vumast3r/cka-sim
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5e3d593f79
cka-sim/weak-spots-cka.md
vumast3r 43e2e1db2f refactor: renumber the CKA bank 1-102 with no gaps 
Task ids used to jump 1-43 / 101-124 / 401-418 / 501-517. They now run
contiguously in the same order:

  1-43    unchanged (base and extra)
  44-67   hard pool          (was 101-124)
  68-85   Simulator Set C    (was 401-418)
  86-102  Simulator Set D    (was 501-517)

Every reference moved with its task: ids, solution keys, workspace paths
({WS}/qNN and the graders' hidden .qNN-* files), temp paths, the one
hardcoded id in code (Q56's derived canary weight), and Q-number
cross-references in the harness, README and the explainer. Each task's
paths were checked to carry only its own new number. History entries and
the local session state were remapped so past attempts stay attached to the
same tasks; retired set A/B ids keep their old numbers and match nothing.
weak-spots is regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mhxm4rsUfuE5HoytYbu2YW
2026-09-22 22:05:37 -06:00

211 lines
15 KiB
Markdown
Raw Blame History

# CKA weak spots
_Generated by exam from 10 attempt(s); regenerated on every `end`._
## Domain scores (latest full exam, 2026-09-08T19:59, 14.3%)
- **ARCH** 12/26 — Cluster Architecture, Installation & Configuration (25%)
- **WORK** 1/16 — Workloads & Scheduling (15%)
- **NET** 0/17 — Services & Networking (20%)
- **STOR** 0/11 — Storage (10%)
- **TSHOOT** 2/35 — Troubleshooting (30%)
## Drill next (`./exam drill weak`)
### Q02 · ARCH · etcd snapshot (1/2 failed, last 0/7 pts, last failed 2026-09-19T12:27)
- ✗ /opt/cka/etcd-snapshot.db exists on the control-plane node
- ✗ snapshot is a real etcd backup (> 100 KB)
### Q06 · ARCH · Certificates: expiry check and user CSR (2/3 failed, last 6/6 pts, last failed 2026-09-12T22:17)
- passed last time (6/6) - one more clean pass takes it off this list
### Q15 · STOR · PersistentVolume, claim and pod (3/4 failed, last 6/6 pts, last failed 2026-09-15T20:55)
- passed last time (6/6) - one more clean pass takes it off this list
### Q16 · STOR · Default StorageClass and dynamic provisioning (4/4 failed, last 0/5 pts, last failed 2026-09-16T19:40)
- ✗ StorageClass fast-local: local-path, WaitForFirstConsumer, Delete
- ✗ fast-local is default and standard is not
- ✗ fast-claim picked up fast-local and is Bound
- ✗ fast-pod Running with claim at /data
### Q17 · TSHOOT · Node NotReady (3/4 failed, last 8/8 pts, last failed 2026-09-13T01:06)
- passed last time (8/8) - one more clean pass takes it off this list
### Q19 · TSHOOT · CrashLoopBackOff diagnosis (4/5 failed, last 6/6 pts, last failed 2026-09-14T16:49)
- passed last time (6/6) - one more clean pass takes it off this list
### Q28 · WORK · Init container prepares content (4/4 failed, last 0/4 pts, last failed 2026-09-16T19:40)
- ✗ pod Running, init container named setup completed
- ✗ emptyDir 'content' shared by both containers
- ✗ nginx serves the init-written content
### Q29 · WORK · Immutable ConfigMap rotation (3/4 failed, last 4/4 pts, last failed 2026-09-15T20:55)
- passed last time (4/4) - one more clean pass takes it off this list
### Q30 · NET · Named ports (2/3 failed, last 4/4 pts, last failed 2026-09-14T16:49)
- passed last time (4/4) - one more clean pass takes it off this list
### Q32 · WORK · ResourceQuota and LimitRange (1/1 failed, last 0/4 pts, last failed 2026-09-19T12:27)
- ✗ ResourceQuota limits pods/6, requests.cpu 1, limits.memory 2Gi
- ✗ LimitRange defaults set
- ✗ worker pods Running with defaulted requests
### Q33 · ARCH · Aggregated ClusterRole (2/3 failed, last 5/5 pts, last failed 2026-09-14T16:49)
- passed last time (5/5) - one more clean pass takes it off this list
### Q37 · TSHOOT · Cluster DNS is broken (4/5 failed, last 6/6 pts, last failed 2026-09-14T16:49)
- passed last time (6/6) - one more clean pass takes it off this list
### Q38 · TSHOOT · Deployments never create pods (2/3 failed, last 7/7 pts, last failed 2026-09-13T01:06)
- passed last time (7/7) - one more clean pass takes it off this list
### Q40 · ARCH · kubeadm join token (4/4 failed, last 0/5 pts, last failed 2026-09-16T19:40)
- ✗ join.sh contains a kubeadm join with token and CA hash
- ✗ the token in the file exists in the cluster with TTL ~24h
### Q42 · NET · Egress-only NetworkPolicy (2/3 failed, last 4/4 pts, last failed 2026-09-14T16:49)
- passed last time (4/4) - one more clean pass takes it off this list
### Q45 · ARCH · etcd restore (1/1 failed, last 2/10 pts, last failed 2026-09-19T12:27)
- ✗ ConfigMap restore-proof-67 exists again with its original data
- ✗ etcd uses a restored data directory (manifest changed)
### Q49 · ARCH · CRD with validation and defaults (4/4 failed, last 0/7 pts, last failed 2026-09-19T12:27)
- ✗ CRD exists, Namespaced, replicas has min/max and is required
- ✗ good created with environment prod
- ✗ replicas 0 is rejected and the message was saved
- ✗ defaulting works: defaulted.spec.environment == dev
### Q52 · WORK · Native sidecar with probes and an exact report (1/1 failed, last 2/8 pts, last failed 2026-09-19T12:27)
- ✗ native sidecar: initContainer agent with restartPolicy Always
- ✗ probes on app as specified
- ✗ Running, shared log written by agent, grace period 5
### Q55 · NET · TLS Ingress with a generated certificate (4/4 failed, last 0/7 pts, last failed 2026-09-19T12:27)
- ✗ Secret secure.lab.local-tls is kubernetes.io/tls with CN secure.lab.local
- ✗ Ingress web: class nginx, host, TLS secret, ssl-redirect annotation
- ✗ fp.txt matches the secret's certificate fingerprint
### Q58 · STOR · Bind the right local volume (3/3 failed, last 1/6 pts, last failed 2026-09-15T20:55)
- ✗ PVC uses a selector and is Bound to lv-nvme
- ✗ consumer Running on the nvme node with /data mounted
### Q63 · TSHOOT · Cluster facts, exactly (3/3 failed, last 0/5 pts, last failed 2026-09-15T20:55)
- ✗ pod-cidr and service-cidr
- ✗ dns-ip and proxy-mode
- ✗ cka-sim-worker3 pod CIDR
### Q64 · WORK · The context's namespace (3/3 failed, last 1/6 pts, last failed 2026-09-15T20:55)
- ✗ Deployment ledger-21 in ac-echo (the context's namespace), 2 available, owner=ac
- ✗ Service ledger-21 port 9000 in the same namespace
- ✗ ns.txt has the namespace
## Attempt matrix
| Q | Domain | Title | D1 | E2 | D3 | D4 | D5 | D6 | D7 | D8 | D9 | D10 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | ARCH | RBAC for a deployment bot | 2/6 | · | · | ✓ | · | · | · | · | · | · |
| 2 | ARCH | etcd snapshot | · | ✓ | · | · | · | · | · | · | · | 0/7 |
| 3 | ARCH | Kustomize overlay | · | 0/5 | · | · | · | · | ✓ | · | · | · |
| 4 | ARCH | CustomResourceDefinition | · | ✓ | · | · | · | · | · | · | · | ✓ |
| 5 | ARCH | Static pod | 0/5 | · | · | · | · | · | ✓ | · | · | · |
| 6 | ARCH | Certificates: expiry check and user CSR | 0/6 | · | · | 3/6 | · | · | ✓ | · | · | · |
| 7 | WORK | Rolling update & scaling | · | · | · | · | · | · | · | · | · | · |
| 8 | WORK | Multi-container pod with shared volume | · | 0/4 | · | · | · | · | ✓ | · | · | ✓ |
| 9 | WORK | Scheduling with node affinity and resources | · | · | · | · | · | · | · | · | · | ✓ |
| 10 | WORK | ConfigMap and Secret consumption | · | · | · | · | · | · | · | · | · | · |
| 11 | NET | NetworkPolicy | · | · | · | · | · | · | · | · | · | · |
| 12 | NET | NodePort Service | · | 0/4 | · | · | · | · | ✓ | · | · | · |
| 13 | NET | Ingress routing | · | 0/5 | · | · | · | · | 0/5 | ✓ | · | ✓ |
| 14 | NET | Cluster DNS | · | · | · | · | · | · | · | · | · | · |
| 15 | STOR | PersistentVolume, claim and pod | · | 0/6 | · | · | · | · | 0/6 | 0/6 | ✓ | · |
| 16 | STOR | Default StorageClass and dynamic provisioning | · | 0/5 | · | · | · | · | 0/5 | 0/5 | 0/5 | · |
| 17 | TSHOOT | Node NotReady | · | 0/8 | · | · | 4/8 | 4/8 | ✓ | · | · | · |
| 18 | TSHOOT | Broken deployment and service | · | 0/7 | · | · | · | · | ✓ | · | · | · |
| 19 | TSHOOT | CrashLoopBackOff diagnosis | · | 1/6 | · | · | 1/6 | 1/6 | 4/6 | ✓ | · | · |
| 20 | TSHOOT | Control plane component failure | · | 0/8 | · | · | · | · | ✓ | · | · | · |
| 21 | ARCH | Helm release install and upgrade | · | · | · | ✓ | · | · | · | · | · | · |
| 22 | NET | Gateway API HTTPRoute | · | · | · | · | · | · | · | · | · | · |
| 23 | WORK | metrics-server repair and HPA | · | · | · | · | · | · | · | · | · | · |
| 24 | WORK | PriorityClass | · | · | · | · | · | · | · | · | · | · |
| 25 | WORK | Taints and tolerations | · | 0/4 | · | · | · | · | 0/4 | 0/4 | ✓ | ✓ |
| 26 | WORK | DaemonSet on every node | · | · | · | · | · | · | · | · | · | · |
| 27 | WORK | CronJob with a manual run | · | · | · | · | · | · | · | · | · | · |
| 28 | WORK | Init container prepares content | · | 0/4 | · | · | · | · | 0/4 | 0/4 | 0/4 | · |
| 29 | WORK | Immutable ConfigMap rotation | · | 1/4 | · | · | · | · | 1/4 | 1/4 | ✓ | · |
| 30 | NET | Named ports | · | 0/4 | · | · | · | · | 0/4 | ✓ | · | · |
| 31 | WORK | Parallel Job | · | · | · | · | · | · | · | · | · | · |
| 32 | WORK | ResourceQuota and LimitRange | · | · | · | · | · | · | · | · | · | 0/4 |
| 33 | ARCH | Aggregated ClusterRole | · | 1/5 | · | · | · | · | 1/5 | ✓ | · | · |
| 34 | ARCH | Discover a CRD field with kubectl explain | 0/4 | · | · | ✓ | · | · | · | · | · | ✓ |
| 35 | STOR | Re-bind a Released PersistentVolume | · | · | · | · | · | · | · | · | · | · |
| 36 | STOR | Data survives the pod | · | · | · | · | · | · | · | · | · | · |
| 37 | TSHOOT | Cluster DNS is broken | · | 1/6 | · | · | 1/6 | 1/6 | 1/6 | ✓ | · | · |
| 38 | TSHOOT | Deployments never create pods | · | · | · | · | 0/7 | 0/7 | ✓ | · | · | · |
| 39 | TSHOOT | kubelet misconfiguration | · | · | · | · | 4/7 | 4/7 | 0/7 | ✓ | · | ✓ |
| 40 | ARCH | kubeadm join token | · | 0/5 | · | · | · | · | 0/5 | 0/5 | 0/5 | · |
| 41 | ARCH | Component versions | 0/4 | · | · | ✓ | · | · | · | · | · | · |
| 42 | NET | Egress-only NetworkPolicy | · | 0/4 | · | · | · | · | 0/4 | ✓ | · | · |
| 43 | NET | Headless and ExternalName services | · | · | · | · | · | · | · | · | · | · |
| 44 | ARCH | Exact RBAC with an existing over-grant | · | · | · | · | · | · | · | · | · | · |
| 45 | ARCH | etcd restore | · | · | · | · | · | · | · | · | · | 2/10 |
| 46 | ARCH | Static pod on a relocated manifest path | · | · | · | · | · | · | · | · | · | · |
| 47 | ARCH | User onboarding to a working kubeconfig | · | · | · | · | · | · | · | · | · | · |
| 48 | ARCH | Kustomize with generators and patches | · | · | · | · | · | · | · | · | · | · |
| 49 | ARCH | CRD with validation and defaults | · | · | 0/7 | · | · | · | 0/7 | 0/7 | · | 0/7 |
| 50 | WORK | Spread, tolerate, prioritise — under a quota | · | · | · | · | · | · | · | · | · | · |
| 51 | WORK | Rollback to a specific revision, then pause | · | · | · | · | · | · | · | · | · | · |
| 52 | WORK | Native sidecar with probes and an exact report | · | · | · | · | · | · | · | · | · | 2/8 |
| 53 | WORK | Namespace audit to exact files | · | · | · | · | · | · | · | · | · | · |
| 54 | NET | Zero-trust namespace | · | · | · | · | · | · | · | · | · | · |
| 55 | NET | TLS Ingress with a generated certificate | · | · | 0/7 | · | · | · | 0/7 | 0/7 | · | 0/7 |
| 56 | NET | Gateway API canary with header match | · | · | · | · | · | · | · | · | · | · |
| 57 | NET | DNS down: three faults | · | · | · | · | · | · | · | · | · | · |
| 58 | STOR | Bind the right local volume | · | · | 1/6 | · | · | · | 1/6 | 1/6 | · | · |
| 59 | STOR | Migrate data between claims | · | · | · | · | · | · | · | · | · | · |
| 60 | TSHOOT | Worker node: three things wrong | · | · | · | · | · | · | · | · | · | · |
| 61 | TSHOOT | Two control-plane components down | · | · | · | · | · | · | · | · | · | · |
| 62 | TSHOOT | Application down for four reasons | · | · | · | · | · | · | · | · | · | · |
| 63 | TSHOOT | Cluster facts, exactly | · | · | 0/5 | · | · | · | 0/5 | 0/5 | · | · |
| 64 | WORK | The context's namespace | · | · | 1/6 | · | · | · | 1/6 | 1/6 | · | · |
| 65 | ARCH | Renew control-plane certificates | · | · | · | · | · | · | · | · | · | · |
| 66 | TSHOOT | Nothing works: kube-apiserver itself is down | · | · | · | · | · | · | · | · | · | · |
| 67 | ARCH | Prepare a node join without shell access to the control plane | · | · | · | · | · | · | · | · | · | · |
| 68 | STOR | Provision geo-fence persistent storage | · | · | · | · | · | · | · | · | · | · |
| 69 | ARCH | Render a chart, then install it | · | · | · | · | · | · | · | · | · | · |
| 70 | TSHOOT | Fix the driver onboarding app | · | · | · | · | · | · | · | · | · | · |
| 71 | NET | Expose and verify the dispatch API | · | · | · | · | · | · | · | · | · | · |
| 72 | STOR | Migrate ride history to a Retain volume | · | · | · | · | · | · | · | · | · | · |
| 73 | TSHOOT | Fix ETA service connectivity | · | · | · | · | · | · | · | · | · | · |
| 74 | NET | Fleet dashboard canary with Gateway API | · | · | · | · | · | · | · | · | · | · |
| 75 | ARCH | Cluster-wide read access for the auth team | · | · | · | · | · | · | · | · | · | · |
| 76 | WORK | Add an init container to the trip logger | · | · | · | · | · | · | · | · | · | · |
| 77 | NET | Audit the CNI, then lock a namespace down | · | · | · | · | · | · | · | · | · | · |
| 78 | WORK | Priority for the rider support portal | · | · | · | · | · | · | · | · | · | · |
| 79 | WORK | Surge pricing configuration | · | · | · | · | · | · | · | · | · | · |
| 80 | ARCH | Plan the control-plane upgrade | · | · | · | · | · | · | · | · | · | · |
| 81 | TSHOOT | Fix the fare calculation pods | · | · | · | · | · | · | · | · | · | · |
| 82 | WORK | Autoscale the route planner on memory | · | · | · | · | · | · | · | · | · | · |
| 83 | NET | NetworkPolicy for the safety monitor | · | · | · | · | · | · | · | · | · | · |
| 84 | ARCH | Enforce TLS 1.3 on the booking portal | · | · | · | · | · | · | · | · | · | · |
| 85 | TSHOOT | Investigate vehicle tracker health | · | · | · | · | · | · | · | · | · | · |
| 86 | ARCH | How the control plane is run | · | · | · | · | · | · | · | · | · | · |
| 87 | TSHOOT | Cluster facts to an exact file | · | · | · | · | · | · | · | · | · | · |
| 88 | NET | Ready only when its dependency answers | · | · | · | · | · | · | · | · | · | · |
| 89 | WORK | Sorting done by kubectl | · | · | · | · | · | · | · | · | · | · |
| 90 | TSHOOT | Event forensics around kube-proxy | · | · | · | · | · | · | · | · | · | · |
| 91 | ARCH | API resources and a Role census | · | · | · | · | · | · | · | · | · | · |
| 92 | TSHOOT | Kubelet unit points at nothing | · | · | · | · | · | · | · | · | · | · |
| 93 | WORK | Secrets as a read-only volume and renamed env vars | · | · | · | · | · | · | · | · | · | · |
| 94 | ARCH | Static Pod on the control plane behind a Service | · | · | · | · | · | · | · | · | · | · |
| 95 | ARCH | The kubelet's two certificates | · | · | · | · | · | · | · | · | · | · |
| 96 | WORK | A Pod for the control plane only | · | · | · | · | · | · | · | · | · | · |
| 97 | TSHOOT | Stop the scheduler, schedule by hand | · | · | · | · | · | · | · | · | · | · |
| 98 | ARCH | Helm release housekeeping | · | · | · | · | · | · | · | · | · | · |
| 99 | STOR | Per-replica storage for a StatefulSet | · | · | · | · | · | · | · | · | · | · |
| 100 | NET | Namespace AND pod selector, enforced | · | · | · | · | · | · | · | · | · | · |
| 101 | NET | Resolves everything except the cluster | · | · | · | · | · | · | · | · | · | · |
| 102 | STOR | A claim that can never bind | · | · | · | · | · | · | · | · | · | · |
_E = full exam, D = drill, · = not in that session, n/m = partial credit._
Reference in New Issue View Git Blame Copy Permalink