# CKA weak spots

_Generated by exam from 1 attempt(s); regenerated on every `end`._

## Drill next  (`./exam drill weak`)

### Q01 · ARCH · RBAC for a deployment bot  (1/1 failed, last 2/6 pts, 2026-09-06T22:07)
- ✗ ServiceAccount rbac-app/deploy-bot exists
- ✗ Role deploy-manager and RoleBinding deploy-bot-binding exist
- ✗ deploy-bot can get/list/watch/create/update/patch/delete deployments

### Q05 · ARCH · Static pod  (1/1 failed, last 0/5 pts, 2026-09-06T22:07)
- ✗ manifest containing static-web is in /etc/kubernetes/manifests on the node
- ✗ mirror pod static-web-<node> is Running
- ✗ image is nginx:1.27

### Q06 · ARCH · Certificates: expiry check and user CSR  (1/1 failed, last 0/6 pts, 2026-09-06T22:07)
- ✗ apiserver-expiry.txt records the real expiry month and year
- ✗ CSR jane exists with signer kubernetes.io/kube-apiserver-client
- ✗ CSR jane approved and certificate issued
- ✗ jane can list pods in default (view) but not delete them

### Q34 · ARCH · Discover a CRD field with kubectl explain  (1/1 failed, last 0/4 pts, 2026-09-06T22:07)
- ✗ path.txt has the correct field path
- ✗ Gadget/sample created with the field = 4

### Q41 · ARCH · Component versions  (1/1 failed, last 0/4 pts, 2026-09-06T22:07)
- ✗ apiserver and kubelet versions correct
- ✗ etcd and runtime versions correct

## Attempt matrix

| Q | Domain | Title | D1 |
|---|---|---|---|
| 1 | ARCH | RBAC for a deployment bot | 2/6 |
| 2 | ARCH | etcd snapshot | · |
| 3 | ARCH | Kustomize overlay | · |
| 4 | ARCH | CustomResourceDefinition | · |
| 5 | ARCH | Static pod | 0/5 |
| 6 | ARCH | Certificates: expiry check and user CSR | 0/6 |
| 7 | WORK | Rolling update & scaling | · |
| 8 | WORK | Multi-container pod with shared volume | · |
| 9 | WORK | Scheduling with node affinity and resources | · |
| 10 | WORK | ConfigMap and Secret consumption | · |
| 11 | NET | NetworkPolicy | · |
| 12 | NET | NodePort Service | · |
| 13 | NET | Ingress routing | · |
| 14 | NET | Cluster DNS | · |
| 15 | STOR | PersistentVolume, claim and pod | · |
| 16 | STOR | Default StorageClass and dynamic provisioning | · |
| 17 | TSHOOT | Node NotReady | · |
| 18 | TSHOOT | Broken deployment and service | · |
| 19 | TSHOOT | CrashLoopBackOff diagnosis | · |
| 20 | TSHOOT | Control plane component failure | · |
| 21 | ARCH | Helm release install and upgrade | · |
| 22 | NET | Gateway API HTTPRoute | · |
| 23 | WORK | metrics-server repair and HPA | · |
| 24 | WORK | PriorityClass | · |
| 25 | WORK | Taints and tolerations | · |
| 26 | WORK | DaemonSet on every node | · |
| 27 | WORK | CronJob with a manual run | · |
| 28 | WORK | Init container prepares content | · |
| 29 | WORK | Immutable ConfigMap rotation | · |
| 30 | NET | Named ports | · |
| 31 | WORK | Parallel Job | · |
| 32 | WORK | ResourceQuota and LimitRange | · |
| 33 | ARCH | Aggregated ClusterRole | · |
| 34 | ARCH | Discover a CRD field with kubectl explain | 0/4 |
| 35 | STOR | Re-bind a Released PersistentVolume | · |
| 36 | STOR | Data survives the pod | · |
| 37 | TSHOOT | Cluster DNS is broken | · |
| 38 | TSHOOT | Deployments never create pods | · |
| 39 | TSHOOT | kubelet misconfiguration | · |
| 40 | ARCH | kubeadm join token | · |
| 41 | ARCH | Component versions | 0/4 |
| 42 | NET | Egress-only NetworkPolicy | · |
| 43 | NET | Headless and ExternalName services | · |
| 101 | ARCH | Exact RBAC with an existing over-grant | · |
| 102 | ARCH | etcd restore | · |
| 103 | ARCH | Static pod on a relocated manifest path | · |
| 104 | ARCH | User onboarding to a working kubeconfig | · |
| 105 | ARCH | Kustomize with generators and patches | · |
| 106 | ARCH | CRD with validation and defaults | · |
| 107 | WORK | Spread, tolerate, prioritise — under a quota | · |
| 108 | WORK | Rollback to a specific revision, then pause | · |
| 109 | WORK | Native sidecar with probes and an exact report | · |
| 110 | WORK | Cluster audit to exact files | · |
| 111 | NET | Zero-trust namespace | · |
| 112 | NET | TLS Ingress with a generated certificate | · |
| 113 | NET | Gateway API canary with header match | · |
| 114 | NET | DNS down: three faults | · |
| 115 | STOR | Bind the right local volume | · |
| 116 | STOR | Migrate data between claims | · |
| 117 | TSHOOT | Worker node: three things wrong | · |
| 118 | TSHOOT | Two control-plane components down | · |
| 119 | TSHOOT | Application down for four reasons | · |
| 120 | TSHOOT | Cluster facts, exactly | · |
| 121 | WORK | The context's namespace | · |
| 122 | ARCH | Renew control-plane certificates | · |
| 201 | ARCH | kubeconfig forensics | · |
| 202 | ARCH | Helm chart with CRDs, then a custom resource | · |
| 203 | WORK | Find the controller, then scale it | · |
| 204 | WORK | Which Pods get evicted first | · |
| 205 | ARCH | Kustomize: drop a ConfigMap, add an HPA, override in prod | · |
| 206 | STOR | PV, PVC and a Deployment that mounts it | · |
| 207 | TSHOOT | Resource usage scripts | · |
| 208 | ARCH | Drain a node for maintenance | · |
| 209 | ARCH | Query the API from inside a Pod | · |
| 210 | ARCH | ServiceAccount limited to two resources | · |
| 211 | WORK | DaemonSet on every node | · |
| 212 | WORK | One Pod per node, on purpose | · |
| 213 | NET | Convert an Ingress to Gateway API, then split on a header | · |
| 214 | ARCH | Certificate expiry, two ways | · |
| 215 | NET | Egress policy with paired destinations | · |
| 216 | NET | CoreDNS: back up, extend, verify | · |
| 217 | TSHOOT | Inspect a container with crictl | · |
| 301 | ARCH | etcd configuration facts | · |
| 302 | NET | Service rules on the node | · |
| 303 | NET | A second Service CIDR | · |
| 304 | ARCH | Bound tokens versus legacy tokens | · |
| 305 | WORK | Schedule without the scheduler | · |
| 306 | STOR | Grow a volume in place | · |
| 307 | TSHOOT | Node accepts nothing new | · |
| 308 | ARCH | API resource reference card | · |
| 309 | WORK | A PodDisruptionBudget that blocks maintenance | · |
| 310 | NET | Route to something outside the cluster | · |
| 311 | ARCH | Image inventory across the cluster | · |
| 312 | WORK | A Job that fails, then one that doesn't | · |
| 313 | NET | Two hosts, TLS, and a default backend | · |
| 314 | TSHOOT | A static pod that never starts | · |
| 315 | STOR | Keep the data when the claim goes | · |
| 316 | ARCH | Plan a control-plane upgrade | · |
| 317 | TSHOOT | Certificates stop being issued | · |

_E = full exam, D = drill, · = not in that session, n/m = partial credit._