cka-sim/CKA_EXAM_GUIDE.md

CKA Exam Preparation & Scenario Decision Guide

This guide is designed for fast mental retrieval during exam scenarios. It outlines which command to choose based on the situation, the exact syntax to run, and the official documentation shortcuts permitted during the exam.

The CKA environment runs Kubernetes v1.35 (etcd 3.6) as of October 2026, and so does this simulator's CKA track.

---

1. Quick Environment Setup & Muscle Memory

Run these first on every terminal/node session in the exam:

# Core aliases & shell variables
alias k=kubectl
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"

# Shell auto-completion with alias support
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

# Vim configuration (~/.vimrc)
cat << 'EOF' > ~/.vimrc
set tabstop=2
set shiftwidth=2
set expandtab
set number
syntax on
EOF

---

2. Situation-to-Command Decision Matrix

Situation / Task	First-Choice Command / Action	Key Flags / Syntax
Create a single pod	k run <name> --image=<img...>	$do > pod.yaml
Expose a pod/deployment as Service	k expose <pod/deploy> <name>	--port=80 --target-port=8080 --type=NodePort/ClusterIP
Create Deployment	k create deploy <name> --image=<img>	--replicas=3 $do > deploy.yaml
Create Job / CronJob	k create job <name> --image=<img> k create cj <name> --image=<img>	--schedule="*/5 * * * *"
Create Secret / ConfigMap	k create secret generic <name> k create cm <name>	--from-literal=key=val --from-file=config.txt
Create ServiceAccount & Token	k create sa <name> k create token <name>	(Kubernetes 1.24+ standard)
Create RBAC Role & RoleBinding	k create role <name> k create rolebinding <name>	--verb=get,list,watch --resource=pods,deployments --role=<role> --serviceaccount=<ns>:<sa>
Create ClusterRole & ClusterRoleBinding	k create clusterrole <name> k create clusterrolebinding <name>	--verb=get,list --resource=nodes,pv --clusterrole=<cr> --user=<user>
Create Ingress	k create ingress <name>	--rule="host/path*=svc:port" --class=nginx --annotation=...
Check API permissions	k auth can-i <verb> <res>	--as=system:serviceaccount:<ns>:<sa> -n <ns>
Find YAML syntax / field paths	k explain <resource>.<field>	k explain pod.spec.containers.securityContext --recursive
Inspect Node / Pod metrics	k top node / k top pod	-A --sort-by=cpu or --sort-by=memory
Drain node for maintenance	k drain <node>	--ignore-daemonsets --delete-emptydir-data --force
Reactivate / Uncordon node	k uncordon <node>
Troubleshoot Node (Kubelet)	systemctl status kubelet journalctl -u kubelet -e --no-pager	Check /etc/kubernetes/kubelet.conf & /var/lib/kubelet/config.yaml
Control Plane Troubleshooting	Inspect /etc/kubernetes/manifests/	Check kube-apiserver.yaml, kube-scheduler.yaml, kube-controller-manager.yaml
Etcd Backup	etcdctl snapshot save <file>	--endpoints=https://127.0.0.1:2379 --cacert=... --cert=... --key=...
Etcd Restore	etcdutl snapshot restore <file>	--data-dir=/var/lib/etcd-backup (update etcd.yaml volume hostPath). etcdctl snapshot restore is gone from etcd 3.6+
Upgrade Node (Control Plane / Worker)	apt-get update && apt-get install -y --allow-change-held-packages kubeadm='1.36.5-*'	pkgs.k8s.io has one repo per minor: point /etc/apt/sources.list.d/kubernetes.list at .../core:/stable:/v1.36/deb/ first. Then kubeadm upgrade plan -> kubeadm upgrade apply v1.36.5 (workers: kubeadm upgrade node) -> upgrade kubelet/kubectl -> systemctl restart kubelet

---

3. Top Troubleshooting Patterns

A. Pod in CrashLoopBackOff or Pending

1. Check events: k describe pod <pod-name> -n <ns>
2. Check logs: k logs <pod-name> -n <ns> --previous
3. If Pending: Check node taints, node selectors, affinity, or resource quotas/limits.

   k get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints
   

B. Node in NotReady

1. SSH into the node: ssh <node>
2. Check kubelet service: systemctl status kubelet
3. View logs: journalctl -u kubelet -n 100 --no-pager
4. Common issues:
   • Container runtime (containerd/crio) is down (systemctl restart containerd).
   • Swap is enabled (swapoff -a).
   • Invalid configuration or wrong certificate path in /var/lib/kubelet/config.yaml or /etc/kubernetes/kubelet.conf.

C. Static Pods

• Manifest location: /etc/kubernetes/manifests/ (or check staticPodPath in /var/lib/kubelet/config.yaml).
• To create a static pod on a worker node:

  k run my-static --image=nginx $do > /etc/kubernetes/manifests/my-static.yaml
  

---

4. Etcd Backup & Restore Reference

Snapshot:

ETCDCTL_API=3 etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /opt/snapshot-pre-boot.db

Restore:

etcdutl snapshot restore /opt/snapshot-pre-boot.db \
  --data-dir=/var/lib/etcd-from-backup

Then edit /etc/kubernetes/manifests/etcd.yaml to update the hostPath volume for etcd-data to /var/lib/etcd-from-backup.

Restore is an offline file operation, so it needs no endpoints or certificates - and it lives in etcdutl, not etcdctl: etcdctl snapshot restore was deprecated in etcd 3.5 and is gone from 3.6+ (the CKA track's v1.35 cluster runs 3.6, like the exam; there it fails with unknown flag: --data-dir). Check first with etcdctl version; on a 3.5 node the old ETCDCTL_API=3 etcdctl snapshot restore still works.

---

5. Official Kubernetes Documentation URLs Allowed in CKA

Per the LF "Resources Allowed" page (checked 2026-10-02):

• Kubernetes Documentation: https://kubernetes.io/docs/ (the kubectl cheatsheet lives here: https://kubernetes.io/docs/reference/kubectl/cheatsheet/)
• Kubernetes Blog: https://kubernetes.io/blog/
• Helm Documentation: https://helm.sh/docs
• Gateway API Documentation (CKA only): https://gateway-api.sigs.k8s.io

Pro Tip for Search in Docs:

Use the documentation search bar for exact resource types, e.g., NetworkPolicy, PersistentVolume, Ingress, or kubeadm upgrade. Copy YAML snippets directly from the docs and edit with $do.