# CKA Exam Preparation & Scenario Decision Guide

This guide is designed for fast mental retrieval during exam scenarios. It outlines **which command to choose based on the situation**, the exact syntax to run, and the official documentation shortcuts permitted during the exam.

The CKA environment runs **Kubernetes v1.35** (etcd 3.6) as of October 2026, and so does this simulator's CKA track.

---

## 1. Quick Environment Setup & Muscle Memory

Run these first on every terminal/node session in the exam:

```bash
# Core aliases & shell variables
alias k=kubectl
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"

# Shell auto-completion with alias support
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

# Vim configuration (~/.vimrc)
cat << 'EOF' > ~/.vimrc
set tabstop=2
set shiftwidth=2
set expandtab
set number
syntax on
EOF
```

---

## 2. Situation-to-Command Decision Matrix

| Situation / Task | First-Choice Command / Action | Key Flags / Syntax |
| :--- | :--- | :--- |
| **Create a single pod** | `k run <name> --image=<img...>` | `$do > pod.yaml` |
| **Expose a pod/deployment as Service** | `k expose <pod/deploy> <name>` | `--port=80 --target-port=8080 --type=NodePort/ClusterIP` |
| **Create Deployment** | `k create deploy <name> --image=<img>` | `--replicas=3 $do > deploy.yaml` |
| **Create Job / CronJob** | `k create job <name> --image=<img>` <br> `k create cj <name> --image=<img>` | `--schedule="*/5 * * * *"` |
| **Create Secret / ConfigMap** | `k create secret generic <name>` <br> `k create cm <name>` | `--from-literal=key=val` <br> `--from-file=config.txt` |
| **Create ServiceAccount & Token** | `k create sa <name>` <br> `k create token <name>` | (Kubernetes 1.24+ standard) |
| **Create RBAC Role & RoleBinding** | `k create role <name>` <br> `k create rolebinding <name>` | `--verb=get,list,watch --resource=pods,deployments` <br> `--role=<role> --serviceaccount=<ns>:<sa>` |
| **Create ClusterRole & ClusterRoleBinding** | `k create clusterrole <name>` <br> `k create clusterrolebinding <name>` | `--verb=get,list --resource=nodes,pv` <br> `--clusterrole=<cr> --user=<user>` |
| **Create Ingress** | `k create ingress <name>` | `--rule="host/path*=svc:port"` <br> `--class=nginx --annotation=...` |
| **Check API permissions** | `k auth can-i <verb> <res>` | `--as=system:serviceaccount:<ns>:<sa> -n <ns>` |
| **Find YAML syntax / field paths** | `k explain <resource>.<field>` | `k explain pod.spec.containers.securityContext --recursive` |
| **Inspect Node / Pod metrics** | `k top node` / `k top pod` | `-A --sort-by=cpu` or `--sort-by=memory` |
| **Drain node for maintenance** | `k drain <node>` | `--ignore-daemonsets --delete-emptydir-data --force` |
| **Reactivate / Uncordon node** | `k uncordon <node>` | |
| **Troubleshoot Node (Kubelet)** | `systemctl status kubelet` <br> `journalctl -u kubelet -e --no-pager` | Check `/etc/kubernetes/kubelet.conf` & `/var/lib/kubelet/config.yaml` |
| **Control Plane Troubleshooting** | Inspect `/etc/kubernetes/manifests/` | Check `kube-apiserver.yaml`, `kube-scheduler.yaml`, `kube-controller-manager.yaml` |
| **Etcd Backup** | `etcdctl snapshot save <file>` | `--endpoints=https://127.0.0.1:2379 --cacert=... --cert=... --key=...` |
| **Etcd Restore** | `etcdutl snapshot restore <file>` | `--data-dir=/var/lib/etcd-backup` (update `etcd.yaml` volume hostPath). `etcdctl snapshot restore` is gone from etcd 3.6+ |
| **Upgrade Node (Control Plane / Worker)** | `apt-get update && apt-get install -y --allow-change-held-packages kubeadm='1.36.5-*'` | pkgs.k8s.io has one repo per minor: point `/etc/apt/sources.list.d/kubernetes.list` at `.../core:/stable:/v1.36/deb/` first. Then `kubeadm upgrade plan` -> `kubeadm upgrade apply v1.36.5` (workers: `kubeadm upgrade node`) -> upgrade `kubelet`/`kubectl` -> `systemctl restart kubelet` |

---

## 3. Top Troubleshooting Patterns

### A. Pod in `CrashLoopBackOff` or `Pending`
1. Check events: `k describe pod <pod-name> -n <ns>`
2. Check logs: `k logs <pod-name> -n <ns> --previous`
3. If `Pending`: Check node taints, node selectors, affinity, or resource quotas/limits.
   ```bash
   k get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints
   ```

### B. Node in `NotReady`
1. SSH into the node: `ssh <node>`
2. Check kubelet service: `systemctl status kubelet`
3. View logs: `journalctl -u kubelet -n 100 --no-pager`
4. Common issues:
   - Container runtime (containerd/crio) is down (`systemctl restart containerd`).
   - Swap is enabled (`swapoff -a`).
   - Invalid configuration or wrong certificate path in `/var/lib/kubelet/config.yaml` or `/etc/kubernetes/kubelet.conf`.

### C. Static Pods
- Manifest location: `/etc/kubernetes/manifests/` (or check `staticPodPath` in `/var/lib/kubelet/config.yaml`).
- To create a static pod on a worker node:
  ```bash
  k run my-static --image=nginx $do > /etc/kubernetes/manifests/my-static.yaml
  ```

---

## 4. Etcd Backup & Restore Reference

### Snapshot:
```bash
ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/snapshot-pre-boot.db
```

### Restore:
```bash
etcdutl snapshot restore /opt/snapshot-pre-boot.db \
  --data-dir=/var/lib/etcd-from-backup
```
Then edit `/etc/kubernetes/manifests/etcd.yaml` to update the hostPath volume for `etcd-data` to `/var/lib/etcd-from-backup`.

Restore is an offline file operation, so it needs no endpoints or certificates - and it lives in
`etcdutl`, not `etcdctl`: `etcdctl snapshot restore` was deprecated in etcd 3.5 and is gone from
3.6+ (the CKA track's v1.35 cluster runs 3.6, like the exam; there it fails with `unknown flag: --data-dir`). Check first with
`etcdctl version`; on a 3.5 node the old `ETCDCTL_API=3 etcdctl snapshot restore` still works.

---

## 5. Official Kubernetes Documentation URLs Allowed in CKA
Per the LF "Resources Allowed" page (checked 2026-10-02):
- Kubernetes Documentation: `https://kubernetes.io/docs/` (the kubectl cheatsheet lives here: `https://kubernetes.io/docs/reference/kubectl/cheatsheet/`)
- Kubernetes Blog: `https://kubernetes.io/blog/`
- Helm Documentation: `https://helm.sh/docs`
- Gateway API Documentation (CKA only): `https://gateway-api.sigs.k8s.io`

### Pro Tip for Search in Docs:
Use the documentation search bar for exact resource types, e.g., `NetworkPolicy`, `PersistentVolume`, `Ingress`, or `kubeadm upgrade`. Copy YAML snippets directly from the docs and edit with `$do`.