CertGrid CertGrid

CKA (Certified Kubernetes Administrator)

Workloads, services and cluster troubleshooting.

103 published guides

83 of 103 guides need path access. Unlock CKA path

103-guide Certified Kubernetes Administrator learning path · 103 published · about 3017 min of reading · 10 learning tracks · reviewed 26 August 2026

Foundations6 guides

What the thing is, what the parts are called, and how to talk to it.

  1. Hands-on Lab 30 min Paid

    What Kubernetes Is and What It Does

    Get the one sentence that explains almost every behaviour you will meet later.

    desired state

    Updated 21 Aug 2026

  2. Hands-on Lab 20 min Paid

    First kubectl Session: Inspecting a Cluster

    Six commands that tell you which cluster you are pointed at and what it can be asked for.

    kubectl api-resources

    Updated 21 Aug 2026

  3. Hands-on Lab 30 min Paid

    Control Plane and Node Components

    Stop reading the five-box diagram and list four of those boxes as Pods you can inspect.

    kubectl get pods -n kube-system

    Updated 21 Aug 2026

  4. Concepts 30 min Paid

    Pods: The Basic Deployment Unit

    See what the API server fills in that you did not write, and why Kubernetes runs Pods not containers.

    kubectl get pod -o yaml

    Updated 21 Aug 2026

  5. Hands-on Lab 25 min Paid

    Declarative Versus Imperative Object Management

    Create the same Deployment twice and see what each way leaves behind on the object.

    kubectl apply vs create

    Updated 21 Aug 2026

  6. Hands-on Lab 18 min Paid

    kubectl Productivity for the Exam

    Stop typing YAML from memory - generate it, and query one field instead of reading a table.

    --dry-run=client -o yaml

    Updated 22 Aug 2026

Installation and Cluster Builds7 guides

Four cluster sizes on real hardware, plus everything they share.

  1. Installation 40 min Paid

    Single-Node kubeadm Cluster Setup

    Take one Ubuntu machine from nothing to a working cluster, and untaint it so it can run work.

    kubeadm init

    Updated 21 Aug 2026

  2. Installation 45 min Paid

    Two-Node kubeadm Cluster Setup

    Join a real worker with a token, and learn what to do when the token has expired.

    kubeadm join

    Updated 21 Aug 2026

  3. Installation 50 min Paid

    Three-Node kubeadm Cluster Setup

    Watch six replicas spread across two workers, then drain one and watch them move.

    kubectl drain

    Scheduling Updated 21 Aug 2026

  4. Installation 55 min Paid

    Four-Node kubeadm Cluster Setup

    Get the third worker that pod anti-affinity and topology spread actually need.

    topologySpreadConstraints

    Scheduling Updated 21 Aug 2026

  5. Concepts 30 min Paid

    Choosing and Installing a CNI Plugin

    Find out why a fresh kubeadm cluster has no pod network, and pick between Calico, Cilium and Flannel.

    kubectl get nodes # NotReady

    Updated 21 Aug 2026

  6. Configuration 25 min Paid

    kubeconfig Contexts and Multi-Cluster Access

    Stop SSH-ing to the control plane - merge several kubeconfigs and switch context.

    kubectl config use-context

    Updated 21 Aug 2026

  7. Troubleshooting 30 min Paid

    Resetting and Rejoining a Node with kubeadm

    Take a node out and put it back, and learn what kubeadm reset does not clean up.

    kubeadm reset

    Updated 21 Aug 2026

Cluster Architecture and Configuration11 guides

RBAC, Helm, operators, HA control planes, upgrades, etcd backup and certificates.

  1. Concepts 30 min Paid

    Static Pods

    Run a Pod the scheduler never sees, and learn why you cannot delete it with kubectl.

    /etc/kubernetes/manifests

    Updated 21 Aug 2026

  2. Hands-on Lab 40 min Paid

    RBAC Roles and Bindings

    Answer permission questions without trial and error, using one verb-and-resource model.

    kubectl auth can-i

    RBAC Updated 21 Aug 2026

  3. Hands-on Lab 20 min Paid

    Creating a User with a CertificateSigningRequest

    Make a user from scratch with openssl and an approval - then watch the certificate get Forbidden.

    kubectl certificate approve

    RBAC Updated 22 Aug 2026

  4. Hands-on Lab 35 min Paid

    Namespaces, ResourceQuotas and LimitRanges

    Learn why a quota rejects at create time and a LimitRange rewrites your Pod instead.

    kubectl describe quota

    Updated 21 Aug 2026

  5. Hands-on Lab 40 min Paid

    Helm Basics

    Understand why Helm silently reverts a hand-edit, and how rollback knows what to restore.

    helm rollback

    Updated 21 Aug 2026

  6. Hands-on Lab 35 min Paid

    Kustomize Basics

    Get config changes to actually roll your Pods, with no templating language.

    configMapGenerator

    Updated 21 Aug 2026

  7. Hands-on Lab 35 min Paid

    Custom Resources and Operators

    Add a real Kubernetes resource with validation and RBAC, and see what a CRD alone does not do.

    kubectl apply -f crd.yaml

    Updated 21 Aug 2026

  8. Hands-on Lab 75 min Paid

    Highly Available Control Planes and etcd Quorum

    Build a three-member control plane, then lose quorum and read the error it actually produces.

    etcdctl endpoint health

    etcd Updated 21 Aug 2026

  9. Hands-on Lab 50 min Paid

    Upgrading a Cluster with kubeadm

    Upgrade control plane then worker in the only order that works.

    kubeadm upgrade apply

    Updated 21 Aug 2026

  10. Configuration 16 min Paid

    Renewing Cluster Certificates

    Renew eleven certificates, then learn why the running control plane has not noticed.

    kubeadm certs renew all

    Updated 22 Aug 2026

  11. Hands-on Lab 55 min Paid

    etcd Backup and Restore

    Snapshot, create something after it, restore, and watch that thing cease to exist.

    etcdctl snapshot save

    etcd Updated 21 Aug 2026

Workloads9 guides

The controllers that keep Pods running and roll them forward.

  1. Hands-on Lab 25 min Paid

    ReplicaSets

    Follow the ownership chain from Deployment to ReplicaSet to Pod, and see who recreates what.

    kubectl get rs -o wide

    Updated 21 Aug 2026

  2. Hands-on Lab 35 min Paid

    Deployment Rollouts and Rollbacks

    Roll an image forward and back, and read what a revision actually stores.

    kubectl rollout undo

    Updated 21 Aug 2026

  3. Hands-on Lab 30 min Paid

    Rolling Update Strategy: maxSurge and maxUnavailable

    See READY exceed the replica count, and learn which knob causes which behaviour.

    maxSurge / maxUnavailable

    Updated 21 Aug 2026

  4. Hands-on Lab 40 min Paid

    StatefulSets: Stable Identity and Ordered Startup

    Get Pods that keep their name, their volume and their start order.

    web-0, web-1, web-2

    Storage Updated 21 Aug 2026

  5. Hands-on Lab 25 min Paid

    DaemonSets

    Run exactly one Pod per node with no replica count, and watch a new node get one.

    kubectl get ds

    Updated 21 Aug 2026

  6. Hands-on Lab 30 min Paid

    Jobs and CronJobs

    Use the one controller that wants its Pods to stop, with parallelism and a schedule.

    completions: 4

    Updated 21 Aug 2026

  7. Hands-on Lab 25 min Paid

    Init Containers and Startup Order

    Run setup that must complete before your app starts, one container at a time.

    initContainers:

    Updated 21 Aug 2026

  8. Concepts 14 min Paid

    Sidecar Containers

    Add a log shipper that starts first, shuts down last, and does not keep a Job alive.

    restartPolicy: Always

    Updated 22 Aug 2026

  9. Hands-on Lab 35 min Paid

    HorizontalPodAutoscaler

    Put real load on a Deployment and watch it scale - and learn why the target needs a request.

    cpu: <unknown>/60%

    Updated 21 Aug 2026

Configuration and Secrets5 guides

Feeding config, secrets, limits and probes into a Pod.

  1. Hands-on Lab 35 min Paid

    ConfigMaps and Secrets

    Learn which of the four picks up a ConfigMap change without a restart, and which does not.

    envFrom vs volumeMount

    Updated 21 Aug 2026

  2. Hands-on Lab 30 min Paid

    Resource Requests, Limits and QoS Classes

    Understand what the scheduler reserves versus what the kernel enforces, and which gets evicted first.

    Guaranteed / Burstable

    Updated 21 Aug 2026

  3. Hands-on Lab 35 min Paid

    Probes and Pod Lifecycle

    Tell three similar-looking probes apart: one gates traffic, one restarts, one buys time.

    readinessProbe

    Updated 21 Aug 2026

  4. Hands-on Lab 30 min Paid

    securityContext and Non-Root Containers

    Stop containers running as root, drop every capability, and make the filesystem read-only.

    runAsNonRoot: true

    Security Updated 21 Aug 2026

  5. Hands-on Lab 30 min Paid

    The Downward API

    Inject a Pod's own name, node and IP - and find what a 50m request reports as.

    fieldRef: status.podIP

    Updated 21 Aug 2026

Scheduling and Placement7 guides

Deciding which node runs what, and proving it landed there.

  1. Hands-on Lab 25 min Paid

    Labels, Selectors and nodeSelector

    Learn the only mechanism by which anything in Kubernetes finds anything else.

    nodeSelector: disk=ssd

    Updated 21 Aug 2026

  2. Hands-on Lab 30 min Paid

    Node Affinity: Required and Preferred

    Get a soft placement rule that prefers a node instead of demanding one.

    preferredDuringScheduling

    Updated 21 Aug 2026

  3. Hands-on Lab 30 min Paid

    Taints and Tolerations

    Learn why a node's taint beats a Pod's nodeSelector, every time.

    kubectl taint nodes

    Updated 21 Aug 2026

  4. Hands-on Lab 35 min Paid

    Topology Spread Constraints

    Find why nine replicas with maxSkew 1 leave six Pending - the tainted control plane counts.

    maxSkew: 1

    Updated 21 Aug 2026

  5. Hands-on Lab 30 min Paid

    PriorityClasses and Preemption

    Watch the scheduler delete a running Pod to fit a more important one.

    priorityClassName

    Updated 21 Aug 2026

  6. Hands-on Lab 16 min Paid

    Draining a Node for Maintenance

    Empty a node for maintenance - and learn what each of the three refusals is protecting.

    --ignore-daemonsets --force

    Updated 22 Aug 2026

  7. Troubleshooting 15 min Paid

    PodDisruptionBudgets and Node Drain

    Fix a drain that retries forever, and learn why one replica with minAvailable 1 never drains.

    ALLOWED DISRUPTIONS 0

    Updated 22 Aug 2026

Services and Networking19 guides

How traffic reaches a Pod, and how you stop it reaching one.

  1. Hands-on Lab 30 min Paid

    The Kubernetes Network Model

    Stop confusing the three address ranges that cause most Kubernetes networking problems.

    pod / service / node CIDR

    Updated 21 Aug 2026

  2. Hands-on Lab 35 min Paid

    Services: ClusterIP, NodePort and LoadBalancer

    Learn why you cannot ping a ClusterIP, and how the three types stack on each other.

    kubectl expose

    Updated 21 Aug 2026

  3. Hands-on Lab 30 min Paid

    Endpoints and EndpointSlices

    See the real answer behind a Service selector, and watch it change as you scale.

    kubectl get endpointslices

    Updated 21 Aug 2026

  4. Hands-on Lab 15 min Paid

    EndpointSlices in Detail

    A failing backend stays in the slice marked ready=false, and disappears from Endpoints entirely - which is the whole reason for the redesign.

    conditions.ready

    Endpoints Updated 26 Aug 2026

  5. Hands-on Lab 14 min Paid

    Service Session Affinity

    Ten requests to one backend instead of three - and one NAT gateway away from pinning every user in the building to the same Pod.

    sessionAffinity: ClientIP

    Balancing Updated 26 Aug 2026

  6. Hands-on Lab 16 min Paid

    Headless and ExternalName Services

    Three Services over the same two Pods, and only two of them carry any traffic.

    clusterIP: None

    Service DNS Updated 26 Aug 2026

  7. Hands-on Lab 17 min Paid

    Service Traffic Policies and Source IP

    Two fields decide whether the backend sees your address or a node's, and whether every node answers at all.

    externalTrafficPolicy: Local

    Routing Updated 26 Aug 2026

  8. Hands-on Lab 40 min Paid

    kube-proxy: iptables and IPVS Modes

    Trace one Service through three iptables chains to the DNAT rule that rewrites the packet.

    iptables -t nat -L KUBE-SERVICES

    Updated 21 Aug 2026

  9. Hands-on Lab 35 min Paid

    CoreDNS and Service Discovery

    Measure what a short name really costs, and get a headless Service to return every Pod IP.

    ndots:5

    DNS Updated 21 Aug 2026

  10. Hands-on Lab 17 min Paid

    Pod DNS Policy and dnsConfig

    A hostNetwork Pod says ClusterFirst and cannot resolve a single Service, and lowering ndots quietly breaks service.namespace.

    ClusterFirstWithHostNet

    Resolution Updated 26 Aug 2026

  11. Hands-on Lab 15 min Paid

    hostPort and hostNetwork

    A port on the node is a scheduling constraint, and it caps a Deployment at one Pod per node without saying so.

    didn't have free ports

    Node ports Updated 26 Aug 2026

  12. Hands-on Lab 30 min Paid

    Ingress Controllers

    Install a controller on bare metal and see what the Ingress object was waiting for.

    ingress-nginx

    Updated 21 Aug 2026

  13. Hands-on Lab 35 min Paid

    Ingress Routing Rules

    Fix the path-based Ingress whose 404 comes from your app, not the controller.

    rewrite-target

    Updated 21 Aug 2026

  14. Hands-on Lab 30 min Paid

    TLS for Ingress

    Serve HTTPS in four lines, then handle the 308 it starts issuing on every HTTP request.

    ssl-redirect

    Security Updated 21 Aug 2026

  15. Hands-on Lab 45 min Paid

    Gateway API

    Split traffic by weight and match on headers, with three objects owned by three roles.

    HTTPRoute weight: 90

    Updated 21 Aug 2026

  16. Hands-on Lab 35 min Paid

    NetworkPolicy Default Deny

    Prove an empty cluster lets everything talk, then close it with four lines.

    podSelector: {}

    Security Updated 21 Aug 2026

  17. Hands-on Lab 40 min Paid

    NetworkPolicy Patterns

    Fix the Pod that loses name resolution the moment you restrict egress.

    allow egress to kube-dns

    DNS Updated 21 Aug 2026

  18. Hands-on Lab 40 min Paid

    LoadBalancer Services on Bare Metal with MetalLB

    Give a bare-metal cluster the thing that actually answers a LoadBalancer Service.

    EXTERNAL-IP <pending>

    Updated 21 Aug 2026

  19. Hands-on Lab 40 min Paid

    Calico Internals and Policy Enforcement

    See the veth, the host route and the iptables chain behind one Pod's networking.

    calicoctl / Felix

    Updated 21 Aug 2026

Storage10 guides

Making data outlive the Pod that wrote it, and getting it back.

  1. Hands-on Lab 30 min Paid

    Volumes: emptyDir and hostPath

    Learn which volume survives a deleted Pod, and why hostPath is read as a security problem.

    emptyDir: {}

    Updated 21 Aug 2026

  2. Hands-on Lab 16 min Paid

    Volume subPath and Mounted File Permissions

    Mounting a ConfigMap over a directory deletes everything the image put there, and the fix costs you live updates.

    subPath

    Mounting Updated 26 Aug 2026

  3. Hands-on Lab 30 min Paid

    PersistentVolumes and PersistentVolumeClaims

    Find out why a 5Gi claim waits forever while a 500Mi claim takes your 1Gi volume.

    kubectl get pv,pvc

    Updated 21 Aug 2026

  4. Hands-on Lab 30 min Paid

    StorageClasses and Dynamic Provisioning

    Learn why a claim deliberately waits for a Pod before its volume is created.

    WaitForFirstConsumer

    Updated 21 Aug 2026

  5. Hands-on Lab 16 min Paid

    Expanding a PersistentVolumeClaim

    spec and status disagreeing is the resize, and the condition tells you it is waiting for you.

    FileSystemResizePending

    Resizing Updated 26 Aug 2026

  6. Hands-on Lab 35 min Paid

    Access Modes and Reclaim Policies

    Choose between Delete and Retain before you find out the hard way.

    persistentVolumeReclaimPolicy

    Updated 21 Aug 2026

  7. Hands-on Lab 17 min Paid

    Reclaim Policies and Recovering a Released Volume

    Released is not Available and not gone, and the field still pointing at a deleted claim is what keeps your data safe.

    status=Released

    Reclaim Updated 26 Aug 2026

  8. Hands-on Lab 40 min Paid

    CSI Drivers

    Understand why Kubernetes has no storage code of its own, and what a driver actually installs.

    kubectl get csidrivers

    Updated 21 Aug 2026

  9. Hands-on Lab 35 min Paid

    Storage for StatefulSets: volumeClaimTemplates

    Give every replica its own claim, and learn why scaling down does not delete it.

    volumeClaimTemplates

    Updated 21 Aug 2026

  10. Hands-on Lab 35 min Paid

    Volume Snapshots

    Restore from a snapshot with three objects shaped like PVC, PV and StorageClass.

    VolumeSnapshotClass

    Updated 21 Aug 2026

Troubleshooting29 guides

The largest domain on the CKA. One guide per failure, symptom to fix.

  1. Hands-on Lab 30 min

    Cluster Triage Order

    Get an order to work through under pressure, instead of guessing which command to try.

    nodes -> pods -> events

    Debugging Updated 21 Aug 2026

  2. Hands-on Lab 30 min

    Events, describe and Object Status

    Learn the three places almost every failure explains itself, and read them in order.

    --sort-by=.lastTimestamp

    Debugging Updated 21 Aug 2026

  3. Hands-on Lab 25 min

    Container Logs with kubectl logs

    Turn a firehose into an answer: pick a container, follow, bound by time, read the dead one.

    kubectl logs --previous

    Updated 21 Aug 2026

  4. Hands-on Lab 35 min

    kubectl debug and Ephemeral Containers

    Debug a distroless container that refuses every exec.

    kubectl debug --target

    Updated 21 Aug 2026

  5. Hands-on Lab 30 min

    Metrics Server and Resource Pressure

    Learn why one node reads 1% in top and 5% in describe, and which number the scheduler uses.

    kubectl top node

    Updated 21 Aug 2026

  6. Hands-on Lab 25 min

    Troubleshooting Pod Pending

    Read the per-node tally the scheduler prints and almost nobody looks at.

    0/4 nodes are available

    Scheduling Updated 21 Aug 2026

  7. Hands-on Lab 16 min Paid

    Troubleshooting Pod ContainerCreating

    The status column separates a scheduler problem from a kubelet one, and the phase field will not.

    MountVolume.SetUp failed

    Mounting Updated 26 Aug 2026

  8. Hands-on Lab 18 min Paid

    Troubleshooting Pod Terminating

    Two fields explain every stuck delete, and the symptom changes after thirty seconds in a way almost nobody expects.

    deletionTimestamp + finalizers

    Deleting Updated 26 Aug 2026

  9. Hands-on Lab 16 min Paid

    Troubleshooting a Namespace Stuck Terminating

    The status conditions can all say everything was removed while the namespace sits there, and the safe fix is never the one people reach for.

    NamespaceFinalizersRemaining

    Deleting Updated 26 Aug 2026

  10. Hands-on Lab 15 min Paid

    Troubleshooting Init Container Failures

    The logs you want belong to a container kubectl logs will not give you by default.

    Init:CrashLoopBackOff

    Initializing Updated 26 Aug 2026

  11. Hands-on Lab 15 min Paid

    Troubleshooting Failed Jobs

    backoffLimit 2 means three attempts, and restartPolicy decides whether you can still read the logs of the first two.

    BackoffLimitExceeded

    Batch Updated 26 Aug 2026

  12. Hands-on Lab 16 min Paid

    Troubleshooting a Stalled Rollout

    ProgressDeadlineExceeded and Available=True at the same time is the whole diagnosis - and nothing rolls back on its own.

    ProgressDeadlineExceeded

    Rollout Updated 26 Aug 2026

  13. Hands-on Lab 18 min Paid

    Troubleshooting a Stuck StatefulSet

    Rolling back fixes the spec and leaves the broken Pod exactly where it was.

    currentRevision != updateRevision

    Ordered Updated 26 Aug 2026

  14. Hands-on Lab 15 min Paid

    Readiness Failures and Service Endpoints

    The same probe on the other field is the difference between losing traffic and losing the container.

    0/1 Running, restarts=0

    Readiness Updated 26 Aug 2026

  15. Hands-on Lab 25 min

    Troubleshooting ImagePullBackOff

    Tell a missing tag from an unreachable registry, when the status looks identical.

    ErrImagePull

    Updated 21 Aug 2026

  16. Hands-on Lab 25 min

    Troubleshooting CrashLoopBackOff

    Catch the exit code and the logs of a container that has already restarted.

    lastState.terminated

    Updated 21 Aug 2026

  17. Hands-on Lab 25 min

    Troubleshooting OOMKilled and Exit Code 137

    Confirm the kernel killed your container, and find the limit that did it.

    exit code 137

    Updated 21 Aug 2026

  18. Hands-on Lab 30 min

    Troubleshooting Node NotReady

    Read what a stopped kubelet does to a node, and the two taints that appear on their own.

    Ready=Unknown

    Updated 21 Aug 2026

  19. Hands-on Lab 25 min

    Troubleshooting a Kubelet That Will Not Start

    Recognise a systemd restart loop that reads like progress.

    systemctl status kubelet

    Updated 21 Aug 2026

  20. Hands-on Lab 30 min

    Troubleshooting a Down Control Plane

    Diagnose a cluster when every kubectl command dies with the API server.

    crictl ps

    Debugging Updated 21 Aug 2026

  21. Hands-on Lab 30 min

    Troubleshooting Unhealthy etcd

    Recognise the symptom change when etcd stops but the API server stays up.

    context deadline exceeded

    etcd Updated 21 Aug 2026

  22. Troubleshooting 34 min

    Troubleshooting Expired Certificates

    Recover a cluster whose certificates expired, including the kubeconfig you also have to fix.

    x509: certificate has expired

    Updated 23 Aug 2026

  23. Hands-on Lab 30 min

    Troubleshooting DNS Resolution Failures

    Tell a name that does not exist from a resolver that cannot be reached - the timing gives it away.

    nslookup / dig +short

    DNS Updated 21 Aug 2026

  24. Hands-on Lab 25 min

    Troubleshooting a Service With No Endpoints

    Find the one-letter selector typo behind two Services with identical symptoms.

    endpoints: <none>

    Updated 21 Aug 2026

  25. Troubleshooting 35 min

    Troubleshooting NetworkPolicy-Blocked Traffic

    Tell a policy denial from a dead backend - one times out, the other refuses.

    connection timed out

    Updated 21 Aug 2026

  26. Troubleshooting 30 min

    Troubleshooting Ingress 404 and 502 Errors

    Use the status code to identify which hop failed: 404, 503 and 502 each name a different one.

    404 / 503 / 502

    Updated 21 Aug 2026

  27. Hands-on Lab 25 min

    Troubleshooting PVC Pending

    Tell three identical-looking Pending claims apart by their event type alone.

    ProvisioningFailed

    Storage Updated 21 Aug 2026

  28. Hands-on Lab 25 min

    Troubleshooting RBAC Forbidden Errors

    Read a Forbidden error as a specification for the Role you need to write.

    cannot list resource

    RBAC Updated 21 Aug 2026

  29. Hands-on Lab 17 min Paid

    Troubleshooting Authentication and Authorization Failures

    401, 403 and x509 send you to three completely different places, and the fourth failure has no error at all.

    401 is not 403

    Access Updated 26 Aug 2026

Command Cheat Sheets5 sheets

Searchable references for day-to-day work and exam day.

← Back to Learn