From 99f833db6898b6680031be83c0a09426879fa9a3 Mon Sep 17 00:00:00 2001 From: vumast3r Date: Mon, 7 Sep 2026 09:30:53 -0600 Subject: [PATCH] docs: add history-cka and weak-spots for mental notes and to keep up with progression --- history-cka.jsonl | 1 + weak-spots-cka.md | 135 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 history-cka.jsonl create mode 100644 weak-spots-cka.md diff --git a/history-cka.jsonl b/history-cka.jsonl new file mode 100644 index 0000000..c347769 --- /dev/null +++ b/history-cka.jsonl @@ -0,0 +1 @@ +{"at": "2026-09-06T22:07", "mode": "drill", "hard": false, "ids": [1, 5, 6, 34, 41], "score_pct": 8.0, "earned": 2, "total": 25, "time_used": 432, "pauses": 0, "paused_seconds": 0, "results": {"1": {"pass": false, "earned": 2, "total": 6, "failed": ["ServiceAccount rbac-app/deploy-bot exists", "Role deploy-manager and RoleBinding deploy-bot-binding exist", "deploy-bot can get/list/watch/create/update/patch/delete deployments"]}, "5": {"pass": false, "earned": 0, "total": 5, "failed": ["manifest containing static-web is in /etc/kubernetes/manifests on the node", "mirror pod static-web- is Running", "image is nginx:1.27"]}, "6": {"pass": false, "earned": 0, "total": 6, "failed": ["apiserver-expiry.txt records the real expiry month and year", "CSR jane exists with signer kubernetes.io/kube-apiserver-client", "CSR jane approved and certificate issued", "jane can list pods in default (view) but not delete them"]}, "34": {"pass": false, "earned": 0, "total": 4, "failed": ["path.txt has the correct field path", "Gadget/sample created with the field = 4"]}, "41": {"pass": false, "earned": 0, "total": 4, "failed": ["apiserver and kubelet versions correct", "etcd and runtime versions correct"]}}} diff --git a/weak-spots-cka.md b/weak-spots-cka.md new file mode 100644 index 0000000..58dc84a --- /dev/null +++ b/weak-spots-cka.md @@ -0,0 +1,135 @@ +# CKA weak spots + +_Generated by exam from 1 attempt(s); regenerated on every `end`._ + +## Drill next (`./exam drill weak`) + +### Q01 · ARCH · RBAC for a deployment bot (1/1 failed, last 2/6 pts, 2026-09-06T22:07) +- ✗ ServiceAccount rbac-app/deploy-bot exists +- ✗ Role deploy-manager and RoleBinding deploy-bot-binding exist +- ✗ deploy-bot can get/list/watch/create/update/patch/delete deployments + +### Q05 · ARCH · Static pod (1/1 failed, last 0/5 pts, 2026-09-06T22:07) +- ✗ manifest containing static-web is in /etc/kubernetes/manifests on the node +- ✗ mirror pod static-web- is Running +- ✗ image is nginx:1.27 + +### Q06 · ARCH · Certificates: expiry check and user CSR (1/1 failed, last 0/6 pts, 2026-09-06T22:07) +- ✗ apiserver-expiry.txt records the real expiry month and year +- ✗ CSR jane exists with signer kubernetes.io/kube-apiserver-client +- ✗ CSR jane approved and certificate issued +- ✗ jane can list pods in default (view) but not delete them + +### Q34 · ARCH · Discover a CRD field with kubectl explain (1/1 failed, last 0/4 pts, 2026-09-06T22:07) +- ✗ path.txt has the correct field path +- ✗ Gadget/sample created with the field = 4 + +### Q41 · ARCH · Component versions (1/1 failed, last 0/4 pts, 2026-09-06T22:07) +- ✗ apiserver and kubelet versions correct +- ✗ etcd and runtime versions correct + +## Attempt matrix + +| Q | Domain | Title | D1 | +|---|---|---|---| +| 1 | ARCH | RBAC for a deployment bot | 2/6 | +| 2 | ARCH | etcd snapshot | · | +| 3 | ARCH | Kustomize overlay | · | +| 4 | ARCH | CustomResourceDefinition | · | +| 5 | ARCH | Static pod | 0/5 | +| 6 | ARCH | Certificates: expiry check and user CSR | 0/6 | +| 7 | WORK | Rolling update & scaling | · | +| 8 | WORK | Multi-container pod with shared volume | · | +| 9 | WORK | Scheduling with node affinity and resources | · | +| 10 | WORK | ConfigMap and Secret consumption | · | +| 11 | NET | NetworkPolicy | · | +| 12 | NET | NodePort Service | · | +| 13 | NET | Ingress routing | · | +| 14 | NET | Cluster DNS | · | +| 15 | STOR | PersistentVolume, claim and pod | · | +| 16 | STOR | Default StorageClass and dynamic provisioning | · | +| 17 | TSHOOT | Node NotReady | · | +| 18 | TSHOOT | Broken deployment and service | · | +| 19 | TSHOOT | CrashLoopBackOff diagnosis | · | +| 20 | TSHOOT | Control plane component failure | · | +| 21 | ARCH | Helm release install and upgrade | · | +| 22 | NET | Gateway API HTTPRoute | · | +| 23 | WORK | metrics-server repair and HPA | · | +| 24 | WORK | PriorityClass | · | +| 25 | WORK | Taints and tolerations | · | +| 26 | WORK | DaemonSet on every node | · | +| 27 | WORK | CronJob with a manual run | · | +| 28 | WORK | Init container prepares content | · | +| 29 | WORK | Immutable ConfigMap rotation | · | +| 30 | NET | Named ports | · | +| 31 | WORK | Parallel Job | · | +| 32 | WORK | ResourceQuota and LimitRange | · | +| 33 | ARCH | Aggregated ClusterRole | · | +| 34 | ARCH | Discover a CRD field with kubectl explain | 0/4 | +| 35 | STOR | Re-bind a Released PersistentVolume | · | +| 36 | STOR | Data survives the pod | · | +| 37 | TSHOOT | Cluster DNS is broken | · | +| 38 | TSHOOT | Deployments never create pods | · | +| 39 | TSHOOT | kubelet misconfiguration | · | +| 40 | ARCH | kubeadm join token | · | +| 41 | ARCH | Component versions | 0/4 | +| 42 | NET | Egress-only NetworkPolicy | · | +| 43 | NET | Headless and ExternalName services | · | +| 101 | ARCH | Exact RBAC with an existing over-grant | · | +| 102 | ARCH | etcd restore | · | +| 103 | ARCH | Static pod on a relocated manifest path | · | +| 104 | ARCH | User onboarding to a working kubeconfig | · | +| 105 | ARCH | Kustomize with generators and patches | · | +| 106 | ARCH | CRD with validation and defaults | · | +| 107 | WORK | Spread, tolerate, prioritise — under a quota | · | +| 108 | WORK | Rollback to a specific revision, then pause | · | +| 109 | WORK | Native sidecar with probes and an exact report | · | +| 110 | WORK | Cluster audit to exact files | · | +| 111 | NET | Zero-trust namespace | · | +| 112 | NET | TLS Ingress with a generated certificate | · | +| 113 | NET | Gateway API canary with header match | · | +| 114 | NET | DNS down: three faults | · | +| 115 | STOR | Bind the right local volume | · | +| 116 | STOR | Migrate data between claims | · | +| 117 | TSHOOT | Worker node: three things wrong | · | +| 118 | TSHOOT | Two control-plane components down | · | +| 119 | TSHOOT | Application down for four reasons | · | +| 120 | TSHOOT | Cluster facts, exactly | · | +| 121 | WORK | The context's namespace | · | +| 122 | ARCH | Renew control-plane certificates | · | +| 201 | ARCH | kubeconfig forensics | · | +| 202 | ARCH | Helm chart with CRDs, then a custom resource | · | +| 203 | WORK | Find the controller, then scale it | · | +| 204 | WORK | Which Pods get evicted first | · | +| 205 | ARCH | Kustomize: drop a ConfigMap, add an HPA, override in prod | · | +| 206 | STOR | PV, PVC and a Deployment that mounts it | · | +| 207 | TSHOOT | Resource usage scripts | · | +| 208 | ARCH | Drain a node for maintenance | · | +| 209 | ARCH | Query the API from inside a Pod | · | +| 210 | ARCH | ServiceAccount limited to two resources | · | +| 211 | WORK | DaemonSet on every node | · | +| 212 | WORK | One Pod per node, on purpose | · | +| 213 | NET | Convert an Ingress to Gateway API, then split on a header | · | +| 214 | ARCH | Certificate expiry, two ways | · | +| 215 | NET | Egress policy with paired destinations | · | +| 216 | NET | CoreDNS: back up, extend, verify | · | +| 217 | TSHOOT | Inspect a container with crictl | · | +| 301 | ARCH | etcd configuration facts | · | +| 302 | NET | Service rules on the node | · | +| 303 | NET | A second Service CIDR | · | +| 304 | ARCH | Bound tokens versus legacy tokens | · | +| 305 | WORK | Schedule without the scheduler | · | +| 306 | STOR | Grow a volume in place | · | +| 307 | TSHOOT | Node accepts nothing new | · | +| 308 | ARCH | API resource reference card | · | +| 309 | WORK | A PodDisruptionBudget that blocks maintenance | · | +| 310 | NET | Route to something outside the cluster | · | +| 311 | ARCH | Image inventory across the cluster | · | +| 312 | WORK | A Job that fails, then one that doesn't | · | +| 313 | NET | Two hosts, TLS, and a default backend | · | +| 314 | TSHOOT | A static pod that never starts | · | +| 315 | STOR | Keep the data when the claim goes | · | +| 316 | ARCH | Plan a control-plane upgrade | · | +| 317 | TSHOOT | Certificates stop being issued | · | + +_E = full exam, D = drill, · = not in that session, n/m = partial credit._