From 69c8ec9557b8c4a612dbb58a71f589f032b63f25 Mon Sep 17 00:00:00 2001 From: vumast3r Date: Wed, 16 Sep 2026 19:48:09 -0600 Subject: [PATCH] docs: updated docs for current cka track. exam on Sat. --- history-cka.jsonl | 3 + weak-spots-cka.md | 302 +++++++++++++++++++++------------------------- 2 files changed, 139 insertions(+), 166 deletions(-) diff --git a/history-cka.jsonl b/history-cka.jsonl index 569ba2b..6a93547 100644 --- a/history-cka.jsonl +++ b/history-cka.jsonl @@ -4,3 +4,6 @@ {"at": "2026-09-12T22:17", "mode": "drill", "hard": false, "ids": [1, 6, 21, 34, 41], "score_pct": 87.5, "earned": 21, "total": 24, "time_used": 534, "pauses": 1, "paused_seconds": 40270, "results": {"1": {"pass": true, "earned": 6, "total": 6, "failed": []}, "6": {"pass": false, "earned": 3, "total": 6, "failed": ["CSR jane exists with signer kubernetes.io/kube-apiserver-client", "CSR jane approved and certificate issued"]}, "21": {"pass": true, "earned": 4, "total": 4, "failed": []}, "34": {"pass": true, "earned": 4, "total": 4, "failed": []}, "41": {"pass": true, "earned": 4, "total": 4, "failed": []}}} {"at": "2026-09-12T22:59", "mode": "drill", "hard": false, "ids": [17, 19, 37, 38, 39], "score_pct": 29.4, "earned": 10, "total": 34, "time_used": 1987, "pauses": 0, "paused_seconds": 0, "results": {"17": {"pass": false, "earned": 4, "total": 8, "failed": ["kubelet is active", "kubelet is enabled (survives reboot)"]}, "19": {"pass": false, "earned": 1, "total": 6, "failed": ["crasher.log captured and contains the DB_HOST failure", "pod crasher Running with DB_HOST set"]}, "37": {"pass": false, "earned": 1, "total": 6, "failed": ["CoreDNS Corefile forwards to the node resolver again", "in-cluster and external names resolve from a pod"]}, "38": {"pass": false, "earned": 0, "total": 7, "failed": ["kube-controller-manager manifest repaired and pod Running", "a new Deployment gets a ReplicaSet and running pods"]}, "39": {"pass": false, "earned": 4, "total": 7, "failed": ["kubelet config points at a CA file that exists", "kubelet active and enabled"]}}} {"at": "2026-09-13T01:06", "mode": "drill", "hard": false, "ids": [17, 19, 37, 38, 39], "score_pct": 29.4, "earned": 10, "total": 34, "time_used": 6649, "pauses": 0, "paused_seconds": 0, "results": {"17": {"pass": false, "earned": 4, "total": 8, "failed": ["kubelet is active", "kubelet is enabled (survives reboot)"]}, "19": {"pass": false, "earned": 1, "total": 6, "failed": ["crasher.log captured and contains the DB_HOST failure", "pod crasher Running with DB_HOST set"]}, "37": {"pass": false, "earned": 1, "total": 6, "failed": ["CoreDNS Corefile forwards to the node resolver again", "in-cluster and external names resolve from a pod"]}, "38": {"pass": false, "earned": 0, "total": 7, "failed": ["kube-controller-manager manifest repaired and pod Running", "a new Deployment gets a ReplicaSet and running pods"]}, "39": {"pass": false, "earned": 4, "total": 7, "failed": ["kubelet config points at a CA file that exists", "kubelet active and enabled"]}}} +{"at": "2026-09-14T16:49", "mode": "drill", "hard": false, "ids": [3, 5, 6, 8, 12, 13, 15, 16, 17, 18, 19, 20, 25, 28, 29, 30, 33, 37, 38, 39, 40, 42, 106, 112, 115, 120, 121], "score_pct": 42.0, "earned": 63, "total": 150, "time_used": 510, "pauses": 2, "paused_seconds": 87534, "results": {"17": {"pass": true, "earned": 8, "total": 8, "failed": []}, "20": {"pass": true, "earned": 8, "total": 8, "failed": []}, "3": {"pass": true, "earned": 5, "total": 5, "failed": []}, "5": {"pass": true, "earned": 5, "total": 5, "failed": []}, "8": {"pass": true, "earned": 4, "total": 4, "failed": []}, "12": {"pass": true, "earned": 4, "total": 4, "failed": []}, "38": {"pass": true, "earned": 7, "total": 7, "failed": []}, "18": {"pass": true, "earned": 7, "total": 7, "failed": []}, "19": {"pass": false, "earned": 4, "total": 6, "failed": ["crasher.log captured and contains the DB_HOST failure"]}, "6": {"pass": true, "earned": 6, "total": 6, "failed": []}, "13": {"pass": false, "earned": 0, "total": 5, "failed": ["ingressClassName nginx and host shop.example.com", "/api (Prefix) -> api:8080", "/ (Prefix) -> web:80"]}, "15": {"pass": false, "earned": 0, "total": 6, "failed": ["PV pv-data: 1Gi hostPath /mnt/data, RWO, Retain, class manual", "PVC pvc-data Bound to pv-data", "data-pod Running with claim mounted at /usr/share/data"]}, "16": {"pass": false, "earned": 0, "total": 5, "failed": ["StorageClass fast-local: local-path, WaitForFirstConsumer, Delete", "fast-local is default and standard is not", "fast-claim picked up fast-local and is Bound", "fast-pod Running with claim at /data"]}, "25": {"pass": false, "earned": 0, "total": 4, "failed": ["cka-sim-worker carries workload=batch:NoSchedule", "deployment tolerates the taint", "both pods Running on cka-sim-worker"]}, "28": {"pass": false, "earned": 0, "total": 4, "failed": ["pod Running, init container named setup completed", "emptyDir 'content' shared by both containers", "nginx serves the init-written content"]}, "29": {"pass": false, "earned": 1, "total": 4, "failed": ["deployment now references a different ConfigMap", "all pods available and see mode=new"]}, "30": {"pass": false, "earned": 0, "total": 4, "failed": ["container port 80 named svc-http", "Service port 8080 -> targetPort svc-http (by name)", "readiness probe uses the named port; endpoints ready"]}, "33": {"pass": false, "earned": 1, "total": 5, "failed": ["ops-19 has an aggregationRule with the right label", "aggregation populated rules from the two labelled roles", "sam can list pods and services cluster-wide"]}, "37": {"pass": false, "earned": 1, "total": 6, "failed": ["CoreDNS Corefile forwards to the node resolver again", "in-cluster and external names resolve from a pod"]}, "39": {"pass": false, "earned": 0, "total": 7, "failed": ["kubelet config points at a CA file that exists", "node Ready", "kubelet active and enabled"]}, "40": {"pass": false, "earned": 0, "total": 5, "failed": ["join.sh contains a kubeadm join with token and CA hash", "the token in the file exists in the cluster with TTL ~2h"]}, "42": {"pass": false, "earned": 0, "total": 4, "failed": ["applies to app=client-64, Egress only", "DNS rule: kube-system namespace + k8s-app=kube-dns, ports 53 UDP and TCP", "TCP 443 to 172.16.0.0/16 only"]}, "106": {"pass": false, "earned": 0, "total": 7, "failed": ["CRD exists, Namespaced, replicas has min/max and is required", "good created with environment prod", "replicas 0 is rejected and the message was saved", "defaulting works: defaulted.spec.environment == dev"]}, "112": {"pass": false, "earned": 0, "total": 7, "failed": ["Secret admin.lab.local-tls is kubernetes.io/tls with CN admin.lab.local", "Ingress web: class nginx, host, TLS secret, ssl-redirect annotation", "fp.txt matches the secret's certificate fingerprint"]}, "115": {"pass": false, "earned": 1, "total": 6, "failed": ["PVC uses a selector and is Bound to lv-nvme", "consumer Running on the nvme node with /data mounted"]}, "120": {"pass": false, "earned": 0, "total": 5, "failed": ["pod-cidr and service-cidr", "dns-ip and proxy-mode", "cka-sim-worker3 pod CIDR"]}, "121": {"pass": false, "earned": 1, "total": 6, "failed": ["Deployment ledger-73 in ac-bravo (the context's namespace), 2 available, owner=ac", "Service ledger-73 port 9000 in the same namespace", "ns.txt has the namespace"]}}} +{"at": "2026-09-15T20:55", "mode": "drill", "hard": false, "ids": [13, 15, 16, 19, 25, 28, 29, 30, 33, 37, 39, 40, 42, 106, 112, 115, 120, 121], "score_pct": 41.7, "earned": 40, "total": 96, "time_used": 608, "pauses": 1, "paused_seconds": 100482, "results": {"13": {"pass": true, "earned": 5, "total": 5, "failed": []}, "19": {"pass": true, "earned": 6, "total": 6, "failed": []}, "33": {"pass": true, "earned": 5, "total": 5, "failed": []}, "30": {"pass": true, "earned": 4, "total": 4, "failed": []}, "37": {"pass": true, "earned": 6, "total": 6, "failed": []}, "39": {"pass": true, "earned": 7, "total": 7, "failed": []}, "40": {"pass": false, "earned": 0, "total": 5, "failed": ["join.sh contains a kubeadm join with token and CA hash", "the token in the file exists in the cluster with TTL ~6h"]}, "42": {"pass": true, "earned": 4, "total": 4, "failed": []}, "15": {"pass": false, "earned": 0, "total": 6, "failed": ["PV pv-data: 1Gi hostPath /mnt/data, RWO, Retain, class manual", "PVC pvc-data Bound to pv-data", "data-pod Running with claim mounted at /usr/share/data"]}, "16": {"pass": false, "earned": 0, "total": 5, "failed": ["StorageClass fast-local: local-path, WaitForFirstConsumer, Delete", "fast-local is default and standard is not", "fast-claim picked up fast-local and is Bound", "fast-pod Running with claim at /data"]}, "25": {"pass": false, "earned": 0, "total": 4, "failed": ["cka-sim-worker carries team=finance:NoSchedule", "deployment tolerates the taint", "both pods Running on cka-sim-worker"]}, "28": {"pass": false, "earned": 0, "total": 4, "failed": ["pod Running, init container named setup completed", "emptyDir 'content' shared by both containers", "nginx serves the init-written content"]}, "29": {"pass": false, "earned": 1, "total": 4, "failed": ["deployment now references a different ConfigMap", "all pods available and see mode=new"]}, "106": {"pass": false, "earned": 0, "total": 7, "failed": ["CRD exists, Namespaced, replicas has min/max and is required", "good created with environment prod", "replicas 0 is rejected and the message was saved", "defaulting works: defaulted.spec.environment == dev"]}, "112": {"pass": false, "earned": 0, "total": 7, "failed": ["Secret portal.lab.local-tls is kubernetes.io/tls with CN portal.lab.local", "Ingress web: class nginx, host, TLS secret, ssl-redirect annotation", "fp.txt matches the secret's certificate fingerprint"]}, "115": {"pass": false, "earned": 1, "total": 6, "failed": ["PVC uses a selector and is Bound to lv-nvme", "consumer Running on the nvme node with /data mounted"]}, "120": {"pass": false, "earned": 0, "total": 5, "failed": ["pod-cidr and service-cidr", "dns-ip and proxy-mode", "cka-sim-worker3 pod CIDR"]}, "121": {"pass": false, "earned": 1, "total": 6, "failed": ["Deployment ledger-21 in ac-echo (the context's namespace), 2 available, owner=ac", "Service ledger-21 port 9000 in the same namespace", "ns.txt has the namespace"]}}} +{"at": "2026-09-16T19:40", "mode": "drill", "hard": false, "ids": [15, 16, 25, 28, 29, 40], "score_pct": 50.0, "earned": 14, "total": 28, "time_used": 1258, "pauses": 3, "paused_seconds": 80587, "results": {"15": {"pass": true, "earned": 6, "total": 6, "failed": []}, "25": {"pass": true, "earned": 4, "total": 4, "failed": []}, "29": {"pass": true, "earned": 4, "total": 4, "failed": []}, "16": {"pass": false, "earned": 0, "total": 5, "failed": ["StorageClass fast-local: local-path, WaitForFirstConsumer, Delete", "fast-local is default and standard is not", "fast-claim picked up fast-local and is Bound", "fast-pod Running with claim at /data"]}, "28": {"pass": false, "earned": 0, "total": 4, "failed": ["pod Running, init container named setup completed", "emptyDir 'content' shared by both containers", "nginx serves the init-written content"]}, "40": {"pass": false, "earned": 0, "total": 5, "failed": ["join.sh contains a kubeadm join with token and CA hash", "the token in the file exists in the cluster with TTL ~24h"]}}} diff --git a/weak-spots-cka.md b/weak-spots-cka.md index 87d2f03..08b636f 100644 --- a/weak-spots-cka.md +++ b/weak-spots-cka.md @@ -1,6 +1,6 @@ # CKA weak spots -_Generated by exam from 6 attempt(s); regenerated on every `end`._ +_Generated by exam from 9 attempt(s); regenerated on every `end`._ ## Domain scores (latest full exam, 2026-09-08T19:59, 14.3%) @@ -12,238 +12,208 @@ _Generated by exam from 6 attempt(s); regenerated on every `end`._ ## Drill next (`./exam drill weak`) -### Q03 · ARCH · Kustomize overlay (1/1 failed, last 0/5 pts, 2026-09-08T19:59) -- ✗ overlay kustomization.yaml exists -- ✗ resources deployed into namespace store-prod -- ✗ store-api has 3 replicas -- ✗ Deployment and Service carry label env=prod - -### Q05 · ARCH · Static pod (1/1 failed, last 0/5 pts, 2026-09-06T22:07) -- ✗ manifest containing static-web is in /etc/kubernetes/manifests on the node -- ✗ mirror pod static-web- is Running -- ✗ image is nginx:1.27 - -### Q06 · ARCH · Certificates: expiry check and user CSR (2/2 failed, last 3/6 pts, 2026-09-12T22:17) +### Q06 · ARCH · Certificates: expiry check and user CSR (2/3 failed, last 6/6 pts, 2026-09-12T22:17) - ✗ CSR jane exists with signer kubernetes.io/kube-apiserver-client - ✗ CSR jane approved and certificate issued -### Q08 · WORK · Multi-container pod with shared volume (1/1 failed, last 0/4 pts, 2026-09-08T19:59) -- ✗ pod log-shipper Running with containers app and shipper -- ✗ volume logs is an emptyDir mounted at /var/log in both containers -- ✗ shipper's logs show lines written by app - -### Q12 · NET · NodePort Service (1/1 failed, last 0/4 pts, 2026-09-08T19:59) -- ✗ Service shop-svc is NodePort, port 80 -> targetPort 80 -- ✗ nodePort is 30080 -- ✗ Service has endpoints - -### Q13 · NET · Ingress routing (1/1 failed, last 0/5 pts, 2026-09-08T19:59) +### Q13 · NET · Ingress routing (2/3 failed, last 5/5 pts, 2026-09-14T16:49) - ✗ ingressClassName nginx and host shop.example.com - ✗ /api (Prefix) -> api:8080 - ✗ / (Prefix) -> web:80 -### Q15 · STOR · PersistentVolume, claim and pod (1/1 failed, last 0/6 pts, 2026-09-08T19:59) +### Q15 · STOR · PersistentVolume, claim and pod (3/4 failed, last 6/6 pts, 2026-09-15T20:55) - ✗ PV pv-data: 1Gi hostPath /mnt/data, RWO, Retain, class manual - ✗ PVC pvc-data Bound to pv-data - ✗ data-pod Running with claim mounted at /usr/share/data -### Q16 · STOR · Default StorageClass and dynamic provisioning (1/1 failed, last 0/5 pts, 2026-09-08T19:59) +### Q16 · STOR · Default StorageClass and dynamic provisioning (4/4 failed, last 0/5 pts, 2026-09-16T19:40) - ✗ StorageClass fast-local: local-path, WaitForFirstConsumer, Delete - ✗ fast-local is default and standard is not - ✗ fast-claim picked up fast-local and is Bound - ✗ fast-pod Running with claim at /data -### Q17 · TSHOOT · Node NotReady (3/3 failed, last 4/8 pts, 2026-09-13T01:06) +### Q17 · TSHOOT · Node NotReady (3/4 failed, last 8/8 pts, 2026-09-13T01:06) - ✗ kubelet is active - ✗ kubelet is enabled (survives reboot) -### Q18 · TSHOOT · Broken deployment and service (1/1 failed, last 0/7 pts, 2026-09-08T19:59) -- ✗ all payments replicas available -- ✗ Service payments has endpoints (selector fixed) -- ✗ Service targetPort matches container port 80 - -### Q19 · TSHOOT · CrashLoopBackOff diagnosis (3/3 failed, last 1/6 pts, 2026-09-13T01:06) +### Q19 · TSHOOT · CrashLoopBackOff diagnosis (4/5 failed, last 6/6 pts, 2026-09-14T16:49) - ✗ crasher.log captured and contains the DB_HOST failure -- ✗ pod crasher Running with DB_HOST set -### Q20 · TSHOOT · Control plane component failure (1/1 failed, last 0/8 pts, 2026-09-08T19:59) -- ✗ kube-scheduler static pod manifest repaired -- ✗ new pods get scheduled - -### Q25 · WORK · Taints and tolerations (1/1 failed, last 0/4 pts, 2026-09-08T19:59) -- ✗ cka-sim-worker carries workload=batch:NoSchedule +### Q25 · WORK · Taints and tolerations (3/4 failed, last 4/4 pts, 2026-09-15T20:55) +- ✗ cka-sim-worker carries team=finance:NoSchedule - ✗ deployment tolerates the taint - ✗ both pods Running on cka-sim-worker -### Q28 · WORK · Init container prepares content (1/1 failed, last 0/4 pts, 2026-09-08T19:59) +### Q28 · WORK · Init container prepares content (4/4 failed, last 0/4 pts, 2026-09-16T19:40) - ✗ pod Running, init container named setup completed - ✗ emptyDir 'content' shared by both containers - ✗ nginx serves the init-written content -### Q29 · WORK · Immutable ConfigMap rotation (1/1 failed, last 1/4 pts, 2026-09-08T19:59) +### Q29 · WORK · Immutable ConfigMap rotation (3/4 failed, last 4/4 pts, 2026-09-15T20:55) - ✗ deployment now references a different ConfigMap - ✗ all pods available and see mode=new -### Q30 · NET · Named ports (1/1 failed, last 0/4 pts, 2026-09-08T19:59) -- ✗ container port 80 named app-port -- ✗ Service port 8080 -> targetPort app-port (by name) +### Q30 · NET · Named ports (2/3 failed, last 4/4 pts, 2026-09-14T16:49) +- ✗ container port 80 named svc-http +- ✗ Service port 8080 -> targetPort svc-http (by name) - ✗ readiness probe uses the named port; endpoints ready -### Q33 · ARCH · Aggregated ClusterRole (1/1 failed, last 1/5 pts, 2026-09-08T19:59) -- ✗ ops-44 has an aggregationRule with the right label +### Q33 · ARCH · Aggregated ClusterRole (2/3 failed, last 5/5 pts, 2026-09-14T16:49) +- ✗ ops-19 has an aggregationRule with the right label - ✗ aggregation populated rules from the two labelled roles -- ✗ lee can list pods and services cluster-wide +- ✗ sam can list pods and services cluster-wide -### Q37 · TSHOOT · Cluster DNS is broken (3/3 failed, last 1/6 pts, 2026-09-13T01:06) +### Q37 · TSHOOT · Cluster DNS is broken (4/5 failed, last 6/6 pts, 2026-09-14T16:49) - ✗ CoreDNS Corefile forwards to the node resolver again - ✗ in-cluster and external names resolve from a pod -### Q38 · TSHOOT · Deployments never create pods (2/2 failed, last 0/7 pts, 2026-09-13T01:06) +### Q38 · TSHOOT · Deployments never create pods (2/3 failed, last 7/7 pts, 2026-09-13T01:06) - ✗ kube-controller-manager manifest repaired and pod Running - ✗ a new Deployment gets a ReplicaSet and running pods -### Q39 · TSHOOT · kubelet misconfiguration (2/2 failed, last 4/7 pts, 2026-09-13T01:06) +### Q39 · TSHOOT · kubelet misconfiguration (3/4 failed, last 7/7 pts, 2026-09-14T16:49) - ✗ kubelet config points at a CA file that exists +- ✗ node Ready - ✗ kubelet active and enabled -### Q40 · ARCH · kubeadm join token (1/1 failed, last 0/5 pts, 2026-09-08T19:59) +### Q40 · ARCH · kubeadm join token (4/4 failed, last 0/5 pts, 2026-09-16T19:40) - ✗ join.sh contains a kubeadm join with token and CA hash -- ✗ the token in the file exists in the cluster with TTL ~2h +- ✗ the token in the file exists in the cluster with TTL ~24h -### Q42 · NET · Egress-only NetworkPolicy (1/1 failed, last 0/4 pts, 2026-09-08T19:59) -- ✗ applies to app=client-47, Egress only +### Q42 · NET · Egress-only NetworkPolicy (2/3 failed, last 4/4 pts, 2026-09-14T16:49) +- ✗ applies to app=client-64, Egress only - ✗ DNS rule: kube-system namespace + k8s-app=kube-dns, ports 53 UDP and TCP -- ✗ TCP 443 to 192.168.100.0/24 only +- ✗ TCP 443 to 172.16.0.0/16 only -### Q106 · ARCH · CRD with validation and defaults (1/1 failed, last 0/7 pts, 2026-09-10T21:07) +### Q106 · ARCH · CRD with validation and defaults (3/3 failed, last 0/7 pts, 2026-09-15T20:55) - ✗ CRD exists, Namespaced, replicas has min/max and is required - ✗ good created with environment prod - ✗ replicas 0 is rejected and the message was saved - ✗ defaulting works: defaulted.spec.environment == dev -### Q112 · NET · TLS Ingress with a generated certificate (1/1 failed, last 0/7 pts, 2026-09-10T21:07) +### Q112 · NET · TLS Ingress with a generated certificate (3/3 failed, last 0/7 pts, 2026-09-15T20:55) - ✗ Secret portal.lab.local-tls is kubernetes.io/tls with CN portal.lab.local - ✗ Ingress web: class nginx, host, TLS secret, ssl-redirect annotation - ✗ fp.txt matches the secret's certificate fingerprint -### Q115 · STOR · Bind the right local volume (1/1 failed, last 1/6 pts, 2026-09-10T21:07) +### Q115 · STOR · Bind the right local volume (3/3 failed, last 1/6 pts, 2026-09-15T20:55) - ✗ PVC uses a selector and is Bound to lv-nvme - ✗ consumer Running on the nvme node with /data mounted -### Q120 · TSHOOT · Cluster facts, exactly (1/1 failed, last 0/5 pts, 2026-09-10T21:07) +### Q120 · TSHOOT · Cluster facts, exactly (3/3 failed, last 0/5 pts, 2026-09-15T20:55) - ✗ pod-cidr and service-cidr - ✗ dns-ip and proxy-mode - ✗ cka-sim-worker3 pod CIDR -### Q121 · WORK · The context's namespace (1/1 failed, last 1/6 pts, 2026-09-10T21:07) -- ✗ Deployment ledger-14 in ac-omega (the context's namespace), 2 available, owner=ac -- ✗ Service ledger-14 port 9000 in the same namespace +### Q121 · WORK · The context's namespace (3/3 failed, last 1/6 pts, 2026-09-15T20:55) +- ✗ Deployment ledger-21 in ac-echo (the context's namespace), 2 available, owner=ac +- ✗ Service ledger-21 port 9000 in the same namespace - ✗ ns.txt has the namespace ## Attempt matrix -| Q | Domain | Title | D1 | E2 | D3 | D4 | D5 | D6 | -|---|---|---|---|---|---|---|---|---| -| 1 | ARCH | RBAC for a deployment bot | 2/6 | · | · | ✓ | · | · | -| 2 | ARCH | etcd snapshot | · | ✓ | · | · | · | · | -| 3 | ARCH | Kustomize overlay | · | 0/5 | · | · | · | · | -| 4 | ARCH | CustomResourceDefinition | · | ✓ | · | · | · | · | -| 5 | ARCH | Static pod | 0/5 | · | · | · | · | · | -| 6 | ARCH | Certificates: expiry check and user CSR | 0/6 | · | · | 3/6 | · | · | -| 7 | WORK | Rolling update & scaling | · | · | · | · | · | · | -| 8 | WORK | Multi-container pod with shared volume | · | 0/4 | · | · | · | · | -| 9 | WORK | Scheduling with node affinity and resources | · | · | · | · | · | · | -| 10 | WORK | ConfigMap and Secret consumption | · | · | · | · | · | · | -| 11 | NET | NetworkPolicy | · | · | · | · | · | · | -| 12 | NET | NodePort Service | · | 0/4 | · | · | · | · | -| 13 | NET | Ingress routing | · | 0/5 | · | · | · | · | -| 14 | NET | Cluster DNS | · | · | · | · | · | · | -| 15 | STOR | PersistentVolume, claim and pod | · | 0/6 | · | · | · | · | -| 16 | STOR | Default StorageClass and dynamic provisioning | · | 0/5 | · | · | · | · | -| 17 | TSHOOT | Node NotReady | · | 0/8 | · | · | 4/8 | 4/8 | -| 18 | TSHOOT | Broken deployment and service | · | 0/7 | · | · | · | · | -| 19 | TSHOOT | CrashLoopBackOff diagnosis | · | 1/6 | · | · | 1/6 | 1/6 | -| 20 | TSHOOT | Control plane component failure | · | 0/8 | · | · | · | · | -| 21 | ARCH | Helm release install and upgrade | · | · | · | ✓ | · | · | -| 22 | NET | Gateway API HTTPRoute | · | · | · | · | · | · | -| 23 | WORK | metrics-server repair and HPA | · | · | · | · | · | · | -| 24 | WORK | PriorityClass | · | · | · | · | · | · | -| 25 | WORK | Taints and tolerations | · | 0/4 | · | · | · | · | -| 26 | WORK | DaemonSet on every node | · | · | · | · | · | · | -| 27 | WORK | CronJob with a manual run | · | · | · | · | · | · | -| 28 | WORK | Init container prepares content | · | 0/4 | · | · | · | · | -| 29 | WORK | Immutable ConfigMap rotation | · | 1/4 | · | · | · | · | -| 30 | NET | Named ports | · | 0/4 | · | · | · | · | -| 31 | WORK | Parallel Job | · | · | · | · | · | · | -| 32 | WORK | ResourceQuota and LimitRange | · | · | · | · | · | · | -| 33 | ARCH | Aggregated ClusterRole | · | 1/5 | · | · | · | · | -| 34 | ARCH | Discover a CRD field with kubectl explain | 0/4 | · | · | ✓ | · | · | -| 35 | STOR | Re-bind a Released PersistentVolume | · | · | · | · | · | · | -| 36 | STOR | Data survives the pod | · | · | · | · | · | · | -| 37 | TSHOOT | Cluster DNS is broken | · | 1/6 | · | · | 1/6 | 1/6 | -| 38 | TSHOOT | Deployments never create pods | · | · | · | · | 0/7 | 0/7 | -| 39 | TSHOOT | kubelet misconfiguration | · | · | · | · | 4/7 | 4/7 | -| 40 | ARCH | kubeadm join token | · | 0/5 | · | · | · | · | -| 41 | ARCH | Component versions | 0/4 | · | · | ✓ | · | · | -| 42 | NET | Egress-only NetworkPolicy | · | 0/4 | · | · | · | · | -| 43 | NET | Headless and ExternalName services | · | · | · | · | · | · | -| 101 | ARCH | Exact RBAC with an existing over-grant | · | · | · | · | · | · | -| 102 | ARCH | etcd restore | · | · | · | · | · | · | -| 103 | ARCH | Static pod on a relocated manifest path | · | · | · | · | · | · | -| 104 | ARCH | User onboarding to a working kubeconfig | · | · | · | · | · | · | -| 105 | ARCH | Kustomize with generators and patches | · | · | · | · | · | · | -| 106 | ARCH | CRD with validation and defaults | · | · | 0/7 | · | · | · | -| 107 | WORK | Spread, tolerate, prioritise — under a quota | · | · | · | · | · | · | -| 108 | WORK | Rollback to a specific revision, then pause | · | · | · | · | · | · | -| 109 | WORK | Native sidecar with probes and an exact report | · | · | · | · | · | · | -| 110 | WORK | Cluster audit to exact files | · | · | · | · | · | · | -| 111 | NET | Zero-trust namespace | · | · | · | · | · | · | -| 112 | NET | TLS Ingress with a generated certificate | · | · | 0/7 | · | · | · | -| 113 | NET | Gateway API canary with header match | · | · | · | · | · | · | -| 114 | NET | DNS down: three faults | · | · | · | · | · | · | -| 115 | STOR | Bind the right local volume | · | · | 1/6 | · | · | · | -| 116 | STOR | Migrate data between claims | · | · | · | · | · | · | -| 117 | TSHOOT | Worker node: three things wrong | · | · | · | · | · | · | -| 118 | TSHOOT | Two control-plane components down | · | · | · | · | · | · | -| 119 | TSHOOT | Application down for four reasons | · | · | · | · | · | · | -| 120 | TSHOOT | Cluster facts, exactly | · | · | 0/5 | · | · | · | -| 121 | WORK | The context's namespace | · | · | 1/6 | · | · | · | -| 122 | ARCH | Renew control-plane certificates | · | · | · | · | · | · | -| 123 | TSHOOT | Nothing works: kube-apiserver itself is down | · | · | · | · | · | · | -| 124 | ARCH | Prepare a node join without shell access to the control plane | · | · | · | · | · | · | -| 201 | ARCH | kubeconfig forensics | · | · | · | · | · | · | -| 202 | ARCH | Helm chart with CRDs, then a custom resource | · | · | · | · | · | · | -| 203 | WORK | Find the controller, then scale it | · | · | · | · | · | · | -| 204 | WORK | Which Pods get evicted first | · | · | · | · | · | · | -| 205 | ARCH | Kustomize: drop a ConfigMap, add an HPA, override in prod | · | · | · | · | · | · | -| 206 | STOR | PV, PVC and a Deployment that mounts it | · | · | · | · | · | · | -| 207 | TSHOOT | Resource usage scripts | · | · | · | · | · | · | -| 208 | ARCH | Drain a node for maintenance | · | · | · | · | · | · | -| 209 | ARCH | Query the API from inside a Pod | · | · | · | · | · | · | -| 210 | ARCH | ServiceAccount limited to two resources | · | · | · | · | · | · | -| 211 | WORK | DaemonSet on every node | · | · | · | · | · | · | -| 212 | WORK | One Pod per node, on purpose | · | · | · | · | · | · | -| 213 | NET | Convert an Ingress to Gateway API, then split on a header | · | · | · | · | · | · | -| 214 | ARCH | Certificate expiry, two ways | · | · | · | · | · | · | -| 215 | NET | Egress policy with paired destinations | · | · | · | · | · | · | -| 216 | NET | CoreDNS: back up, extend, verify | · | · | · | · | · | · | -| 217 | TSHOOT | Inspect a container with crictl | · | · | · | · | · | · | -| 301 | ARCH | etcd configuration facts | · | · | · | · | · | · | -| 302 | NET | Service rules on the node | · | · | · | · | · | · | -| 303 | NET | A second Service CIDR | · | · | · | · | · | · | -| 304 | ARCH | Bound tokens versus legacy tokens | · | · | · | · | · | · | -| 305 | WORK | Schedule without the scheduler | · | · | · | · | · | · | -| 306 | STOR | Grow a volume in place | · | · | · | · | · | · | -| 307 | TSHOOT | Node accepts nothing new | · | · | · | · | · | · | -| 308 | ARCH | API resource reference card | · | · | · | · | · | · | -| 309 | WORK | A PodDisruptionBudget that blocks maintenance | · | · | · | · | · | · | -| 310 | NET | Route to something outside the cluster | · | · | · | · | · | · | -| 311 | ARCH | Image inventory across the cluster | · | · | · | · | · | · | -| 312 | WORK | A Job that fails, then one that doesn't | · | · | · | · | · | · | -| 313 | NET | Two hosts, TLS, and a default backend | · | · | · | · | · | · | -| 314 | TSHOOT | A static pod that never starts | · | · | · | · | · | · | -| 315 | STOR | Keep the data when the claim goes | · | · | · | · | · | · | -| 316 | ARCH | Plan a control-plane upgrade | · | · | · | · | · | · | -| 317 | TSHOOT | Certificates stop being issued | · | · | · | · | · | · | +| Q | Domain | Title | D1 | E2 | D3 | D4 | D5 | D6 | D7 | D8 | D9 | +|---|---|---|---|---|---|---|---|---|---|---|---| +| 1 | ARCH | RBAC for a deployment bot | 2/6 | · | · | ✓ | · | · | · | · | · | +| 2 | ARCH | etcd snapshot | · | ✓ | · | · | · | · | · | · | · | +| 3 | ARCH | Kustomize overlay | · | 0/5 | · | · | · | · | ✓ | · | · | +| 4 | ARCH | CustomResourceDefinition | · | ✓ | · | · | · | · | · | · | · | +| 5 | ARCH | Static pod | 0/5 | · | · | · | · | · | ✓ | · | · | +| 6 | ARCH | Certificates: expiry check and user CSR | 0/6 | · | · | 3/6 | · | · | ✓ | · | · | +| 7 | WORK | Rolling update & scaling | · | · | · | · | · | · | · | · | · | +| 8 | WORK | Multi-container pod with shared volume | · | 0/4 | · | · | · | · | ✓ | · | · | +| 9 | WORK | Scheduling with node affinity and resources | · | · | · | · | · | · | · | · | · | +| 10 | WORK | ConfigMap and Secret consumption | · | · | · | · | · | · | · | · | · | +| 11 | NET | NetworkPolicy | · | · | · | · | · | · | · | · | · | +| 12 | NET | NodePort Service | · | 0/4 | · | · | · | · | ✓ | · | · | +| 13 | NET | Ingress routing | · | 0/5 | · | · | · | · | 0/5 | ✓ | · | +| 14 | NET | Cluster DNS | · | · | · | · | · | · | · | · | · | +| 15 | STOR | PersistentVolume, claim and pod | · | 0/6 | · | · | · | · | 0/6 | 0/6 | ✓ | +| 16 | STOR | Default StorageClass and dynamic provisioning | · | 0/5 | · | · | · | · | 0/5 | 0/5 | 0/5 | +| 17 | TSHOOT | Node NotReady | · | 0/8 | · | · | 4/8 | 4/8 | ✓ | · | · | +| 18 | TSHOOT | Broken deployment and service | · | 0/7 | · | · | · | · | ✓ | · | · | +| 19 | TSHOOT | CrashLoopBackOff diagnosis | · | 1/6 | · | · | 1/6 | 1/6 | 4/6 | ✓ | · | +| 20 | TSHOOT | Control plane component failure | · | 0/8 | · | · | · | · | ✓ | · | · | +| 21 | ARCH | Helm release install and upgrade | · | · | · | ✓ | · | · | · | · | · | +| 22 | NET | Gateway API HTTPRoute | · | · | · | · | · | · | · | · | · | +| 23 | WORK | metrics-server repair and HPA | · | · | · | · | · | · | · | · | · | +| 24 | WORK | PriorityClass | · | · | · | · | · | · | · | · | · | +| 25 | WORK | Taints and tolerations | · | 0/4 | · | · | · | · | 0/4 | 0/4 | ✓ | +| 26 | WORK | DaemonSet on every node | · | · | · | · | · | · | · | · | · | +| 27 | WORK | CronJob with a manual run | · | · | · | · | · | · | · | · | · | +| 28 | WORK | Init container prepares content | · | 0/4 | · | · | · | · | 0/4 | 0/4 | 0/4 | +| 29 | WORK | Immutable ConfigMap rotation | · | 1/4 | · | · | · | · | 1/4 | 1/4 | ✓ | +| 30 | NET | Named ports | · | 0/4 | · | · | · | · | 0/4 | ✓ | · | +| 31 | WORK | Parallel Job | · | · | · | · | · | · | · | · | · | +| 32 | WORK | ResourceQuota and LimitRange | · | · | · | · | · | · | · | · | · | +| 33 | ARCH | Aggregated ClusterRole | · | 1/5 | · | · | · | · | 1/5 | ✓ | · | +| 34 | ARCH | Discover a CRD field with kubectl explain | 0/4 | · | · | ✓ | · | · | · | · | · | +| 35 | STOR | Re-bind a Released PersistentVolume | · | · | · | · | · | · | · | · | · | +| 36 | STOR | Data survives the pod | · | · | · | · | · | · | · | · | · | +| 37 | TSHOOT | Cluster DNS is broken | · | 1/6 | · | · | 1/6 | 1/6 | 1/6 | ✓ | · | +| 38 | TSHOOT | Deployments never create pods | · | · | · | · | 0/7 | 0/7 | ✓ | · | · | +| 39 | TSHOOT | kubelet misconfiguration | · | · | · | · | 4/7 | 4/7 | 0/7 | ✓ | · | +| 40 | ARCH | kubeadm join token | · | 0/5 | · | · | · | · | 0/5 | 0/5 | 0/5 | +| 41 | ARCH | Component versions | 0/4 | · | · | ✓ | · | · | · | · | · | +| 42 | NET | Egress-only NetworkPolicy | · | 0/4 | · | · | · | · | 0/4 | ✓ | · | +| 43 | NET | Headless and ExternalName services | · | · | · | · | · | · | · | · | · | +| 101 | ARCH | Exact RBAC with an existing over-grant | · | · | · | · | · | · | · | · | · | +| 102 | ARCH | etcd restore | · | · | · | · | · | · | · | · | · | +| 103 | ARCH | Static pod on a relocated manifest path | · | · | · | · | · | · | · | · | · | +| 104 | ARCH | User onboarding to a working kubeconfig | · | · | · | · | · | · | · | · | · | +| 105 | ARCH | Kustomize with generators and patches | · | · | · | · | · | · | · | · | · | +| 106 | ARCH | CRD with validation and defaults | · | · | 0/7 | · | · | · | 0/7 | 0/7 | · | +| 107 | WORK | Spread, tolerate, prioritise — under a quota | · | · | · | · | · | · | · | · | · | +| 108 | WORK | Rollback to a specific revision, then pause | · | · | · | · | · | · | · | · | · | +| 109 | WORK | Native sidecar with probes and an exact report | · | · | · | · | · | · | · | · | · | +| 110 | WORK | Cluster audit to exact files | · | · | · | · | · | · | · | · | · | +| 111 | NET | Zero-trust namespace | · | · | · | · | · | · | · | · | · | +| 112 | NET | TLS Ingress with a generated certificate | · | · | 0/7 | · | · | · | 0/7 | 0/7 | · | +| 113 | NET | Gateway API canary with header match | · | · | · | · | · | · | · | · | · | +| 114 | NET | DNS down: three faults | · | · | · | · | · | · | · | · | · | +| 115 | STOR | Bind the right local volume | · | · | 1/6 | · | · | · | 1/6 | 1/6 | · | +| 116 | STOR | Migrate data between claims | · | · | · | · | · | · | · | · | · | +| 117 | TSHOOT | Worker node: three things wrong | · | · | · | · | · | · | · | · | · | +| 118 | TSHOOT | Two control-plane components down | · | · | · | · | · | · | · | · | · | +| 119 | TSHOOT | Application down for four reasons | · | · | · | · | · | · | · | · | · | +| 120 | TSHOOT | Cluster facts, exactly | · | · | 0/5 | · | · | · | 0/5 | 0/5 | · | +| 121 | WORK | The context's namespace | · | · | 1/6 | · | · | · | 1/6 | 1/6 | · | +| 122 | ARCH | Renew control-plane certificates | · | · | · | · | · | · | · | · | · | +| 123 | TSHOOT | Nothing works: kube-apiserver itself is down | · | · | · | · | · | · | · | · | · | +| 124 | ARCH | Prepare a node join without shell access to the control plane | · | · | · | · | · | · | · | · | · | +| 201 | ARCH | kubeconfig forensics | · | · | · | · | · | · | · | · | · | +| 202 | ARCH | Helm chart with CRDs, then a custom resource | · | · | · | · | · | · | · | · | · | +| 203 | WORK | Find the controller, then scale it | · | · | · | · | · | · | · | · | · | +| 204 | WORK | Which Pods get evicted first | · | · | · | · | · | · | · | · | · | +| 205 | ARCH | Kustomize: drop a ConfigMap, add an HPA, override in prod | · | · | · | · | · | · | · | · | · | +| 206 | STOR | PV, PVC and a Deployment that mounts it | · | · | · | · | · | · | · | · | · | +| 207 | TSHOOT | Resource usage scripts | · | · | · | · | · | · | · | · | · | +| 208 | ARCH | Drain a node for maintenance | · | · | · | · | · | · | · | · | · | +| 209 | ARCH | Query the API from inside a Pod | · | · | · | · | · | · | · | · | · | +| 210 | ARCH | ServiceAccount limited to two resources | · | · | · | · | · | · | · | · | · | +| 211 | WORK | DaemonSet on every node | · | · | · | · | · | · | · | · | · | +| 212 | WORK | One Pod per node, on purpose | · | · | · | · | · | · | · | · | · | +| 213 | NET | Convert an Ingress to Gateway API, then split on a header | · | · | · | · | · | · | · | · | · | +| 214 | ARCH | Certificate expiry, two ways | · | · | · | · | · | · | · | · | · | +| 215 | NET | Egress policy with paired destinations | · | · | · | · | · | · | · | · | · | +| 216 | NET | CoreDNS: back up, extend, verify | · | · | · | · | · | · | · | · | · | +| 217 | TSHOOT | Inspect a container with crictl | · | · | · | · | · | · | · | · | · | +| 301 | ARCH | etcd configuration facts | · | · | · | · | · | · | · | · | · | +| 302 | NET | Service rules on the node | · | · | · | · | · | · | · | · | · | +| 303 | NET | A second Service CIDR | · | · | · | · | · | · | · | · | · | +| 304 | ARCH | Bound tokens versus legacy tokens | · | · | · | · | · | · | · | · | · | +| 305 | WORK | Schedule without the scheduler | · | · | · | · | · | · | · | · | · | +| 306 | STOR | Grow a volume in place | · | · | · | · | · | · | · | · | · | +| 307 | TSHOOT | Node accepts nothing new | · | · | · | · | · | · | · | · | · | +| 308 | ARCH | API resource reference card | · | · | · | · | · | · | · | · | · | +| 309 | WORK | A PodDisruptionBudget that blocks maintenance | · | · | · | · | · | · | · | · | · | +| 310 | NET | Route to something outside the cluster | · | · | · | · | · | · | · | · | · | +| 311 | ARCH | Image inventory across the cluster | · | · | · | · | · | · | · | · | · | +| 312 | WORK | A Job that fails, then one that doesn't | · | · | · | · | · | · | · | · | · | +| 313 | NET | Two hosts, TLS, and a default backend | · | · | · | · | · | · | · | · | · | +| 314 | TSHOOT | A static pod that never starts | · | · | · | · | · | · | · | · | · | +| 315 | STOR | Keep the data when the claim goes | · | · | · | · | · | · | · | · | · | +| 316 | ARCH | Plan a control-plane upgrade | · | · | · | · | · | · | · | · | · | +| 317 | TSHOOT | Certificates stop being issued | · | · | · | · | · | · | · | · | · | _E = full exam, D = drill, · = not in that session, n/m = partial credit._