`./exam sim c` - 18 tasks, 163 points, 120 minutes, exam rules. Built after a
23% result on a paid mock, so reruns cost nothing and the weak topics can be
drilled as often as needed.
Original scenarios, not copies, exercising the same techniques as an 18-question
sitting: hostPath PV/PVC bound by volumeName, data migration between claims onto
a Retain volume, Helm render-then-install, Gateway API header canary, RBAC with
the answer written to a file, probe/selector/targetPort repair, HPA v2 behavior
blocks, and three "write the output to an exact path" data-extraction tasks.
Ids 401-418, set="c", difficulty="hard". cmd_sim is already generic over SETS so
no harness change was needed; set-tagged tasks stay out of POOL and cannot leak
into `./exam start` or drills. CKA bank goes 101 -> 119 tasks.
Two scenarios are deliberately adapted, because the originals would destroy the
practice cluster:
- 410 audits the installed CNI and applies a default-deny, rather than
installing Calico over the running kindnet. The Flannel-vs-Calico
"does this CNI actually enforce NetworkPolicy" judgement is kept as a
written answer.
- 413 plans a control-plane upgrade - versions, ordered command sequence,
`kubeadm upgrade node` for workers - and never runs `kubeadm upgrade apply`.
The grader checks the ordering, modelled on Q316.
Verified end to end: every task seeded, solved with its own reference solution
and graded, 163/163 across all 18, in four batches. Checks were also confirmed
to fail cleanly against an unsolved cluster rather than erroring.
Three environment facts cost a round of debugging and are now encoded in the
tasks and their solutions:
- The StorageClass on this kind cluster is named `standard`, not `local-path`,
and is WaitForFirstConsumer - a PVC stays Pending until its pod can be
scheduled, which is what interlocks the two faults in 414.
- Under rootless podman the host cannot route to node IPs, so a host-side
openssl against a NodePort just hangs (rc=124). 417 probes TLS from inside a
node via nx against 127.0.0.1:<nodePort>. Nodes have openssl and curl but
not nc or wget.
- hostPath PV data must be seeded on every node (401, 405), since nothing
pins the pod to the node holding the directory.
Seeding all 18 creates ~24 pods, which on this host needs
kernel.keys.maxkeys raised above the 200 default or container starts fail with
"unable to join session keyring: disk quota exceeded".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NziZdvBvy7CpEAAbZNgp8i
The Q02/Q102 seeds tried to copy etcdctl out of the running etcd pod with
`kubectl exec -- cat`, which cannot work: registry.k8s.io/etcd is distroless
(no cat, no sh, no tar). The copy failed, stderr went to /dev/null and seeding
still printed a green tick, so the snapshot task had no etcdctl on the node.
Q102 was worse: it also ran `exec -- sh -c 'etcdctl ... snapshot save'` inside
that container, so its /opt/cka/backup.db was never created at all.
- etcd-tools.sh installs both binaries on the control-plane node, taking them
from the etcd image already in the node's containerd (offline, exactly the
server version), falling back to the upstream release tarball, then apt.
- setup.sh runs it at bootstrap; ensure_etcd_tools in the exam prelude installs
them through CKA_NODE_ACCESS when a task is seeded, so ssh/vagrant clusters
get them too, and both etcd setups now fail with a reason instead of hiding it.
- Q102 takes its snapshot with the node's etcdctl; Q02 no longer documents a
kubectl cp fallback that cannot work on a distroless image.
Co-authored-by: Junie <junie@jetbrains.com>
