105 of the 147 CKA reference solutions had you type what nobody types
in the exam: heredoc manifests, sed, JSON patches, kubectl wait, loops,
command substitution, jsonpath into files. Each is rewritten as the
lessons are: a generator and the lines to add in vim, a manifest pasted
from the docs page it names, kubectl edit, ssh NODE and sudo -i, or a
value read off the screen and echoed. The other 42 were commands typed
as they stand already.
A solution can now be parts (sim/bank.py cmd, hand) as a lesson step's
show is. The page and ./ksim solution N render it as Markdown, each
thing to type a block of its own that a click copies, with the edit
beneath it. A solution in parts is its own audit script: load_track
runs its parts, and for each edit by hand the script beside it, so the
solution you read is the one proven. Their separate scripts in
cka/solve.py are dropped, and a task that has both is refused.
./ksim solution lint [N|DOMAIN..] reads what the solutions have you
type against TYPING_TRAPS: the CKA bank is clean. Q49's params gain
the plural stem and shortName the solution spells out (no new draws);
Q103, ported from CKAD Q23, takes a solution of its own.
Audited from a copy with renamed hosts: Q3-Q67 (52 tasks) all solved by
their parts, after two waits were added to the audit scripts (Q43's
DNS record, Q53's Pods); Q68-Q147 still running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BNSZLLsGXTMBsw17kDunkQ
Bump VERSION to 2026.10.26.4 and date its CHANGELOG.md entry: every
CKA lesson step shown the exam way, ./ksim lesson lint, failed host
setups marked, from 226ef19.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Show me how gave the commands the audit runs: sed, awk and yq edits,
heredoc manifests, JSON patches, --overrides, sleeps and wait loops -
nothing anyone types in the exam. A step's show is now a list of
parts (sim/bank.py): cmd() is what you type as it stands; hand() is
what you do by hand - vim on a generated skeleton or on a manifest
pasted from the docs page it names, kubectl edit, ssh NODE and sudo
-i, a value you read and echo - with a script that does the same for
the audit. All 135 CKA steps are rewritten so, with k for kubectl;
their checks, titles and texts are unchanged.
Add ./ksim lesson lint, which reads what every step has you type and
flags scripts. The lesson audit runs it first.
Record the hosts whose setup failed when a session started. The page
warns above that task or lesson and offers Rebuild this host; the CLI
names ./ksim reset N on each step.
Render *italics* in lessons and tasks, outside code spans.
Audited on v1.37: CKA lessons 27/27, 135/135 steps, done the exam
way; lint clean. kubectl edit --subresource resize, the one edit the
audit replaces with a patch, was proven on its own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bump VERSION to 2026.10.26.3 and date its CHANGELOG.md entry: the
stale ./ksim web guard from 95f9d1b.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
./ksim web reads web/index.html from disk on every request but runs
the code it started with. After the Teach a domain update, a server
from before it got the page's new start request, did not know
"teach", and started its default instead: a full 20-task exam.
Report "stale" in /api/session: whether ksim or sim/*.py changed on
disk since the server started. The page treats a server that sends
no "stale" as stale too, since it predates the check. While the
server is stale, the lobby says to restart it and launch() starts no
session.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add runs of a domain's lessons: ./ksim lesson ARCH, the lobby's Teach
a domain card, or the Teach a domain session in the Start exam
dialog. A run is one lesson session over the domain's lessons not
done yet (--all: every one), each on its own host, all made before it
starts, so there is no waiting between lessons. The session keeps
the lesson you are on and each lesson's checks. A lesson's wrap-up
leads to the next, the list at the top of a lesson goes to any lesson
of the run, and ./ksim lesson next and ./ksim lesson OBJ do the same
in a terminal. Finishing the run sends you to the domain's drill.
Stamp a lesson done the moment its last step passes, not when the
session ends, so terminating a lesson or a run keeps what it taught.
Tested on a real STOR run in a copy of the repo: every host up before
step 1; lesson 1.1 done step by step through the CLI and the web API,
and stamped done as its last step passed; next, jump, a lesson
outside the run refused, and the finish report as expected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bump VERSION to 2026.10.26.1 and date its CHANGELOG.md entry: the
noVNC cache fix from cf4f5be.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The desktop failed to start in a browser that had cached noVNC 1.6
from the Debian desktop image: its vnc.html, which has no clipboard
Clear button, ran the Ubuntu image's 1.3 ui.js, which wires one up
and threw "Cannot read properties of null". websockify sends only
Last-Modified, so browsers cache noVNC on a guess, and it answers a
revalidation with 304 when the file on disk is older than the copy.
Serve noVNC through websockify-no-store, which adds Cache-Control:
no-store to every response, and from /novnc/ rather than /, so no
browser holds a stale copy at the paths the desktop now uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The release reaches main on 2026-10-21, when feat/lessons is merged:
replace the Unreleased heading with the version and that date, and
name the commits its entries came in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDuDkQHyHPvYZQAE1z5CF2
Q103 failed to seed once in an audit of six hosts at a time: a minute
passed without a Falco alert naming the Pod. When that happens, the
setup now replaces the Pod - a new container, which Falco's container
plugin looks up afresh - and waits one minute more before it gives up.
Record the final audit in README.md and CHANGELOG.md: CKS 110/110 on
v1.37, Q103 passing alone and with the other seven VM tasks six at a
time, and CKA Q132, CKAD Q1 and CKS Q60, Q61 and Q64 passing on the
images rebuilt with hexdump and xxd.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDuDkQHyHPvYZQAE1z5CF2
Add lessons: untimed guided labs, one per curriculum objective, on a
host of their own, in the browser and in the terminal. Each step has
a check, a hint and its commands; a lesson writes no history or
scores, only a done mark on its objective. CKAD 2.1-2.4 (24 steps)
and all 27 CKA objectives (135 steps) have one, and `./ksim lesson
audit` proves that every step fails, is done by its own commands,
then passes.
Add CKA tasks 132-147 (cka/bank_course.py) on what a full CKA course
teaches beyond the bank: a real upgrade from v1.36, a drain under a
PodDisruptionBudget, QoS and eviction, in-place resize, kube-proxy's
chains, encryption at rest, an operator, and CSI expansion, snapshots
and clones (ensure_csi_hostpath).
Move CKA and CKS to Kubernetes v1.37 and rebuild the hosts on Ubuntu
24.04, with kubelet, kubeadm and kubectl as held packages from
pkgs.k8s.io; the desktop runs Ubuntu too. Hosts gain man pages,
hexdump and xxd.
Fix CKS Q4, which gave 3 of 12 points untouched, and CKA Q4 and Q49,
whose solutions raced their new CRD.
Audited on v1.37: CKA 147/147, CKAD 105/105, CKS 109/110 (Q103, a
Falco task, failed to seed once and awaits a re-audit); lessons: 135
of 135 CKA steps and 24 of 24 CKAD steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a changelog from the first release (2026.10.12.1) up to
2026.10.15.3, newest first, with Added/Changed/Removed/Fixed sections
and the commit behind each entry. List dark mode under 2026.10.15.3,
since it shipped without a version bump.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JZPd3GGWyxTgAkL6a4gAJz
