.containers.securityContext --recursive` |
+| **Inspect Node / Pod metrics** | `k top node` / `k top pod` | `-A --sort-by=cpu` or `--sort-by=memory` |
+| **Drain node for maintenance** | `k drain <node>` | `--ignore-daemonsets --delete-emptydir-data --force` |
+| **Reactivate / Uncordon node** | `k uncordon <node>` | |
+| **Troubleshoot Node (Kubelet)** | `systemctl status kubelet` <br> `journalctl -u kubelet -e --no-pager` | Check `/etc/kubernetes/kubelet.conf` & `/var/lib/kubelet/config.yaml` |
+| **Control Plane Troubleshooting** | Inspect `/etc/kubernetes/manifests/` | Check `kube-apiserver.yaml`, `kube-scheduler.yaml`, `kube-controller-manager.yaml` |
+| **Etcd Backup** | `etcdctl snapshot save <file>` | `--endpoints=https://127.0.0.1:2379 --cacert=... --cert=... --key=...` |
+| **Etcd Restore** | `etcdctl snapshot restore <file>` | `--data-dir=/var/lib/etcd-backup` (update `etcd.yaml` volume hostPath) |
+| **Upgrade Node (Control Plane / Worker)** | `apt-get update && apt-get install -y --allow-change-held-packages kubeadm=1.31.x-1.1` | `kubeadm upgrade plan` -> `kubeadm upgrade apply` -> upgrade `kubelet`/`kubectl` -> `systemctl restart kubelet` |
+
+---
+
+## 3. Top Troubleshooting Patterns
+
+### A. Pod in `CrashLoopBackOff` or `Pending`
+1. Check events: `k describe pod <pod-name> -n <ns>`
+2. Check logs: `k logs <pod-name> -n <ns> --previous`
+3. If `Pending`: Check node taints, node selectors, affinity, or resource quotas/limits.
+   ```bash
+   k get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints
+   ```
+
+### B. Node in `NotReady`
+1. SSH into the node: `ssh <node>`
+2. Check kubelet service: `systemctl status kubelet`
+3. View logs: `journalctl -u kubelet -n 100 --no-pager`
+4. Common issues:
+   - Container runtime (containerd/crio) is down (`systemctl restart containerd`).
+   - Swap is enabled (`swapoff -a`).
+   - Invalid configuration or wrong certificate path in `/var/lib/kubelet/config.yaml` or `/etc/kubernetes/kubelet.conf`.
+
+### C. Static Pods
+- Manifest location: `/etc/kubernetes/manifests/` (or check `staticPodPath` in `/var/lib/kubelet/config.yaml`).
+- To create a static pod on a worker node:
+  ```bash
+  k run my-static --image=nginx $do > /etc/kubernetes/manifests/my-static.yaml
+  ```
+
+---
+
+## 4. Etcd Backup & Restore Reference
+
+### Snapshot:
+```bash
+ETCDCTL_API=3 etcdctl \
+  --endpoints=https://127.0.0.1:2379 \
+  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
+  --cert=/etc/kubernetes/pki/etcd/server.crt \
+  --key=/etc/kubernetes/pki/etcd/server.key \
+  snapshot save /opt/snapshot-pre-boot.db
+```
+
+### Restore:
+```bash
+ETCDCTL_API=3 etcdctl \
+  --data-dir=/var/lib/etcd-from-backup \
+  snapshot restore /opt/snapshot-pre-boot.db
+```
+Then edit `/etc/kubernetes/manifests/etcd.yaml` to update the hostPath volume for `etcd-data` to `/var/lib/etcd-from-backup`.
+
+---
+
+## 5. Official Kubernetes Documentation URLs Allowed in CKA
+- Kubernetes Documentation: `https://kubernetes.io/docs/`
+- Kubernetes Blog: `https://kubernetes.io/blog/`
+- GitHub Kubernetes Organization: `https://github.com/kubernetes/`
+- Cheatsheet: `https://kubernetes.io/docs/reference/kubectl/cheatsheet/`
+
+### Pro Tip for Search in Docs:
+Use the documentation search bar for exact resource types, e.g., `NetworkPolicy`, `PersistentVolume`, `Ingress`, or `kubeadm upgrade`. Copy YAML snippets directly from the docs and edit with `$do`.