Learn
Practical setup guides, configuration walkthroughs and troubleshooting notes, each paired with the terminal output you should expect. Organised by the technology you are working with.
Latest guide
A message in the queue and why it is still therePaid
Accepting a message is not delivering it. This guide sends one message that fails permanently and one that fails temporarily, shows that only the second is queued, finds the queued file on disk, reads it with postcat, asks how long Postfix will keep trying, and deletes it - then proves local delivery never went near the relay at all.
showmount -e rhcsa-util01Export list for rhcsa-util01:/srv/nfsshare 192.168.0.0/24/srv/nfsrw 192.168.0.0/24showmount -e 192.168.0.32Export list for 192.168.0.32:/srv/nfsshare 192.168.0.0/24/srv/nfsrw 192.168.0.0/24Choose a technology and follow its path in order.
-
75 free
Kubernetes
Install and operate real clusters, then specialise by role.
- KCNAKubernetes and Cloud Native Associate Unlock
- KCSAKubernetes and Cloud Native Security Associate Unlock
- CKACertified Kubernetes Administrator Unlock
- CKADCertified Kubernetes Application Developer Unlock
- CKSCertified Kubernetes Security Specialist Unlock
-
40 free
Linux
One Red Hat path and four vendor-neutral Linux paths, built over the same fundamentals.
- LFCSLinux Foundation Certified System Administrator Unlock
- Linux+CompTIA Linux+ (XK0-006) Unlock
- LPIC-1LPIC-1: Linux Administrator Unlock
- LPIC-2LPIC-2: Linux Engineer Unlock
- RHCSARed Hat Certified System Administrator Unlock
-
Free
Containers
Build and run images, with a daemon or without one.
- DockerImages, layers, registries and Compose. Free
- PodmanDaemonless, rootless containers, pods and systemd units. Free
-
24 free
Python
Two certifications and one practical track, over the same language.
- PCEPCertified Entry-Level Python Programmer Unlock
- PCAPCertified Associate Python Programmer Unlock
- Python AutomationScripts that run unattended - files, processes, APIs and remote hosts. Unlock
-
30 free
Databases
Install, operate and troubleshoot relational and document databases on real hosts.
- MySQLInstall, secure and operate MySQL services. Unlock
- PostgreSQLRoles, databases, backups, replication and service troubleshooting. Unlock
-
9 free
Infrastructure as Code
Provision, configure and automate infrastructure with repeatable code.
Browse 45 guides
Kubernetes
Install and operate real clusters, then specialise by role.
Linux
One Red Hat path and four vendor-neutral Linux paths, built over the same fundamentals.
Containers
Build and run images, with a daemon or without one.
Python
Two certifications and one practical track, over the same language.
Databases
Install, operate and troubleshoot relational and document databases on real hosts.
Infrastructure as Code
Provision, configure and automate infrastructure with repeatable code.
- KCNAKubernetes and Cloud Native Associate Unlock
- KCSAKubernetes and Cloud Native Security Associate Unlock
- CKACertified Kubernetes Administrator Unlock
- CKADCertified Kubernetes Application Developer Unlock
- CKSCertified Kubernetes Security Specialist Unlock
- LFCSLinux Foundation Certified System Administrator Unlock
- Linux+CompTIA Linux+ (XK0-006) Unlock
- LPIC-1LPIC-1: Linux Administrator Unlock
- LPIC-2LPIC-2: Linux Engineer Unlock
- RHCSARed Hat Certified System Administrator Unlock
- DockerImages, layers, registries and Compose. Free
- PodmanDaemonless, rootless containers, pods and systemd units. Free
- PCEPCertified Entry-Level Python Programmer Unlock
- PCAPCertified Associate Python Programmer Unlock
- Python AutomationScripts that run unattended - files, processes, APIs and remote hosts. Unlock
- MySQLInstall, secure and operate MySQL services. Unlock
- PostgreSQLRoles, databases, backups, replication and service troubleshooting. Unlock
- AnsibleInventories, playbooks, roles and idempotence. Unlock
Nothing here yet.
All guides
The whole library, searchable. Use this when you already know what you are looking for.
790 guides
-
A message in the queue and why it is still therePaid
Accepting a message is not delivering it.
-
A service that will not startPaid
A unit is written, and then broken four ways on purpose: a file that is not executable, a port already in use, a working directory that does not exist, and a program that fails faster than systemd will restart it.
-
ACLs and what new files inheritPaid
Owner, group and other is three slots, and a shared directory routinely needs four.
-
Archives, cpio, dd, and the globs the shell expandsPaid
Objective 103.3 names tar, cpio and dd, and expects you to know what the shell does to a pattern before any of them run.
-
cron, timers, and one-off jobsPaid
Domain 4 names scheduled tasks.
-
Finding what is consuming the machine
Topic 200 asks you to measure resource usage and predict future needs.
-
Infrastructure as code, idempotence and driftPaid
Domain 4 asks for the vocabulary of infrastructure as code, and the words are easy to define and hard to recognise.
-
Kernel modules, devices and udev
Objective 101.1 names modprobe, lsmod, /dev, /sys and udev as things you should be able to talk about.
-
Locale, encoding, and what changes with itPaid
Objective 107.3 covers locale and character encoding.
-
Login shells and which file is readPaid
Objective 105.1 is about customising the shell environment, and the part that catches people is which file is read when.
-
LVM, from physical volume to a filesystem that grows
Domain 1 names LVM and this guide builds the whole stack: two devices into physical volumes, a volume group, a logical volume with a filesystem on it - then grows it while it is mounted, runs out of space on purpose, adds the second device, and spans the volume across both, with the data checksummed before and after.
-
Network configuration on both familiesPaid
Domain 2 covers network configuration and the two families share almost no vocabulary for it.
-
Network faults, from the client outwardsPaid
Six rungs, each with one command and one unambiguous signal: the interface, the routing decision, the neighbour, the name, the port and the protocol.
-
Packages, repositories, and proving nothing changed
Domain 1 names package management and the two families answer every question differently.
-
Password policy and account expiryPaid
Domain 3 asks about account policy, and the commands are easy while the semantics are not.
-
Permissions, ownership, and the two kinds of linkPaid
Objectives 104.5 and 104.6 cover permissions, ownership and links.
-
Ports, protocols, and the addresses to recognisePaid
Objective 109.1 is the fundamentals under everything else in topic 109: the file that maps service names to port numbers, the difference between a TCP listener and a UDP socket, the port numbers the exam expects on sight, protocol numbers, and the IPv6 addresses that exist on every interface whether or not anyone configured them.
-
Publishing a service and the three ways a client failsPaid
A service can be running, its port open in the firewall, and a client still get nowhere.
-
Shared libraries and what a binary needsPaid
Objective 102.3 is about the libraries a program needs and where they are found.
-
Storage faults: full, out of inodes, and busyPaid
Three storage faults are built on purpose on a 32 MB loop filesystem, so nothing on the host is at risk.
-
Swap: a file, a partition, and how eagerly it is used
Domain 1 names swap management.
-
The filters that process text streamsPaid
Objective 103.2 lists its commands by name and expects you to know what each one does.
-
The firewall on both families, and what survives a reloadPaid
Domain 3 names firewalls and the two families ship different ones in opposite states.
-
The SSH server and what blocks a loginPaid
Domain 2 names secure remote access, and the question that actually comes up is why a good key is refused.
-
A backup you have actually restoredPaid
Topic 206 asks for backup operations and for notifying users.
-
A Containerfile, an image, and what it runs asPaid
Containers appear in 46 questions of the XK0-006 pool and Kubernetes in 4, so Domain 4's container content is images and how you run them.
-
A disk, a filesystem, and a mount that survives a reboot
Domain 1 is 23% of XK0-006 and most of it is storage.
-
Bash, Git, and rootless containers in one workflowPaid
Domain 4 is 17% of XK0-006 and over half of it is shell scripting.
-
A service, an account, and the permission between themPaid
Domain 2 pairs services with accounts, and this guide treats them as one subject.
-
Accounts, sudo, and what a login readsPaid
Domain 2 is 20% of XK0-006 and half of it is accounts.
-
Faults, and the order that finds themPaid
Domain 5 is 22% of XK0-006 and it is a method rather than a topic.
-
Keys, certificates, and what the server allowsPaid
Domain 3 names keys and certificates alongside mandatory access control.
-
Memory, permissions, and what the machine complains aboutPaid
Domain 5 names memory and permission faults alongside storage, CPU and network.
-
Ninety questions, and where the marks arePaid
XK0-006 is 90 questions in 90 minutes, scored 100-900 with 720 to pass.
-
Processes, boot, and what systemd started
Domain 1 is 23% of XK0-006 and storage is only half of it.
-
SELinux and AppArmor, side by sidePaid
Domain 3 is 18% of XK0-006 and the pool names SELinux in 35 questions to AppArmor's 4.
-
Variables, scope and exit statusPaid
Objective 105 is shell customisation and scripting, and two ideas carry most of it: a script runs in a child process unless you source it, and the only thing a caller learns is the exit status.
-
Virtual interfaces, bridges and MTUPaid
Objective 205.1 covers advanced network configuration, and the parts that are hard to picture are easiest to learn by building them.
-
Watching the wire, and telling the usersPaid
Objective 205.3 is network troubleshooting and 205.4 is notifying users.
-
What a performance exam rewardsPaid
LFCS gives you a live system and a list of tasks, and grades the state the machine ends in.
-
What is listening, and what is connectedPaid
Before you can firewall a port or debug a service you have to know what is on it. `ss` answers that, and its flags are terse enough that most people memorise one invocation and stop.
-
LFCS exam format and lab strategy
LFCS is a two-hour performance-based exam: you are given tasks on a live system and graded on the end state, not on how you reached it.
-
LPIC-1 exam format and topic weights
LPIC-1 is two separate exams, 101-500 and 102-500, both required and each scored on its own.
-
LPIC-2 exam format and topic weights
LPIC-2 is 201-450 and 202-450, both required, each 60 questions in 90 minutes and scored 200-800 with 500 to pass. 201 is the machine - kernel, storage, capacity, startup. 202 is the services you install and configure.
-
Firewalls, SELinux, and service reachability
Most of the time lost configuring a service on the RPM family is not spent on the service.
-
When a filesystem fills, or refusesPaid
`No space left on device` has three quite different causes, and only one of them is solved by deleting files.
-
When the network does not workPaid
Not a made-up scenario: `ssh lfcs-b01` genuinely fails on this host, and this guide works out why in five commands.
-
Why fstab uses UUIDs, and checking a filesystemPaid
A `/dev/sd?` name is assigned in the order the kernel finds the disks, which changes when hardware is added.
-
Writing a unit, and what ordering meansPaid
Writing a unit is a task you will be given, and the marks are in the parts that are not the ExecStart line: the environment your script gets, whether a failure is recorded, and the difference between needing another unit and running after it.
-
SSH hardening, and who has been tryingPaid
SSH is the one service on every machine, which makes it the one worth hardening properly.
-
SSH posture, limits, and encrypting a filePaid
Objectives 110.2 and 110.3 cover host hardening and encryption.
-
Streams, pipes and redirectionPaid
Topic 103 is weight 23, the largest on either paper, and this is its foundation.
-
sudo, and what it actually grantsPaid
Granting one command is a task you will be given, and the trap is that a narrow rule is often not narrow at all.
-
SUID, sudo, and who can do whatPaid
Objective 110.1 asks you to find files with the SUID bit set and to explain what sudo grants.
-
Swap files, partitions and swappinessPaid
Swap is the part of storage that is not a filesystem, and adding some is a common exam task because it touches allocation, permissions, fstab and sysctl at once.
-
sysctl, and what survives a rebootPaid
Kernel tunables can be read and written two ways - through `/proc/sys` as files, or through `sysctl` as dotted names - and they are the same values.
-
systemd units, services and targetsPaid
`systemctl` is the same program on both distributions and it is a quarter of the exam's biggest domain.
-
tar and the archives you will be asked for
"Archive this directory and compress it" is a task you will be given, and the marks are in the details: which letter creates and which extracts, where the paths inside the archive come from, and whether the thing you extract lands where you meant.
-
Targets, runlevels, and what the kernel found
Objective 101.3 is runlevels and boot targets, and on a current machine the honest answer is that runlevels are a compatibility layer over systemd targets.
-
Tests, loops, and the options that catch mistakesPaid
Most scripting marks are lost on the test command, not on loops.
-
Ubuntu and AlmaLinux differences that matter
LFCS lets you choose the distribution at the start of the exam, which means the syllabus is really two syllabuses that overlap.
-
The firewall, on both familiesPaid
Two distributions, two firewall front ends, one kernel underneath.
-
The graphical stack that is not installedPaid
Topic 106 is weight 4, the smallest on either paper, and this guide is proportionate to that.
-
The initramfs, the bootloader, and the rescue targetsPaid
Topic 202 is weight 9 and covers recovery, the initramfs and bootloaders.
-
The journal, and what it keepsPaid
The journal is a structured, indexed log with fields you can select on - which makes `journalctl | grep` the slow, lossy way to use it.
-
The lab: one disk, and a client that proves things
Two practical facts every later page depends on.
-
LPIC-1 lab: Debian and RPM package families
Objectives 102.4 and 102.5 examine Debian and RPM package management separately, and both appear on the 101 paper.
-
LFCS lab: Ubuntu, AlmaLinux, and safe storage practice
Two Ubuntu hosts and one RHEL host, because LFCS is sat on either family and the candidate chooses.
-
The sixty-question mockPaid
The mock is 60 questions drawn from a 1298-question pool, weighted to the five published domains.
-
The ssh server and its configurationPaid
sshd is the service you are connected over, which makes changing it uniquely risky.
-
Time synchronisation and the system clockPaid
Objective 108.1 is time, and it is worth more attention than it usually gets: a clock that is wrong breaks TLS, Kerberos, cron and every log correlation you will ever attempt.
-
Two papers, and where the marks actually arePaid
LPIC-2 is two exams of 60 questions each, and both are required.
-
Two virtual hosts, TLS, and a reverse proxyPaid
Topic 208 is weight 11 and names virtual hosts, TLS and reverse proxying.
-
Users, accounts and what useradd doesPaid
Creating an account is one command; knowing what it did is the examinable part.
-
Load, memory, and what the numbers mean
Topic 200 is capacity planning, and almost all of it is interpretation rather than commands.
-
Logging in, and what a session is
Domain 1 opens with logging in locally and remotely, which sounds like the easiest thing on the syllabus until you try to answer "who logged in yesterday" on a current Ubuntu. `last` is not installed, `/var/run/utmp` does not exist, and `who` prints nothing.
-
Logging, priorities and rotationPaid
Objective 108.2 covers system logging, and on a current machine that means two systems running side by side - the journal and rsyslog.
-
LVM, from physical volume to logicalPaid
LVM puts a layer between disks and filesystems so that neither has to match the other.
-
Building LVM on a real diskPaid
The whole LVM stack on a genuinely spare 5 GB disk: physical volume, volume group, logical volume, filesystem, mount.
-
Mail transport, aliases and printingPaid
Objectives 108.3 and 108.4 are mail transfer agent basics and printing.
-
mdadm RAID, and a failure that heals itselfPaid
RAID is only interesting when something breaks, so this guide builds a RAID 1 mirror with a hot spare and then deliberately fails a member to watch the array recover on its own.
-
Mounting filesystems and making them survive rebootPaid
A filesystem that is not mounted does nothing, and an fstab line that is wrong can stop a machine booting.
-
Name resolution, and diagnosing in the right orderPaid
Objective 109.4 is client-side DNS and 109.3 is basic troubleshooting, and they belong together: most "the network is down" reports are name resolution.
-
Name resolution, end to endPaid
Half of all "the network is down" reports are name resolution, and the tools people reach for answer different questions.
-
Packages, on both familiesPaid
The package manager is where Debian and Red Hat diverge most, and the exam may put you in front of either.
-
Partitions, filesystems and fstabPaid
Topic 104 is weight 15 and this is the spine of it: partition a real disk, put a filesystem on it, mount it by hand, then write the fstab line that mounts it at boot.
-
Partitions on a device you madePaid
Storage is a fifth of the exam and every task begins with a block device.
-
Passwords, ageing and locked accountsPaid
Account expiry and password ageing are two different things stored in two different fields, and `passwd -S` reports a state that does not mean what it looks like.
-
Permissions, ownership and the bits above them
Nine bits, three more above them, and an ACL layer on top.
-
Pipes, filters and redirection
Three streams, a handful of operators, and two traps that catch everybody: the order of `2>&1` relative to `>`, and a pipeline that reports success because only the last command's status survives.
-
Processes, signals and job controlPaid
Objectives 103.5 and 103.6 cover process management and signals, and both are asked with exact commands.
-
Processes, signals and what is using the CPUPaid
Finding the process, understanding what state it is in, and stopping it without breaking anything else. `ps` has two completely different option styles that produce the same processes, `kill` sends a signal rather than killing, and `nice` numbers run backwards from priority.
-
Reading a DNS answer: NXDOMAIN and REFUSEDPaid
`dig +short` returning nothing looks the same whether the name does not exist, the server refuses to answer, or the server is not there.
-
Regular expressions and the text toolsPaid
Objective 103.7 examines regular expressions by name, and 103.2 the filters that use them.
-
Repositories, and verifying what is installedPaid
A package manager is only as good as the sources it reads, and only useful if you can tell whether what it installed is still what is on disk.
-
Repositories, and where packages come fromPaid
A package manager can only install what a repository offers, and most package failures are really repository failures.
-
Routes, and where a packet goesPaid
Reading a routing table is the skill that separates guessing from diagnosing.
-
Sitting two papers, and what to practisePaid
LPIC-1 is two exams booked separately, each 60 questions in 90 minutes and scored 200-800 with 500 to pass.
-
Apache on Debian and RPM familiesPaid
Topic 208 is web services, and this guide installs Apache on both families to show how much differs around identical software: one distribution starts it and the other does not, the configuration lives in different directories, and only one of them is reachable from the client until a firewall rule is added.
-
Accounts, groups and password ageingPaid
Objective 107.1 is about the files, not the wrapper commands.
-
Addresses, links, and where the configuration livesPaid
Networking is a quarter of the LFCS exam and it starts here: reading the addresses a machine has, then finding the file that will still say so after a reboot.
-
Addresses, routes and what the mask decidesPaid
Topic 109 is weight 14, the largest on the 102 paper.
-
An encrypted volume, and what the header holdsPaid
Objective 203.3 names encrypted filesystems and the path had nothing on them.
-
An MTA that accepts, and one that refusesPaid
Objective 211.1 is running an MTA.
-
An NFS export, proved from two clientsPaid
Objective 209.1 is NFS.
-
Boot, firmware, and what the kernel was told
Objectives 101.1 and 101.2 cover firmware, the boot sequence and the bootloader.
-
Boot order, and what actually delayed itPaid
Topic 202 is system startup, and its most useful skill is reading a boot the way systemd measures it.
-
Boot targets, and a system that will not bootPaid
The tasks that end an exam attempt are the ones that stop a machine booting, and almost all of them are a bad `/etc/fstab` line.
-
Building from source, and what it leaves behindPaid
Objective 206.1 is building and installing programs from source.
-
Client-side resolution, and the directory that is not therePaid
Objectives 210.2 and 210.3 are PAM and LDAP clients, and both depend on one file most people never read: nsswitch.conf.
-
Scheduling jobs with cron and systemd timersPaid
Objective 107.2 names both cron and systemd timers, and on a current distribution the maintenance jobs have largely moved to timers.
-
DHCP, and when not to start a servicePaid
Objective 210.1 is DHCP configuration.
-
dpkg and rpm, the low-level toolsPaid
Objectives 102.4 and 102.5 examine Debian and RPM package management separately.
-
ext4, xfs, and choosing between themPaid
Both distributions offer both filesystems and each family defaults to a different one, so a task may name either.
-
Files, directories and where things live
The commands in this guide are the ones you will type most and get wrong least - until a filename has a space in it, or a `cp -r` puts a directory somewhere you did not expect.
-
find, locate and the two kinds of link
`find` is the tool the exam reaches for whenever a task says "all files that...", and its two `-exec` forms behave differently enough to matter.
-
Finding your way on an unfamiliar machine
Before any objective, there is the skill of working out what a machine will actually do.
-
Firewall zones, and what a scan revealsPaid
Topic 212 is weight 14, the largest on the 202 paper, and packet filtering is most of it.
-
grep, sed and the text you have to change
Most of what an administrator does to text is find a line, count some lines, or change a string in a file. `grep`, `sed` and `awk` cover all three, and the mistake that costs marks is not syntax - it is using the wrong field number, which produces a confident wrong answer rather than an error.
-
Groups and shared directoriesPaid
Group membership is examined constantly, and the mistake that costs marks is one missing letter: `usermod -G` replaces the supplementary group list while `-aG` adds to it.
-
Growing a filesystem without losing itPaid
This is the most dangerous sequence in the Storage domain, and the whole of it is one rule about order.
-
Hostnames, and the three of themPaid
A hostname looks like the simplest thing on a Linux system and is not: there are three of them, two files involved, and a difference between changing it now and changing it permanently.
-
Kernel modules, and proving a parameter arrivedPaid
Topic 201 is one of the largest areas on the 201 paper.
-
A DNS zone, proved from a clientPaid
DNS is one of the largest areas on the 202 paper.
-
Samba shares, users, and client accessPaid
Objective 209 names Samba alongside NFS, and Samba is the half with a separate password database.
-
Ansible archive and unarchive ModulesPaid
`unarchive` is built in; `archive` is not - it lives in `community.general`, which is the kind of asymmetry that costs marks.
-
Ansible Development Containers with ansible-navigatorPaid
EX294 expects you to run playbooks from a development container.
-
Ansible Playbooks in GitPaid
add, commit, push is three commands.
-
Ansible Git Repository CloningPaid
EX294 expects you to clone a repository and work in it.
-
ansible-navigator.yml ConfigurationPaid
`ansible-navigator.yml` is to navigator what `ansible.cfg` is to ansible-playbook, and it has the same three-layer precedence: file, environment variable, command line. `settings --effective` prints the result, which is the only reliable way to answer "where did that value come from".
-
PostgreSQL psql Client
psql's backslash meta-commands are a second language beside SQL - `\l`, `\du`, `\dt`, `\conninfo` - and `pg_settings` is how you read the server's configuration as a table rather than a file.
-
PostgreSQL Reload, Restart and pending_restartPaid
Change `shared_buffers`, reload, and the value does not move - but `pending_restart` flips to `t`.
-
PostgreSQL Replication PrerequisitesPaid
Four things before a standby exists: the right `wal_level` (already the default), a role with REPLICATION, a pg_hba rule for the special `replication` database, and a slot so the primary keeps the WAL the standby will need.
-
PostgreSQL Replication Slots and WAL RetentionPaid
A slot guarantees a standby can always catch up.
-
PostgreSQL Database RestorePaid
The database is dropped for real - which first requires evicting every connection - and rebuilt from the dump.
-
PostgreSQL Roles and AttributesPaid
PostgreSQL has one object where other databases have two: a role is a user when it can log in and a group when it cannot.
-
PostgreSQL Roles and Peer Authentication
Create a role with your own name and the connection that failed a moment ago succeeds with no password at all. `pg_hba.conf` explains why - and why the same role needs a password over TCP.
-
PostgreSQL Server Log ConfigurationPaid
`logging_collector` is off, `pg_current_logfile()` returns NULL, and there is still a log file.
-
PostgreSQL Startup Failure Diagnosis
Three failures that all look identical to systemd, and three different places the real reason turns up - one of which is not the PostgreSQL log at all.
-
PostgreSQL Settings and ContextsPaid
`pg_settings.context` answers the question every configuration change starts with: does this need a restart, a reload, or nothing at all.
-
PostgreSQL Statistics ViewsPaid
Cache hit ratio, sequential scans, dead tuples and unused indexes - and a reset that left the table reporting zero rows while holding four hundred thousand.
-
PostgreSQL Tables and Data Types
Seven columns, each a deliberate choice: identity rather than serial, text rather than varchar(n), numeric for money, timestamptz for time, and native array and jsonb types that MySQL has no equivalent for.
-
PostgreSQL Timestamps and Time Zones
The same instant stored in both timestamp types, then read in a different session timezone.
-
PostgreSQL Transaction ID Wraparound
The failure that takes a database offline to protect it.
-
PostgreSQL VACUUM and Table BloatPaid
An UPDATE of 133,333 rows leaves 133,333 dead tuples. `VACUUM` clears them and the table stays at exactly 47 MB.
-
PostgreSQL WAL Archiving and Recovery ReadinessPaid
A base backup restores last night.
-
PostgreSQL WAL Growth and Archive Failures
A broken `archive_command` fills `pg_wal` while every query keeps working.
-
PostgreSQL work_mem and Sort SpillPaid
A sort spills to disk at the default `work_mem`.
-
PostgreSQL Configuration PrecedencePaid
`pg_settings.source` names where every live value came from - default, configuration file, or a session override.
-
PostgreSQL Connection Limits and PgBouncerPaid
Fill every slot and read the error PostgreSQL actually gives - it is not the one everybody quotes.
-
PostgreSQL Connection Failure Diagnosis
Six ways a connection fails and the six different messages they produce - including the two that look like authentication problems and are not.
-
PostgreSQL Constraints and Error Messages
Four inserts that fail, and the point is not that they fail but how much the server tells you: the constraint by name, the failing value, the entire failing row, and a HINT naming the syntax that would have worked.
-
PostgreSQL Crash Recovery and Data Checksums
`kill -9` the whole cluster with a transaction open, then read what recovery did.
-
PostgreSQL Streaming Standby CreationPaid
One `pg_basebackup -R` builds the standby, writes its connection settings and drops a `standby.signal` file.
-
PostgreSQL Custom Format Dumps and Selective RestorePaid
A custom-format dump carries a table of contents, so you can restore one table out of it.
-
PostgreSQL Database, Schema and Table PrivilegesPaid
Three separate refusals before a role can read one table: CONNECT on the database, USAGE on the schema, SELECT on the table.
-
PostgreSQL Databases, Schemas and search_path
`\dt` says the database has no tables.
-
PostgreSQL Default Privileges and Role MembershipPaid
A grant covers the tables that exist when you make it, and nothing created afterwards. `ALTER DEFAULT PRIVILEGES` fixes the future; a group role fixes the past - and you usually need both.
-
PostgreSQL Query Plans with EXPLAINPaid
`EXPLAIN (ANALYZE, BUFFERS)` gives estimates, actuals and the number that matters most - how many pages were touched.
-
PostgreSQL Index Types and Index SelectionPaid
A partial index is a fifth the size and answers its query in 0.285 ms.
-
PostgreSQL UPSERT with ON CONFLICT
`INSERT ...
-
PostgreSQL Installation on Ubuntu 26.04
One apt command installs PostgreSQL 18 and starts a cluster.
-
PostgreSQL JSON and Array Columns
`jsonb` and `text[]` are real column types with real operators - containment, extraction, membership, expansion - so semi-structured data stays queryable in SQL rather than becoming a string the database cannot see into.
-
PostgreSQL Locks and Blocked QueriesPaid
`pg_blocking_pids()` names the session at fault in one column.
-
PostgreSQL Logical ReplicationPaid
Replicate one table into a writable database on another cluster.
-
PostgreSQL Replication MonitoringPaid
The primary and the standby each have their own view, and neither is complete.
-
PostgreSQL Password AuthenticationPaid
A remote client with the right password is still refused - because no pg_hba rule covers it.
-
PostgreSQL Logical Backups with pg_dumpPaid
`pg_dump` backs up one database and **not** the roles that own it - the dump contains zero `CREATE ROLE` statements.
-
PostgreSQL pg_hba.conf Rule OrderPaid
The same two rules, the same client, opposite outcomes - decided entirely by which line comes first. `pg_hba.conf` stops at the first match, and a `reject` below a permit rule does nothing at all.
-
PostgreSQL pg_stat_activity and Session ControlPaid
The first view anyone opens on a busy server - and the one that quietly lies to you.
-
PostgreSQL Query Statistics with pg_stat_statementsPaid
One extension, one restart, and every statement the server runs is aggregated by shape with call counts and timings - finding the query that takes 5 ms and runs a hundred thousand times, which no slow-query threshold ever will.
-
PostgreSQL Promotion and TimelinesPaid
`pg_promote()` turns a standby into a primary in seconds.
-
MySQL Point-in-Time RecoveryPaid
A dump restores last night.
-
MySQL Replica Write ProtectionPaid
A fresh replica is not read-only.
-
MySQL SELECT, Joins and Aggregation
One query answering a real question - how many orders each customer has and what they spent - and the two choices in it that decide whether customers with no orders appear at all.
-
MySQL Query Plans with EXPLAINPaid
`EXPLAIN` shows what the optimizer intends; `EXPLAIN ANALYZE` runs it and reports what happened.
-
MySQL Replication Failure and FailoverPaid
A local write on a replica collides with the source's next insert and replication stops with `Last_SQL_Errno: 1062`.
-
MySQL Replication PrerequisitesPaid
Three servers, three unique ids, GTID on everywhere and one account with exactly one privilege.
-
MySQL Dump RestorePaid
The database is dropped for real, the client returns `ERROR 1049`, and the dump brings back all five customers and three orders.
-
MySQL Roles and Default RolesPaid
A role is granted, the account still cannot read the schema, and `SET ROLE` in the same command does not help - because the database is selected before the role is activated. `SET DEFAULT ROLE` is the fix, and nothing in the error says so.
-
MySQL Runaway Queries and KILL
`KILL QUERY` stops the statement and leaves the connection alive; `KILL` drops the whole connection and rolls back its transaction.
-
MySQL Secure Installation and Password Validation
The four things `mysql_secure_installation` is famous for are already done on Ubuntu - the transcript shows no anonymous users, no test database and root bound to localhost.
-
MySQL Replica SeedingPaid
A replica has to start from a known point, not an empty database.
-
MySQL Server VariablesPaid
Some variables change on a running server, some need a restart, and some cannot change at all. `SET GLOBAL` tells you which is which - and a restart shows what it did not save.
-
MySQL Service Management and Startup Failures
Stopping MySQL removes its socket directory, which is why `ERROR 2002` names a file that is not there.
-
MySQL Slow Query LogPaid
Off by default, on in one statement, and the field that matters is not `Query_time` but `Rows_examined` - 400,000 rows read to return 1 is the signature of a missing index.
-
MySQL SQL Mode and Strict BehaviourPaid
`sql_mode` decides whether bad data is an error or a silent correction.
-
MySQL Replication StartupPaid
Point the replica at the source, start it, and read the five fields of `SHOW REPLICA STATUS` that actually matter.
-
MySQL Table Sizes and GrowthPaid
`information_schema` reports table sizes, and `TABLE_ROWS` is an estimate that was wrong every time it was read here.
-
MySQL Connection Limit Failures
`ERROR 1040` is almost never a sign that you need more connections.
-
MySQL Buffer Pool and Connection LimitsPaid
The two settings worth touching before any others, what they cost, and how to set them so they survive - on a 4 GB host where getting the buffer pool wrong takes the machine down rather than making it slow.
-
MySQL UPDATE and DELETE
Change a row by reading its current value in the same statement, then remove one.
-
PostgreSQL ALTER SYSTEM and postgresql.auto.confPaid
`SET` lasts one session, `ALTER SYSTEM` writes a file the server owns.
-
PostgreSQL Physical Backups with pg_basebackupPaid
A physical copy of the entire cluster taken over the replication protocol while it runs - every database, every role, ready to start as a server.
-
PostgreSQL Cascading ReplicationPaid
A standby that feeds another standby.
-
PostgreSQL Cluster and Service Management
Ubuntu wraps PostgreSQL in two layers - a systemd unit per cluster and a `postgresql` umbrella that controls none of them directly.
-
PostgreSQL Configuration FilesPaid
Three files matter and Debian puts them somewhere upstream documentation does not expect.
-
MySQL Installation on Ubuntu 26.04
One apt command installs MySQL 8.4 and starts it.
-
MySQL Binary LogPaid
Every change is written to the binary log before it reaches you.
-
MySQL Buffer Pool in PracticePaid
A 99.948% hit rate sounds excellent and means almost nothing on its own - the dataset fits in the pool, so of course it does.
-
MySQL Command-Line Client
The same query, four ways: a box-drawn table, tab-separated for scripts, one field per line, and a file piped in.
-
MySQL Column-Level PrivilegesPaid
Grant `SELECT` on three named columns and the account can read those three.
-
MySQL Configuration Files and Load OrderPaid
MySQL reads several files in a fixed order and the last one wins.
-
MySQL Crash Recovery
`kill -9` on the server, and 400,000 rows are still there afterwards.
-
MySQL User AccountsPaid
A new account can connect and can see almost nothing.
-
MySQL Data Types and Constraints
Three inserts that fail, each for a different reason and with a different error number.
-
MySQL Databases and Tables
Create a database, name its character set explicitly, then read the table back with `SHOW CREATE TABLE` - which shows every default MySQL filled in that you did not type, and is the only honest answer to what a table actually is.
-
MySQL Diagnostic Toolkit
Where to look, in what order, when something is wrong: the error log for the server, the process list for now, status variables for since-startup, and `performance_schema` for the detail underneath.
-
MySQL Foreign Keys and ALTER TABLE
A foreign key refuses in both directions - an order for a customer who does not exist, and deleting a customer who still has orders.
-
MySQL Fragmentation and OPTIMIZE TABLEPaid
A third of the rows deleted and the table is exactly as large as before - 20.5 MB either way.
-
MySQL Privileges and GRANTPaid
Grant `SELECT` on one schema and the account can read it and nothing else.
-
MySQL Health ChecksPaid
Seven counters that describe a server's health, and the two that quietly predict trouble: temporary tables spilling to disk, and joins running with no index at all.
-
MySQL Indexes, Selectivity and Skip ScanPaid
A composite index takes the query from 57.4ms to 20.7ms - a 2.8x improvement, not the 100x the articles promise.
-
MySQL Integrity and Upgrade ChecksPaid
`CHECK TABLE` verifies structure and indexes; `mysqlcheck --check-upgrade` finds what an upgrade would object to.
-
MySQL Local and Remote Connections
A connection from another host fails twice, with two different errors and two different causes: 2003 because the server is not listening, then 1130 because the account does not exist for that host.
-
MySQL Account Locking, Revocation and RemovalPaid
Locking an account is reversible and keeps its grants; dropping it is neither. `ERROR 3118` is what a locked account looks like from outside, and it is distinct from a wrong password.
-
MySQL Locks, Blocking and DeadlocksPaid
One transaction holds a row lock, another waits and dies with `ERROR 1205`.
-
MySQL Metadata Locks and Blocked DDL
An `ALTER TABLE` hangs behind a transaction that only ever ran a `SELECT`.
-
MySQL Replication Topology MonitoringPaid
`SHOW REPLICA STATUS` says replication is running.
-
MySQL Logical Backups with mysqldumpPaid
A dump is a text file of SQL statements that rebuilds the database. `--single-transaction` is the flag that makes it consistent without locking anyone out, and it is the one most people leave off.
-
MySQL Partial and Schema-Only DumpsPaid
Dump one table, or the structure with no rows at all. `--no-data` produces a file with zero INSERT statements - useful for a schema diff, and catastrophic if you thought it was your backup.
-
MySQL Persisted ConfigurationPaid
`SET PERSIST` writes to a JSON file the server owns, and that value outranks your config file.
-
A Service With Endpoints and No TrafficPaid
The Service failure that passes every check people run first.
-
Troubleshooting Authentication and Authorization FailuresPaid
Four ways a request fails to reach an object, produced deliberately one after another, so the error text tells you which layer to look at instead of sending you to RBAC every time.
-
EndpointSlices in DetailPaid
Where a Service's backend list actually lives, the three conditions each address carries, and a side-by-side comparison with the object EndpointSlices replaced.
-
Expanding a PersistentVolumeClaimPaid
Growing a volume under a running Pod.
-
Getting a Pod Past Pod Security AdmissionPaid
A namespace that refuses your Pod, read from the developer's side: what the message is asking for, where each field actually belongs, and how much of it you need at each of the three levels.
-
Headless and ExternalName ServicesPaid
The two Service types that are not proxies.
-
hostPort and hostNetworkPaid
The two ways a Pod can take a port on the node it runs on, what each does to scheduling, and why a Deployment that uses either one quietly stops scaling.
-
Troubleshooting Init Container FailuresPaid
A Pod held before its application ever starts.
-
Troubleshooting a Namespace Stuck TerminatingPaid
A namespace held open by one object inside it.
-
Pod DNS Policy and dnsConfigPaid
The file the kubelet writes into every Pod, the two settings that decide how a name is resolved, and the one combination where the spec field and the file disagree.
-
Troubleshooting Pod ContainerCreatingPaid
A Pod that is scheduled and still will not start.
-
Troubleshooting Pod TerminatingPaid
A delete that returns successfully and leaves the object behind.
-
Readiness Failures and Service EndpointsPaid
One Pod taken out of a Service without being restarted, put back without being rescheduled, and then the identical probe moved to livenessProbe so the difference is measured rather than described.
-
Reclaim Policies and Recovering a Released VolumePaid
The emergency lever for a volume you are about to delete, and the four-step recovery that gets the data back afterwards - ending with the file read out of the rebound volume.
-
Service Session AffinityPaid
What a ClusterIP does with repeated requests, what changes when you pin them, what happens when the pinned backend disappears, and the source-IP assumption that makes the whole feature fragile.
-
Service Traffic Policies and Source IPPaid
One Pod on one node, reached through every node's NodePort.
-
Service Types End to EndPaid
The three Service types on one workload, each proved from the place it is supposed to be reachable from - and an honest look at what a LoadBalancer does on a cluster that has a controller for it and on one that does not.
-
Troubleshooting a Stalled RolloutPaid
A Deployment that stops half way and keeps serving traffic while it does.
-
Troubleshooting a Stuck StatefulSetPaid
A StatefulSet update that stops at the highest ordinal and stays there.
-
Troubleshooting Failed JobsPaid
A Job that gives up, read from the object rather than guessed at - and the one field that decides whether every attempt leaves evidence behind or only the last one does.
-
Enabling Kubernetes Audit LoggingPaid
Every guide before this one changed something and nothing wrote down who did it.
-
Volume subPath and Mounted File PermissionsPaid
The two things that go wrong when configuration reaches a container as a file: a mount that hides the directory it landed on, and a permissions field that is decimal when everyone reads it as octal.
-
Assessing Cluster Detection CoveragePaid
Every guide in this domain changed something and then put it back.
-
Threat Detection Across Cluster LayersPaid
The competency asks you to detect threats across infrastructure, apps, networks, data and users.
-
Falco Runtime Detection and Resource LimitsPaid
A syscall-level detector is the only thing that sees what happens INSIDE a container.
-
Common CKS Task MistakesPaid
On a performance exam nothing tells you that you were wrong.
-
Container Immutability at RuntimePaid
The image is a starting point, not a guarantee.
-
Querying Kubernetes Audit LogsPaid
An audit log is a haystack by design.
-
Static Analysis of a DockerfilePaid
The manifest is the last place to fix a workload's security and the Dockerfile is nearly the first.
-
Static Analysis of Kubernetes ManifestsPaid
Admission control refuses a bad workload at the last possible moment.
-
The 4C Cloud Native Security Model
The 4Cs are usually four nested rings on a slide, which is why people can recite them without using them.
-
kube-apiserver Security FlagsPaid
The apiserver is the only way into the cluster, so its flags are the cluster's security posture.
-
Time Management on a Performance ExamPaid
A performance exam is two hours of tasks, and some of that time is not yours.
-
The KCSA Practice Cluster and Its Defaults
Security behaviour depends on what is installed, so this guide reads the lab off the machines rather than describing it.
-
Control Plane Static Pod ManifestsPaid
Domain 2 is about the security of each cluster component, and the first thing to understand is where they come from.
-
Kubelet API Access and PortsPaid
Every node runs an API that can list Pods, read logs and exec into containers - and it is not the apiserver.
-
Linux+ lab: Ubuntu and AlmaLinux package families
XK0-006 is family-neutral, so a question may name apt or dnf, ufw or firewalld, AppArmor or SELinux.
-
Node Authorization and NodeRestrictionPaid
A kubelet authenticates to the apiserver as `system:node:<name>` in the group `system:nodes`, and what that identity may read is decided per request rather than by a role.
-
Identifying the Phases of an AttackPaid
One compromised Pod, three phases, and then the same three phases from the defender's side.
-
The CKS Practice Clusters
This path runs on three clusters rather than one, because CKS work is meant to damage things and a cluster you are about to break should not be the one another path depends on.
-
Upgrading Kubernetes to Patch VulnerabilitiesPaid
"Upgrade Kubernetes to avoid vulnerabilities" is a competency and a task you can be handed, and it is the one place where getting the order wrong turns maintenance into an outage.
-
Verifying Kubernetes Platform Binaries
The last competency in Cluster Setup is the one people skip: check that the binary you are about to run is the one that was published.
-
Namespace Isolation for Multi-TenancyPaid
A namespace separates names and nothing else.
-
CKS Exam Format and Domain Weights
CKS is a performance exam sat on live clusters, and it is the only Kubernetes certification with a prerequisite.
-
Software Bills of Materials (SBOM)Paid
Understanding your supply chain starts with knowing what you shipped.
-
KCSA Exam Format and Domain Weights
KCSA is multiple choice - 60 questions in 90 minutes - and it wants 75%, which is the highest threshold of any exam on this site.
-
Moving from KCSA to CKS
If you have come from KCSA you already know most of the vocabulary, and that is worth less than it feels.
-
Linux+ XK0-006 domains and question style
XK0-006 is 90 questions in 90 minutes, scored on a 100-900 scale with 720 to pass, across five domains.
-
Cluster DNS and Service Discovery
A Pod reported NXDOMAIN for the apiserver and then fetched a page from it seconds later.
-
Encrypting Secrets at Rest in etcdPaid
Secrets are base64 in the API and plaintext in etcd, and turning that off means editing the apiserver.
-
etcd Security and Access ControlPaid
Every object in the cluster is a row in etcd, so etcd access is cluster access - and on a default kubeadm cluster the Secrets in it are not encrypted.
-
Auditing RBAC PermissionsPaid
Before you can minimise RBAC you have to find what is over-broad, and reading every Role by hand does not scale past about ten.
-
Hardening a Pod with securityContext
The previous page had a Pod refused for four separate violations.
-
KCSA in the Kubernetes Certification Path
This site teaches KCNA, KCSA and CKS.
-
How Linux+ differs from LFCS and RHCSA
All three are vendor-neutral-ish Linux administrator exams and the overlap is real.
-
Ingress TLS Configuration
A cluster with no ingress controller ignores every Ingress object silently, so this guide installs one, creates a certificate and a TLS Secret, wires them together and then proves the result the only way that counts - by reading the certificate off the wire.
-
Least-Privilege Identity and Access on the NodePaid
Identity and access management in this domain means the host's, not the cluster's: who can log in, what they can become, and what a shell on this machine is worth.
-
Managing Kubernetes SecretsPaid
Encryption at rest protects the datastore.
-
Restricting Node External Network AccessPaid
The node's listening ports are only a finding once you prove what answers on them.
-
Minimizing an Over-Broad RBAC RolePaid
The most likely RBAC task you will be handed is not writing a Role from nothing - it is taking one that says `*` and leaving it saying as little as possible.
-
Minimizing the Base Image FootprintPaid
The first supply-chain competency is the one with the best return: most of what a scanner finds in your image was never yours.
-
Minimizing the Host OS FootprintPaid
A Kubernetes node is a Linux box, and most of what makes it dangerous was installed before Kubernetes was.
-
Protecting Node Metadata and Endpoints
Every Pod can address the node it runs on, and on a cloud cluster it can address the metadata service that hands out credentials.
-
Pod Security Admission Levels
Pod Security Admission is the control a KCSA candidate is most likely to be asked about and least likely to have seen refuse anything.
-
Pod Security Admission: enforce, audit and warnPaid
Every namespace you create admits a privileged container and says nothing about it.
-
Pod-to-Pod Encryption with Cilium WireGuardPaid
The orientation guide flagged `Encryption: Disabled` as a task rather than a fact.
-
Restricting Kubernetes API AccessPaid
Restricting API access means three different things - who may call without a credential, what they get if they do, and who can reach the endpoint at all.
-
NetworkPolicy for Cluster-Level Access Control
The first competency in the first domain, and the task most likely to appear in front of you: take a namespace that can reach everything and leave it able to reach one service.
-
Restricting Permitted Image RegistriesPaid
Securing a supply chain means deciding what the cluster will run before it runs it.
-
CIS Benchmark Review with kube-bench
The competency says use the CIS benchmark to review the configuration of Kubernetes components, so this guide runs it, fixes what it finds, and runs it again to prove the fix.
-
Sandboxed Containers with gVisor and RuntimeClassPaid
The previous guide ended with two tenants sharing one kernel.
-
Container Scanning and Vulnerability StalenessPaid
A vulnerability scan is a timestamped claim about an image, not a property of it.
-
ServiceAccount Tokens and automountServiceAccountTokenPaid
The competency says exercise caution in using service accounts, and the caution has three parts: stop mounting credentials into workloads that never call the API, give the ones that do their own identity, and know which token type you are looking at.
-
Signing and Verifying Artifacts with CosignPaid
A digest proves bytes did not change.
-
A securityContext That Passes the Restricted StandardPaid
The previous guide ended with a refusal listing four fields.
-
AppArmor and seccomp Profiles for PodsPaid
The largest piece of genuinely new ground between KCSA and CKS.
-
Container Runtime SecurityPaid
The kubelet does not run containers - it asks a runtime to.
-
NetworkPolicy Default Deny and DNS
Isolation techniques is a Domain 1 competency and NetworkPolicy is the one you will be asked about.
-
RBAC FundamentalsPaid
RBAC is 30% of the KCSA pool by keyword, more than any other subject.
-
ResourceQuota and LimitRange as Security ControlsPaid
Availability is part of security, and the cheapest denial of service in Kubernetes is a neighbour who asks for everything.
-
Image Scanning and Supply Chain ChecksPaid
Supply chain compliance asks two questions: what is in the thing you ship, and what is known to be wrong with it.
-
Kubernetes Secrets and Exposure PathsPaid
Secrets are 27% of the KCSA pool by keyword.
-
Network Flow ObservabilityPaid
Observability is a security control when it answers who talked to whom and whether it was allowed.
-
Storage Security: StorageClass, PV and CSIPaid
Storage is a component like the kubelet or etcd, and it has its own security questions: who may provision it, where the bytes actually live, and what happens to them when the workload goes away.
-
CIS Benchmark Assessment with kube-benchPaid
The CIS Kubernetes Benchmark is the compliance framework KCSA names, and kube-bench is how it is run.
-
Cluster PKI and Certificate Signing RequestsPaid
Every component of this cluster proves who it is with a certificate, and all of them trace back to files in one directory.
-
kubeconfig Files and Client CertificatesPaid
Client security is a Domain 2 competency and a kubeconfig is the client.
-
Image Tags, Digests and Pull PolicyPaid
Supply chain security starts with a question with a surprising answer: what did this Pod actually run? A tag is a mutable pointer, and the cluster records what it resolved to in a different field.
-
Pod Security Standards in DetailPaid
`privileged`, `baseline` and `restricted` are easy to recite and hard to place.
-
Projected ServiceAccount TokensPaid
ServiceAccount tokens changed shape in 1.24 and most material has not caught up.
-
Commonly Confused KCSA ConceptsPaid
Multiple-choice security questions are built on distinctions: two things that sound the same and behave differently.
-
Threat Modeling with STRIDEPaid
A threat modelling framework is a list of questions somebody worked out so you do not have to.
-
Trust Boundaries: Authentication and AuthorizationPaid
A threat model is a map of boundaries, and Kubernetes has four that matter: the human at a terminal, the Pod holding a token, the apiserver deciding twice about every request, and the node underneath.
-
Namespaces as a Security BoundaryPaid
Namespaces are the most over-trusted object in Kubernetes.
-
Service Mesh Security CapabilitiesPaid
KCSA asks what a service mesh provides.
-
Audit Logging and Cluster RecordsPaid
Audit logging is a Domain 3 competency and this cluster has none - which makes it a good place to measure the gap precisely.
-
KCSA Exam Timing and Error BudgetPaid
KCSA is 60 questions in 90 minutes at 75%, the highest pass mark on this site.
-
Privilege Escalation Paths in RBACPaid
Auditing RBAC by reading it does not scale - there are 74 ClusterRoles on a cluster with nothing installed.
-
Compromised Container Blast RadiusPaid
Assume the application is already owned - a dependency, an upload handler, an unauthenticated admin path - and ask what the attacker now has.
-
Admission Control and ValidatingAdmissionPolicyPaid
Admission control is where a cluster stops being a set of defaults and starts being your policy.
-
Network-Based Attack VectorsPaid
The pod network is flat and cluster DNS is open to everyone in it, so lateral movement needs no exploit - a name and a port are enough.
-
Denial of Service and Resource ControlsPaid
Availability is the third of the three properties, and the one Kubernetes gives away by default: a container with no `resources` block may take the whole node.
-
kube-proxy and Service ImplementationPaid
A Service is not a process.
-
Attacker Persistence MechanismsPaid
Getting in is one problem; staying in is a different one, and in Kubernetes it is solved with ordinary objects that look like configuration.
-
Python JSON API Requests and ResponsesPaid
Sending data is where the errors get interesting: `data=` and `json=` do completely different things to the same dict, a rejected request has an explanation you have to go and fetch, and `json=` refuses five types that appear in real payloads - datetimes, Decimals, UUIDs, Paths and sets.
-
Privilege Escalation from Pod to NodePaid
The most important idea in the KCSA threat model is that `create pods` is a privilege escalation primitive.
-
Python Process Environment and Working DirectoryPaid
A child process starts with a copy of your environment and your working directory.
-
Private Registry AuthenticationPaid
Private images need a credential, and Kubernetes stores it as an ordinary Secret with the password in clear.
-
Python Regular Expressions for LogsPaid
Log lines are the one place automation genuinely needs regular expressions: the shape is fixed enough to match and irregular enough that `split()` will not do it.
-
Python Retries, Timeouts and BackoffPaid
`requests` has no default timeout and no retries, so an unattended script gets both wrong by default: it can hang for ever, and it gives up on a failure that would have succeeded a second later.
-
Python SFTP File TransfersPaid
`open_sftp()` on a connected client gives you a full filesystem API over the same connection - put, get, stat, listdir, and an `open()` that reads a remote file with no local copy.
-
Python Signals, Timeouts and Process TerminationPaid
An automation script that can hang for ever is worse than one that fails, because nobody finds out.
-
Python SSH Keys and Host InventoryPaid
An unattended script needs a key with no passphrase, which sounds careless until you see what `authorized_keys` can restrict it to - a key that can run one command and nothing else.
-
Python subprocess Without a ShellPaid
Automation spends a lot of its time running other programs. `subprocess.run` with a list of arguments does that with no shell involved, which means no quoting, no glob expansion and no injection. `shell=True` hands your string to `/bin/sh` instead - and this guide shows exactly what that costs, with a captured command injection that removes a file it was never asked to touch.
-
Testing Python Automation with pytestPaid
Automation is exactly the code nobody watches run, which makes it exactly the code worth testing. pytest needs no boilerplate: a function whose name starts with `test_` and a plain `assert`.
-
Python Automation Mock ExamPaid
This track is not a certification, so there is no vendor blueprint to argue with - there is a 787-question pool, a 50-question mock, and a 70% readiness threshold that CertGrid sets.
-
Python Automation Production Failure PatternsPaid
Thirty-seven guides produced a lot of failures, and most of them were the same half dozen shapes: no timeout, no `check`, a shell where a list would do, a bare `except`, a credential in the wrong place.
-
Python Standard Library for Automation
Most automation needs no dependency at all: paths, CSV, JSON, INI, TOML, SQLite, regex, subprocess, logging, argparse and an HTTP client all ship with the interpreter.
-
Python Automation Practice Lab
One control node where scripts run and two hosts they act on.
-
Python urllib Without requestsPaid
Sometimes you cannot add a dependency: a locked-down host, a minimal image, a bootstrap script that has to run before pip exists. `urllib.request` does everything the last five guides did, with more code and two behavioural surprises - a 404 raises, and the exception it raises is also a readable response.
-
Python Automation for IT Overview
Python Automation for IT is a practical track rather than a certification: five domains, a 787-question pool, a 50-question mock and a 70% readiness threshold, all of it CertGrid's own.
-
Python Multi-Host Failure HandlingPaid
A loop over an inventory has one host that is down, one whose name does not resolve and one where the command itself fails - and the obvious `for` loop stops at the first of them, having done a third of the work and reported nothing.
-
Python YAML, INI and TOML ConfigurationPaid
Four configuration formats, and the choice between them is mostly about types.
-
CI Pipeline for Python AutomationPaid
A test suite nobody runs is documentation.
-
Python Virtual Environments and Pinning
A virtual environment is a directory with its own `python` and its own `site-packages`.
-
Python API Authentication and SecretsPaid
Getting a token into a request is one line.
-
Python Archives and Bulk File OperationsPaid
Copying a tree, moving files, making a backup archive and unpacking somebody else's - all of it is `shutil` and two archive modules, and none of it needs a subprocess.
-
Python subprocess Output and Return CodesPaid
Running a command is half the job; reacting to what it did is the other half. `check=True` turns a non-zero exit into an exception carrying both streams, `text=True` decides whether you get `str` or `bytes`, and `input=` feeds a command on standard input without a temporary file.
-
Python Cloud SDK Patterns with boto3Paid
boto3 is the shape almost every cloud SDK has: a client per service, one exception class for every failure, paginators instead of page loops, and retries already built in.
-
Python Command-Line Arguments with argparse
A script that needs editing to change a hostname is not automation. `argparse` turns a script into a tool: it parses arguments, converts their types, validates them against a set of choices, writes the `--help` output for you, and exits 2 on a bad call so the caller can tell a usage error from a runtime one.
-
Python Configuration and Environment Variables
A script with a hostname in it works on one host.
-
Python Scripts with cron and systemd TimersPaid
"It works when I run it and not from cron" is almost always the environment.
-
Python CSV and Tabular DataPaid
CSV is what an inventory, an export or a report arrives as.
-
Python Encodings, Temp Files and Atomic WritesPaid
Two problems that only show up in production.
-
Python Error Handling for Scheduled Jobs
Code you are watching can fail with a traceback and you will read it.
-
Python Script Exit Codes
An unattended script has exactly one way to tell whoever started it what happened: its exit status.
-
Python File Permissions and OwnershipPaid
A script that writes a credential needs to get the file mode right, and the obvious way - write it, then `chmod` it - leaves a window where anybody can read it.
-
Python HTTP Requests and Status CodesPaid
Most automation eventually calls an API. `requests.get` is four characters more than you need to get it wrong, so this guide is about the parts that bite: `ok` is not `== 200`, `raise_for_status` throws away the server's explanation, an error page is usually HTML rather than JSON, and a `Session` is worth using for a reason you can count rather than time.
-
Python JSON and Nested DataPaid
JSON is what an API returns and what a config file increasingly is.
-
Python Locking and Single-Instance ScriptsPaid
A cron job that sometimes takes longer than its interval will eventually run twice at once.
-
Python Logging for Unattended Scripts
`print` is fine while you are watching.
-
Mocking subprocess and HTTP in PythonPaid
Half of an automation script is calls you cannot make in a test - a subprocess, an API, a host that may be down. `monkeypatch` and `unittest.mock.patch` replace them, and both have one rule that catches everybody: you patch the name where it is looked up, not where it is defined.
-
Python API Pagination and Rate LimitsPaid
An API that holds more than a screenful gives it to you in pages, and one that is shared tells you to slow down.
-
Python Remote Commands with ParamikoPaid
`paramiko` gives you SSH without shelling out to `ssh`, which means the host key check, the exit status and every timeout become your decisions rather than OpenSSH's.
-
Python pathlib and Filesystem OperationsPaid
Automation is mostly files. `pathlib` makes a path an object rather than a string, which means the filename's parts have names, joining uses `/` instead of string concatenation, and reading a whole file is one call.
-
Python Modules and PackagesPaid
PCAP objective 1.5 is create and use user-defined modules and packages, and there is much less machinery than people expect: a module is a `.py` file, a package is a directory containing `__init__.py`, and being importable means being somewhere on `sys.path`.
-
Ansible Playbook BasicsPaid
A playbook is a YAML file containing a list of plays, and a play is a list of tasks aimed at a pattern of hosts.
-
Running Shell ScriptsPaid
Not an objective on its own, and assumed by all four that are.
-
PCAP String MethodsPaid
PCAP objective 3.3 is employ built-in string methods, and unusually it names them: capitalize, center, count, endswith, find, index, isalnum, isalpha, isdigit, islower, isspace, isupper, join, lower, lstrip, replace, rfind, rstrip, split, startswith, strip, swapcase, title, upper.
-
RHCSA Practice Lab Machines
Most of EX200 can be practised on one machine.
-
PCEP and PCAP Exam TrapsPaid
These are the behaviours that turn known material into a wrong answer.
-
Controlling a Rollout with maxSurge and maxUnavailablePaid
`maxSurge` and `maxUnavailable` are the only two knobs on a rolling update, and together they decide whether a deploy is invisible to users or an outage.
-
Time Synchronization with ChronyPaid
One objective, one config file, and one thing worth insisting on: `systemctl is-active chronyd` proves the service runs, not that the clock is right. `chronyc tracking` and `timedatectl` are what answer the question the objective actually asks.
-
SELinux Denial TroubleshootingPaid
Not a separate objective, and what the other five are really testing.
-
Python try, except and Clause OrderingPaid
Objective 4.4 is the basics of Python exception handling, and there are four keywords: `try`, `except`, `else`, `finally`.
-
System Tuning with tunedPaid
A small objective, usually taught as three commands to memorise.
-
Python Tuples and ImmutabilityPaid
Objective 3.2 is short because a tuple is a list you cannot change - the indexing and slicing from the previous guides applies unaltered.
-
Python Type Casting and Floating Point Accuracy
The second half of objective 1.4: converting between types. `int()`, `float()`, `str()` and `bool()` are four functions with a small number of sharp edges - `int("3.5")` raises where `int(3.5)` does not, and `int()` truncates where `round()` does something stranger.
-
Ansible Users, Groups and Password HashesPaid
Creating a user is one module and the parameters are obvious.
-
Ansible Role Variables and OverridesPaid
There are three ways to call a role and they are not interchangeable. `roles:` runs it before the play's tasks; `import_role` inserts it statically where you put it; `include_role` resolves it at run time.
-
Ansible Variables and PrecedencePaid
Ansible has twenty-two levels of variable precedence and you do not need to memorise them - you need the five that occur in practice, in the right order.
-
LVM Volume GroupsPaid
The middle layer, and the one that makes LVM worth using: a volume group can grow by absorbing another disk while everything above it stays running.
-
Pod Volumes and Volume Lifetime
An application needs two kinds of storage: scratch space that can vanish, and data that must not. `emptyDir` and a PersistentVolumeClaim cover both, and the only thing that reliably confuses people is a claim that reports `Pending` while nothing at all is wrong with it.
-
Exposing Pod Metadata with the Downward APIPaid
The downward API injects facts about the Pod into the Pod - its name, the node it landed on, its own IP, the memory limit it was given.
-
Ansible Architecture and Agentless Operation
Ansible is agentless, push-based and runs Python over SSH.
-
RHCSA on RHEL 10 Changes
RHEL 10 changed enough that older RHCSA material is actively misleading, and the corrections circulating about it are not all correct either.
-
CKAD Exam Format and Scope
CKAD is two hours of practical tasks on a cluster somebody else built.
-
PCEP and PCAP Exam Format and Objectives
PCEP and PCAP are sold as a ladder, and most study plans treat them as one exam split across two sittings.
-
RHCSA Reboot Persistence ChecklistPaid
Not an objective.
-
RHCSA Exam Format and Objectives
EX200 is 180 minutes of real work on a real machine: no multiple choice, no internet, and a grader that reads the state of the system rather than the commands you typed.
-
Multi-Container Pods: Shared Network and Volumes
Every multi-container pattern on the CKAD - sidecar, adapter, ambassador - is built out of exactly two shared things: one network namespace and any volumes you mount in both containers.
-
Python while and for Loops
Objective 2.2 - perform different types of iterations - is the other half of PCEP's 29% control-flow block.
-
Running Ansible from Shell ScriptsPaid
"Script administration tasks" is an EX294 objective in its own right: shell scripts that run ad hoc commands or playbooks.
-
Python File Streams, Modes and HandlesPaid
PCAP objective 5.4 is understand basic input/output terminology, and it is the vocabulary objective for files: stream, handle, mode, text against binary. `open()` returns an object with a `name`, a `mode` and an `encoding`; the mode letter decides what you may do and whether the file is truncated; and five distinct things can go wrong, each with its own exception.
-
Python String BasicsPaid
Objective 3.4 asks you to operate with strings, and a string is an immutable sequence of characters - so every index and slice rule from the list guides applies, and nothing can be assigned.
-
PCEP and PCAP Question TypesPaid
PCEP and PCAP are not multiple choice.
-
RHCSA Exam Time ManagementPaid
Not an objective. 180 minutes, 210 of 300 to pass, and no partial credit for a task that half works.
-
User Switching and Login ShellsPaid
The objective is "log in and switch users in multi-user targets", and the one thing worth practising is that `su user` and `su - user` leave you with different environments.
-
systemd Targets and Boot SelectionPaid
Two objectives: booting into a target manually, and configuring the default.
-
systemd Timer UnitsPaid
The third tool the scheduling objective names, and the one Red Hat now ships its own periodic work as.
-
Ansible Templates with Jinja2Paid
A template is a configuration file with the machine-specific parts left as expressions, and it is the single most useful thing Ansible does.
-
The CKAD Practice Cluster
CKAD tasks assume things exist: a default StorageClass so a PVC binds, an ingress controller so an Ingress does something, a metrics-server so an HPA has a denominator.
-
Python Exception HierarchyPaid
PCEP objective 4.3 is titled Python Built-In Exceptions Hierarchy, and it is one of the few objectives that really is a memorisation task.
-
Ansible Firewall Rules and Safe OrderingPaid
Configuring a firewall remotely has one hazard that nothing else in this path shares: get the order wrong and you disconnect yourself from the machine you are configuring, mid-play, with no way back in.
-
systemd Journal and System LogsPaid
One objective and the most useful troubleshooting skill in the blueprint.
-
Python Practice Environment
Every other path on this site needs a cluster or a pair of managed hosts.
-
Python math ModulePaid
PCAP objective 1.2 is perform evaluations using the math module, and it is one of the most answerable objectives in either exam - the functions do what their names say.
-
Common Ansible ModulesPaid
Six modules that do not belong to any one administration task but turn up in almost every real playbook.
-
ResourceQuota and LimitRangePaid
A ResourceQuota caps what a namespace may consume in total, and it has a side effect nobody expects the first time: once you quota a compute resource, every Pod must declare it, and `kubectl run` stops working.
-
NetworkPolicy Egress and DNSPaid
A default-deny egress policy blocks port 53 along with everything else, so DNS stops working and every symptom points at DNS rather than at the policy you just wrote.
-
Ansible Play Execution OrderPaid
A play has four task sections and they do not run top to bottom in file order.
-
Python platform ModulePaid
PCAP objective 1.4 is discover host platform properties using the platform module, and it is the smallest objective in either syllabus - a dozen functions that each return a string.
-
Liveness, Readiness and Startup ProbesPaid
An application that takes 40 seconds to start and a liveness probe that gives up after 15 will never run: the probe kills it mid-boot, forever.
-
Python random ModulePaid
PCAP objective 1.3 is generate random values using the random module.
-
Deployment Rollout Health and AvailabilityPaid
A Deployment does not replace Pods; it manages two ReplicaSets and moves replicas between them under a budget.
-
Shell Help and Command Discovery
Two objectives in one guide: issuing commands with correct syntax, and locating documentation in man, info and /usr/share/doc.
-
Sidecar Containers in Jobs
A Job is complete when its Pod's containers have all terminated.
-
Readiness Probes and Rollout ProgressPaid
A readiness probe restarts nothing.
-
Python File Reading and WritingPaid
PCAP objective 5.5 is perform input/output operations.
-
Python RecursionPaid
Recursion is part of objective 4.1 and is examined narrowly: given a recursive function, what does it return, and what happens if the base case is missing.
-
Shell Redirection and Pipelines
One objective, and most of it is muscle memory.
-
Resource Requests, Limits and OOMKilledPaid
Requests are what the scheduler reserves; limits are what the kernel enforces.
-
Restoring Default SELinux ContextsPaid
The objective says "restore default file contexts", and the exam question behind it is always the same: a service cannot read files in a directory it should be able to.
-
Deployment Rollback and Revision HistoryPaid
`kubectl rollout undo` goes back one step, which is rarely the step you want.
-
RPM Queries and Local Package InstallationPaid
Covers "install and update software packages from the local file system" and the rpm queries that answer exam questions faster than dnf can.
-
Pod Phase Versus ReadinessPaid
STATUS says Running and the Service answers nothing.
-
Running Selected Ansible Tasks with TagsPaid
A long playbook that can only be run in full is painful to develop and dangerous to re-run.
-
Manual Scaling and HorizontalPodAutoscalerPaid
`kubectl scale` is one command and always works.
-
Ansible Scheduled Tasks with cronPaid
The `cron` module is idempotent in a way that is worth understanding, because the mechanism is visible in the crontab itself: it writes a comment containing the job's name and finds the job again by that comment.
-
Scheduled Tasks with cronPaid
Part of one objective that names cron, at and timer units together. cron is the oldest and still the fastest to write.
-
Python Scope, Shadowing and globalPaid
The environment half of objective 4.2.
-
Secrets: Creation, Consumption and EncodingPaid
A Secret is a ConfigMap with a different name, a type field, and one genuine difference: mounted Secrets land on tmpfs rather than disk.
-
SELinux BooleansPaid
One objective, and the easiest SELinux fix when it applies: policy already contains the rule you need and it is switched off.
-
SELinux File and Process ContextsPaid
One objective covering files and processes.
-
SELinux Enforcing and Permissive ModesPaid
The shortest SELinux objective.
-
SELinux Port LabelsPaid
One objective.
-
systemd Service State and EnablementPaid
One objective, and the single most expensive misunderstanding available: `start` and `enable` are unrelated.
-
Ansible Service State and EnablementPaid
Two independent questions - is it running now, and will it run after a reboot - and two independent parameters.
-
Setting the Default Namespace in a Context
Most CKAD tasks name a namespace, and every one of them is scored in that namespace.
-
Special Permissions: SUID, SGID and Sticky BitPaid
Not a separate objective, and assumed by two that are: the collaborative directory in the groups objective needs SGID, and diagnosing permissions needs you to read an `s` or a `t` where you expected an `x`.
-
SSH, scp and rsync Transfers
Two objectives: accessing remote systems over SSH, and transferring files securely.
-
Linux File and Directory Permissions
chmod syntax takes ten minutes to learn.
-
Python Methods and selfPaid
PCAP objective 4.3 is equip a class with methods.
-
Boot Loader ConfigurationPaid
One objective, and the last of the 62.
-
Persistent Mounts with UUID and LabelPaid
The objective that can cost every other mark on the exam: a malformed `/etc/fstab` stops the machine booting, and the grader reboots before marking.
-
NFS Mounts and Client PackagesPaid
The objective is the client side, and step one is the one that wastes the most time: `nfs-utils` is not installed on a minimal RHEL 10, and without it `mount -t nfs` fails with a message about a "remote address" that mentions no package at all.
-
Ansible File Copy and FetchPaid
Four modules move files and the only hard part is remembering which way each one goes. `copy`, `template` and `unarchive` push from the control node; `fetch` pulls to it.
-
Python Multiple Inheritance and MROPaid
The other half of PCAP objective 4.5.
-
Network Services at BootPaid
One objective, and it is a two-part answer that a one-part answer fails: NetworkManager must be enabled, **and** the connection must be set to autoconnect.
-
ConfigMap Consumption MethodsPaid
A ConfigMap is one object, but a Pod can consume it three ways at once - as an environment variable, as a mounted directory, and as a single file placed with subPath.
-
One-Time Jobs with atPaid
The second of the three tools the scheduling objective names, and the only one for "once, then never again".
-
Python Operators and Precedence
Objective 1.4 asks you to choose operators adequate to the problem, and in practice that means predicting what an expression evaluates to.
-
Python ord(), chr() and String OperationsPaid
PCAP objective 3.2 is operate on strings, and its distinctive content is `ord` and `chr` - the two functions that turn a character into its code point and back.
-
Ansible Package ManagementPaid
Package management is the most common thing a playbook does.
-
Python Parameters and ArgumentsPaid
Objective 4.2 is organise interaction between the function and its environment, and the argument side of it is the most rule-heavy part of PCEP.
-
Passwords and Account AgingPaid
One objective covering two things that look alike and are not: password expiry and account expiry.
-
Ansible Permissions, ACLs and File ModesPaid
File modes in YAML have a trap, and it is not quite where most guidance says it is.
-
LVM Physical VolumesPaid
The bottom layer of LVM, and the shortest of the three objectives.
-
Service Ports: port, targetPort and nodePortPaid
Three numbers are involved in getting a request to a container - `port`, `targetPort` and `containerPort` - and only two of them matter.
-
Shell Script ArgumentsPaid
One objective, `$1` and `$2` by name.
-
Python print() and input()
Objective 1.5 is the smallest in block 1 and produces one of PCEP's most reliable questions: `input()` always returns a string, so adding two of them concatenates rather than adds.
-
Python Private Members and Name ManglingPaid
The second half of PCAP objective 4.2.
-
Process Priority with nice and renicePaid
A one-line objective with one genuinely non-obvious rule: a normal user can make their own process nicer but cannot make it greedier again, not even back to where it started.
-
Command Output in Shell ScriptsPaid
The last of the four scripting objectives, and the one that turns a script from a list of commands into something that reacts.
-
Python 3.14 and Exam Version Differences
PCEP-30-02 and PCAP-31-03 were written against a much older Python 3, and studying on a current interpreter quietly introduces disagreements.
-
Python raise, assert and finally
PCAP objective 2.1 goes past catching into causing. `raise` throws deliberately and a bare `raise` re-throws what you are handling. `assert` is a debugging statement that disappears under `-O` and has a spectacular failure mode when written with brackets.
-
kubectl port-forward and proxyPaid
`kubectl port-forward` tunnels a local port to something in the cluster through the API server, which means it works on any Service, needs no NodePort and no Ingress, and reaches things that are not exposed at all.
-
Init Containers and Completion Order
An init container runs to completion before the next one starts, and all of them finish before any application container begins.
-
Ansible Control Node Installation
The whole install is one package on one machine.
-
Installing Ansible Roles from GalaxyPaid
Galaxy has a role for most things and installing one is a single command.
-
Python Instance and Class VariablesPaid
This is the most asked subject in PCAP's 34% object-oriented section, and it comes down to one rule: **reading an attribute searches the instance and then the class; assigning one always writes to the instance.** Everything surprising follows - the list shared between every instance, and the counter that increments to 1 three times over.
-
Root Password Reset from Boot LoaderPaid
One objective, asked in some form on almost every attempt.
-
Python Introspection and Class AttributesPaid
PCAP objective 4.4 is discover the class structure, and it is a list of things you can ask an object about itself: `__class__`, `__name__`, `__bases__`, `__mro__`, `__dict__`, `__doc__`, plus `isinstance`, `issubclass` and the four `*attr` functions.
-
IPv4 Configuration with nmcliPaid
Half of one objective.
-
IPv6 Network ConfigurationPaid
The other half of the addresses objective.
-
SSH Key-Based AuthenticationPaid
One objective, three commands, and two failure modes that produce the identical unhelpful message.
-
Python Keywords, Indentation and Comments
PCEP objective 1.2 covers the shape of a Python program: which words are reserved, how blocks are marked, and what a comment is.
-
Using kubectl explain for Field Reference
The exam allows the Kubernetes documentation, and a browser is still slower than the terminal for the question you actually have: what is this field called and where does it go. `kubectl explain` answers from the schema of the cluster you are connected to, which means it is never the wrong version, and `--recursive` prints a whole subtree in one screen.
-
Kustomize with kubectlPaid
Kustomize is built into kubectl, which makes it the one packaging tool guaranteed to be available on the exam.
-
Labels and Selectors
Labels are how every object in Kubernetes finds every other object - a Service finds Pods, a Deployment owns a ReplicaSet, a NetworkPolicy picks a target.
-
Python Lambdas, map() and filter()Paid
PCAP objective 5.2 is embed lambda functions into code.
-
Python List ComprehensionsPaid
PCAP objective 5.1 is build complex lists using list comprehensions.
-
Python List Methods and CopyingPaid
The second half of objective 3.1.
-
Python List Indexing and SlicingPaid
Objective 3.1 is the largest part of PCEP's 25% collections block, and half of it is position arithmetic.
-
Python Literals, Variables and Number Systems
PCEP objective 1.3 covers literals, variables and numeral systems, and it is the first objective with real traps in it.
-
LVM Logical VolumesPaid
The top LVM layer and the one you actually put a filesystem on.
-
Container Logs and --previousPaid
When a container restarts, `kubectl logs` shows you the new one - which has not failed yet, so the error is not in it. `--previous` reads the dead container's log, and it is where the actual cause lives.
-
Ansible Loops and loop_controlPaid
One task with a loop replaces five near-identical tasks, and the loop is where playbooks stop being scripts.
-
Shell Loops with for, while and untilPaid
One objective, phrased as "process file, command line input" - so the forms that matter are the ones that read a file and the ones that read a command's output.
-
Ansible Performance TuningPaid
Ansible performance advice is mostly repeated without measurement.
-
Persistent systemd Journal ConfigurationPaid
By default the journal lives on tmpfs and is destroyed at every reboot - so the logs explaining why a machine went down are gone by the time you can read them.
-
Ansible Facts and Gathering OverheadPaid
Facts are what a managed node knows about itself, and Ansible collects them before every play unless told not to.
-
Files, Directories and Links
Two objectives that belong together, because the difference between a hard link and a soft link is invisible until you move or delete what they point at.
-
Ansible Filesystems, LVM and Persistent MountsPaid
Storage is the part of the RHCSA-style objectives that people practise least, because getting it wrong on a real disk is expensive.
-
Finding Ansible Modules with ansible-doc
The exam allows documentation, and `ansible-doc` is faster than any of it - it reads the modules actually installed on the machine in front of you, so it can never describe a version you are not running.
-
Process Discovery and TerminationPaid
One objective covering both halves: finding CPU and memory-intensive processes and killing them.
-
Debugging Ansible PlaybooksPaid
Four techniques cover almost every Ansible problem: raise the verbosity, print the variable, assert what you assumed, and ask the inventory what it thinks.
-
firewalld Zones, Services and PortsPaid
This appears in two objectives - networking and security - and is one skill.
-
Flatpak Repositories and ApplicationsPaid
RHEL 10 removed the whole container domain from EX200 and added two Flatpak objectives in its place, so there is very little RHCSA material on this yet.
-
Ansible forks, serial and Rolling ChangesPaid
`forks` and `serial` both control parallelism and they are not the same thing.
-
Job Completions, Parallelism and backoffLimit
Three fields decide how a Job behaves: `completions` (how many successes are needed), `parallelism` (how many at once) and `backoffLimit` (how many failures before giving up).
-
ConfigMaps: Environment Variables and Volume MountsPaid
There are three ways to create a ConfigMap and four ways to consume one, and CKAD tasks use all of them.
-
Generating YAML with --dry-run=client
Nobody passes CKAD by typing `apiVersion: apps/v1` from memory sixteen times.
-
Python Generators and yieldPaid
PCEP names generators in passing under objective 4.1 and asks little about them; PCAP's comprehension and closure material assumes you know what a lazy sequence is.
-
Debugging a Container Without a ShellPaid
Minimal and distroless images have no shell, so `kubectl exec` fails and the standard debugging routine stops at step one. `kubectl debug` adds an ephemeral container to the running Pod - sharing its network namespace, so it sees the same IP and can reach the same things - without restarting anything.
-
GPT Partitioning with partedPaid
One objective, and the commands are short.
-
grep and Regular Expressions
One objective covering both grep's options and regular expressions.
-
Group Membership ManagementPaid
One objective, and one mistake worth more marks than the rest of the domain combined: `usermod -G` without `-a` replaces every secondary group instead of adding one, reports nothing, and exits 0.
-
Ansible Handlers and Notification BehaviourPaid
A handler is a task that runs only if something notified it, only once however many times it was notified, and only at the end of the play.
-
Helm Install, Upgrade and RollbackPaid
Helm is a package manager with a memory: every install and upgrade is a revision it can go back to.
-
Hostname and Name ResolutionPaid
One objective, and one tool choice that matters more than it looks: `dig` and `host` query DNS directly and ignore `/etc/hosts`, so they can report a failure for a name that resolves perfectly well. `getent hosts` uses the same path an application does.
-
Python Execution Model
PCEP objective 1.1 is the terminology objective: interpreter and compiler, source and bytecode, lexis, syntax and semantics.
-
Ansible Idempotence, changed and ok
Idempotence is the property that running something twice has the same effect as running it once, and in Ansible it is visible in one word per host: `changed` or `ok`.
-
Python if, elif and else
Objective 2.1 is one line of blueprint - make decisions and branch the flow with the if instruction - and part of the densest 29% in PCEP.
-
Python Imports and sys.pathPaid
PCAP objective 1.1 is import and use modules and packages, and it is the first subject in either syllabus that PCEP does not mention.
-
Python Inheritance and Method OverridingPaid
PCAP objective 4.5 is build a class hierarchy using inheritance.
-
On-Demand Mounting with autofsPaid
One objective.
-
Privileged Access with sudoPaid
One objective, asked constantly.
-
RPM Repository ConfigurationPaid
A write-a-file objective, and the most common way to lose it is to write the file, confirm with `dnf repolist`, and move on. `repolist` does not validate anything - it lists a broken repository as happily as a working one.
-
Python ConstructorsPaid
PCAP objective 4.6 is construct and initialize objects. `__init__` runs automatically when an instance is created, receives the instance as `self`, and has two rules that are examined directly: the arguments must match like any function's, and it may not return anything but `None`.
-
User Account ManagementPaid
One objective, and the commands are short.
-
XFS, ext4 and VFAT FilesystemsPaid
Three filesystems, three `mkfs` commands, and one asymmetry that matters: **XFS cannot be shrunk**. ext4 is shrunk here to prove the contrast, and VFAT is shown silently ignoring a `chmod` - because it has no concept of Unix permissions at all.
-
Python Custom Exception Classes
PCAP objective 2.2 is extend the exceptions hierarchy with self-defined exceptions, and it is a small objective with one genuinely useful idea: define a base exception for your code and derive the specific ones from it, so a caller can catch the whole family with one clause or any single member precisely.
-
Custom Resources and the Operator PatternPaid
CKAD asks you to discover and use resources that extend Kubernetes.
-
Default Permissions and umaskPaid
One objective.
-
Python Function Definition and CallsPaid
Objective 4.1 is decompose the code using functions, and the syntax is one keyword.
-
Controllers and Pod RecreationPaid
Deployment Pods are interchangeable and named at random; StatefulSet Pods have stable identities and each keeps its own disk across deletion and rescheduling.
-
Linux Permission TroubleshootingPaid
The objective is diagnosis, not syntax.
-
Python DictionariesPaid
Objective 3.3 covers dictionaries: a mapping from keys to values, where the keys must be hashable and the values need not be.
-
Ansible SSH Keys and become
Two EX294 objectives in one sequence: create and distribute SSH keys to managed nodes, and configure privilege escalation on them.
-
dnf Updates and Transaction HistoryPaid
Covers the "install and update software packages" objective and the one dnf feature that can rescue a task: every transaction is logged and most can be undone.
-
Package Management with dnfPaid
Two objectives, and the install and remove halves take about a minute each.
-
Ansible Dynamic InventoryPaid
The exam asks for a static inventory, and a static inventory stops working the moment something else creates and destroys your hosts.
-
Ansible File Editing with lineinfile and blockinfilePaid
Sometimes you cannot template a file because you do not own all of it - a package-managed config, or one another team also edits.
-
Text Editing with Vim
One objective, and the exam gives you no graphical editor.
-
Python Encodings and Code PointsPaid
PCAP objective 3.1 is understand machine representation of characters, and it is the one string objective that is really about types.
-
Ansible Error Handling with ignore_errors and blockPaid
By default a failed task removes that host from the rest of the play while the others carry on - which is neither obviously right nor obviously wrong until you have seen it.
-
Events, describe and kubectl topPaid
Almost every "why is this broken" question is answered by events, and almost everyone reads them the slow way.
-
Python Exception Objects and Arguments
PCAP treats an exception as an object rather than a label, and objective 2.1 expects you to know what is on it. `as e` binds an instance; `e.args` is the tuple the constructor was given; `str(e)` is derived from that tuple and behaves differently for one argument, several, and none.
-
Ansible Execution Environments and ansible-navigatorPaid
An execution environment is the control node packaged as a container image: ansible-core, its collections and their Python dependencies, versioned together. `ansible-navigator` runs your playbook inside one.
-
Extending LVM Volumes and FilesystemsPaid
The objective is one line and the mistake is universal: growing the logical volume does not grow the filesystem on it.
-
Service Selectors and EndpointsPaid
A Service whose selector matches nothing is completely valid.
-
ServiceAccounts, Roles and RoleBindingsPaid
Every Pod runs as a ServiceAccount whether you choose one or not, and by default it can do nothing.
-
Ansible Static Inventory and Host Patterns
An inventory is a list of hosts arranged into groups, and the groups only earn their keep once you start selecting with them.
-
Ansible Ad-Hoc Commands and Core Modules
An ad-hoc command is one module against a pattern of hosts, right now, with no playbook.
-
Non-Destructive Swap ConfigurationPaid
The objective's key word is *non-destructively*: swap is added while the machine keeps running and its existing swap keeps working.
-
Ingress Rules and Ingress ControllersPaid
An Ingress is only a request.
-
Ansible Configuration File Precedence
Ansible reads its configuration from the first of four locations it finds, and gets this wrong for you silently if you assume the wrong one.
-
Ansible Vault for SecretsPaid
Vault encrypts files with AES256 so that variables containing passwords can live in the same repository as everything else.
-
Finding Deprecated API VersionsPaid
"Understand API deprecations" is a CKAD objective and it shows up as a manifest that used to work and now does not.
-
Archive and Compression Tools
One objective naming three tools.
-
Blue-Green Deployments with Service SelectorsPaid
Blue-green needs no special tooling in Kubernetes.
-
Boot, Reboot and ShutdownPaid
The shortest objective in the blueprint, with one genuine trap: `shutdown -k` is described as sending warnings without shutting down, and it also creates `/run/nologin`, which stops every unprivileged user logging in until it is removed.
-
Python Loop Control and else
The second half of objective 2.2. `break` leaves a loop, `continue` skips to the next iteration, and both loops accept an `else` clause that runs only if no `break` happened - a construct almost unique to Python and one PCEP asks about by name.
-
Ansible Role CreationPaid
A role is a directory layout that Ansible knows how to read: tasks here, templates there, variables in two places with different precedence. `ansible-galaxy init` creates the skeleton in one command.
-
Building and Loading Images Without a Registry
CKAD lists defining, building and modifying container images, and the modifying half is what actually comes up: overriding an image's entrypoint, arguments and environment from the Pod spec.
-
Python bytearray and Binary FilesPaid
The last part of PCAP objective 5.5. `bytes` is immutable and `bytearray` is its mutable sibling - a sequence of integers 0 to 255 that you can assign into.
-
Editing Live Objects: apply, edit, patch and replace
CKAD hands you existing objects more often than empty namespaces, and there are four ways to change one: `set` for the handful of fields with a verb, `patch` for everything else, `edit` for exploration, and delete-and-recreate for the fields that cannot change at all.
-
Choosing a Workload Object
"Choose and use the right workload resource" is a CKAD objective, and the differences are easier to see than to remember.
-
Python Classes and ObjectsPaid
PCAP objective 4.1 is understand the object-oriented approach, and it is the start of the 34% of that exam PCEP never mentions.
-
Python ClosuresPaid
PCAP objective 5.3 is define and use closures.
-
Ansible Collections and Fully Qualified Collection NamesPaid
Since Ansible 2.10 almost everything ships in collections, and a module's real name has three parts.
-
Ansible command, shell and raw Modules
Three modules run things on a host and choosing between them is a recurring exam question. `command` runs a binary with no shell, `shell` runs a shell, and `raw` needs no Python at all.
-
Ansible Conditionals and Jinja ExpressionsPaid
`when:` decides whether a task runs, per host and per loop item.
-
Shell Conditionals with if and testPaid
One objective, which names `if`, `test` and `[]` explicitly.
-
Canary Deployments by Replica CountPaid
A canary needs no mesh and no ingress weighting: put both versions behind one Service with one shared label, and the traffic split is the ratio of ready Pods.
-
CronJob Schedules and concurrencyPolicy
A CronJob creates a Job on a schedule, and the interesting question is what it does when the previous Job is still running. `concurrencyPolicy` answers it, and the default is to let them overlap.
-
DaemonSets and Node EligibilityPaid
"A DaemonSet runs one Pod on every node" is the definition everyone learns and it is not what the controller does.
-
securityContext: runAsNonRoot and CapabilitiesPaid
A securityContext decides who the process is and what it may do, and each setting has a characteristic failure. `runAsNonRoot` against a root image refuses to start at all; `readOnlyRootFilesystem` lets the container start and then breaks its first write; dropping capabilities produces `Operation not permitted` from a command that has always worked.
-
Troubleshooting Expired Certificates
kubeadm certificates last one year and renewing them is one command.
-
Taints and Tolerations: NoSchedule and NoExecutePaid
A taint is a node saying no.
-
Podman Volume Ownership and Permissions
A container running as its own user 1000 writes files owned by host UID 100999.
-
The CNCF Landscape and Project Maturity
The CNCF landscape is usually taught as a poster to memorise.
-
Pod Security Admission Namespace Labels
One label on a namespace turns a privileged Pod from Running into Forbidden.
-
Podman Without a Daemon
Start a container, then look for the process that owns it. `pgrep podman` finds nothing, `podman.service` is inactive, and the running nginx is a child of PID 1 by way of a 96-argument monitor called conmon.
-
HPA, VPA and Cluster Autoscaler
HPA adds Pods, VPA resizes them, Cluster Autoscaler adds nodes.
-
Podman Pods and Shared Localhost
A sidecar reaches its web server on `http://localhost:80` with no network, no DNS and no service.
-
Podman Volumes and Bind Mounts
A named volume is a directory in your rootless store that Podman manages; a bind mount is a path you chose.
-
NetworkPolicy Scope and LimitationsPaid
Two Pods talk in plaintext, a default-deny stops them dead, and one label-based rule lets exactly one caller back in.
-
Container Runtimes and the CRI
The kubelet does not run containers.
-
KCNA Exam Format and Domain Weights
KCNA is broad and shallow on purpose: four domains, one of them nearly half the exam, and no live cluster to fix.
-
The Four Cs of Cloud Native SecurityPaid
Cloud, Cluster, Container, Code.
-
Rootless Podman Image Storage
185 MB of images in `~/.local/share/containers/storage`, on your home filesystem and counted against your quota.
-
Podman Prune Commands and Data Loss
`container prune` and `image prune` reclaim space and lose nothing. `volume prune` removed two volumes here, one of them a Compose volume with data in it - and it is the only one of the three that is irreversible.
-
Prometheus Targets and Control Plane Scraping
Prometheus reports kube-proxy, the scheduler, the controller manager and etcd as down on a healthy cluster.
-
Podman Stop Timeout and PID 1
`podman stop` on a container running `sleep` takes 10.119 seconds and ends in SIGKILL.
-
Podman Image Layers and Build Cache
Rebuilding an unchanged Containerfile produces the same image ID, so `app:1` and `app:2` are one image with two tags.
-
Replica Count and Cluster CapacityPaid
Scale to 8 with a ResourceQuota and an HPA in place and you land on 4.
-
PromQL Query BasicsPaid
Query Prometheus from a Pod instead of a port-forward.
-
Podman Pasta Source Address Behavior
Two curls from the same machine reach the same container and its access log records `::1` for one and `169.254.1.2` for the other.
-
Podman Error Diagnosis
Every failure on this path named its own cause: `Invalid argument` versus `Permission denied`, pasta versus nginx on port 80, a netns error that still exits 0.
-
Docker Compose with Podman
Enable `podman.socket`, set `DOCKER_HOST`, and the genuine Docker Compose binary brings up a two-service stack on Podman.
-
Renewing Cluster CertificatesPaid
`kubeadm certs renew all` rewrites eleven certificates and tells you to restart four components.
-
Podman Kubernetes YAML Replica Behavior
A Deployment asking for three replicas gets a warning and one pod.
-
Resource Requests, Usage and Cost
A cluster can be completely full while every node sits at 3% CPU.
-
Podman Pod Restart with systemd
A `.pod`, a `.volume` and a `.container` file, and starting one of them starts all three.
-
Podman Rootless and Rootful Capabilities
`CapEff: 00000000800405fb` in a rootless container, and the identical value under sudo.
-
Rootless Podman Build UID Limits
`RUN chown 65000:65000` builds fine and `RUN chown 70000:70000` fails with `Invalid argument`, because /etc/subuid grants you exactly 65536 subordinate UIDs.
-
Rootless Docker and Daemon Socket Access
Membership of the docker group is equivalent to root on the host, and most people who have it do not know why.
-
Rootless Podman Defaults
You are root inside the container and uid 1000 outside it, at the same instant, for the same process.
-
Running Kubernetes YAML with Podman
`podman kube play` runs a Kubernetes manifest on a single host with no cluster, no kubelet and no API server. `podman kube down` then prints a netns error and exits 0 - the pod is gone, and the same pod built by hand tears down silently.
-
Running and Managing Podman Containers
The five states a container moves through, and the two flags that decide whether you ever see it again.
-
Scale to Zero on KubernetesPaid
Kubernetes will happily run zero replicas - that half of serverless is built in.
-
GitOps Self-Heal and PrunePaid
Scale a managed Deployment by hand and the change is gone before the next command runs.
-
Podman Short Names and Registry Resolution
`podman pull hello-world` fetches `quay.io/podman/hello`, not Docker's image - and the same command on the same host returns a different image once one is already in your store.
-
Docker Swarm Cluster Architecture
Docker's own orchestrator, already in the engine you have installed.
-
Docker Swarm Node Maintenance and Failover
Take a machine out of service without dropping a request.
-
Docker Swarm Overlay Networks and Routing Mesh
Publish a port on a cluster and every node answers it - including nodes running none of your containers.
-
Docker Swarm Rolling Updates and Rollback
Change the image on a live service and watch the cluster replace tasks a few at a time.
-
Docker Swarm Services and Scheduling
A service is a desired state, not a container.
-
Docker Swarm Stacks and Secrets
Deploy a Compose file to the whole cluster with one command, and distribute a password to only the services that need it - proved by the service that should not have it finding nothing at all.
-
PodDisruptionBudgets and Node DrainPaid
`ALLOWED DISRUPTIONS 0` and a drain that retries every five seconds forever: `Cannot evict pod as it would violate the pod's disruption budget`. minAvailable 3 with 3 replicas permits nothing, and the arithmetic is the whole guide.
-
The cgroup Driver: kubelet and containerdPaid
The kubelet and the runtime each decide how to talk to cgroups.
-
The KCNA Practice Cluster
Four nodes, Kubernetes 1.36.4, containerd 2.2.6 - and a kubectl one minor behind the server, which is supported and worth understanding rather than fixing.
-
Podman Default Network DNS Behavior
`getent hosts beta` exits 2 on the default network and resolves on a user-defined one.
-
Grafana Dashboards for KubernetesPaid
The chart ships Grafana already pointed at Prometheus, with 29 dashboards delivered as ConfigMaps and loaded by a sidecar.
-
Docker Image SBOMs and Provenance
You cannot answer "are we affected by this CVE" without knowing what is inside your images.
-
Inspecting Podman Containers
Four questions and the command for each: what has it said, what is it running, what is it costing, and what has it changed. `podman diff` is the one people never reach for and should.
-
Installing Argo CD
The documented one-liner fails on this chart with "annotations: Too long".
-
Podman Installation on Ubuntu 26.04
Podman installs from Ubuntu's own repository in a single command.
-
Installing Prometheus on Kubernetes
Install kube-prometheus-stack with Helm and watch all four node-exporters go into CrashLoopBackOff.
-
kubectl Productivity for the ExamPaid
Two hours, seventeen tasks. `--dry-run=client -o yaml` writes the manifest you were about to type from memory, `kubectl explain` replaces the browser tab, and jsonpath answers a question instead of printing a table to read.
-
kubectl and the Kubernetes API
Turn up the verbosity and kubectl stops being magic: it is a GET to an HTTPS endpoint that returns JSON.
-
Podman User Services and Linger
Everyone repeats that a rootless service dies at logout.
-
Podman Container Logs and Persistence
`podman rm` the container and `podman logs` says no such container - but `journalctl --user CONTAINER_NAME=talker` still prints every line. journald is the store; `podman logs` is only a reader that needs the container to exist.
-
Docker to Podman Migration Differences
`docker run` mostly just works.
-
Moving Podman Images Without a Registry
`podman image scp localhost/multi:1 lab02::` copies an image host to host and prints `Loaded image`.
-
Podman Multi-Stage Builds
The same Containerfile produces an 8.66 MB image and a 182 MB one, and the difference is which stage you stop at. `--target` builds the discarded half so you can look at what was thrown away.
-
Podman Netavark and Aardvark DNS
Two Rust binaries in /usr/lib/podman that you never invoke: netavark configures the network and aardvark-dns answers name lookups.
-
Podman Network Drivers Beyond Bridge
`--network none` leaves a container with loopback and nothing else. `host` gives it your namespace outright.
-
Default Alerting Rules and Alert TuningPaid
A fresh kube-prometheus-stack fires nineteen alerts on a working cluster.
-
Pod Sandboxes and Pause ContainersPaid
Ten Pods on this node means ten pause containers doing nothing at all.
-
Podman Pasta Networking
A rootless container on the default network has `eth0` set to 192.168.0.21 - the host's own LAN address - and an empty IPAddress field.
-
podman-compose and Docker Compose Differences
The same compose.yaml gives you `stack_web_1` from podman-compose and `stack-web-1` from `podman compose`.
-
Podman and Docker CLI Differences
`podman-docker` puts a /usr/bin/docker on your PATH and most commands just work.
-
Docker Production Troubleshooting
The failures you will actually meet, each reproduced deliberately so you recognise the exact wording.
-
Podman Low-Port Publishing and sysctl
`-p 80:80` rootless fails with `pasta failed ...
-
RBAC: Roles, ServiceAccounts and BindingsPaid
A ServiceAccount starts able to do almost nothing.
-
Docker Read-Only Containers and Capabilities
Harden a real nginx container to a read-only filesystem and four capabilities - including the two failed attempts, because the failures are where the learning is.
-
Podman Auto-Update with systemd
Push a new image under the same tag and `podman auto-update` pulls it and restarts the container - no orchestrator.
-
Podman Pods and Infra Containers
`podman pod inspect` answers the question directly: `shared=[uts ipc net]`.
-
Podman Private Registry Setup
A registry container on podman03, and the first push fails with `http: server gave HTTP response to HTTPS client`.
-
Sidecar ContainersPaid
An init container with `restartPolicy: Always` is not an init container.
-
Podman Image Signature Policy
Two identical images in one registry, one signed.
-
Podman tmpfs and Read-Only Filesystems
`--opt type=tmpfs --opt o=size=8m` makes a volume that lives in RAM and enforces its size - a 16 MB write stops at 8.
-
The Argo CD Application ResourcePaid
Point Argo CD at a Git path with twenty lines of YAML and it deploys, then keeps deploying.
-
SLOs, SLIs and Error BudgetsPaid
An SLO is not a document.
-
Helm Charts and Release StatePaid
helm create scaffolds a working chart, helm template renders it without a cluster, and --dry-run creates nothing at all - not even the namespace.
-
HorizontalPodAutoscaler and Resource Requests
An HPA on a Deployment with no CPU requests reports cpu: <unknown>/60% forever.
-
Podman Volume Backup
`podman volume export` writes a plain tar of a volume's contents - no helper container, no `-v $(pwd):/backup` incantation.
-
Building Images with Containerfiles
Five instructions, five STEP lines, and an image tagged `localhost/app:1` - Podman prefixes locally built images with a registry that does not exist, which is the first thing that will confuse you when you try to push it.
-
Buildah and podman build
`buildah` is already installed - it arrived with Podman.
-
Docker Build Cache in CI/CD
A CI worker starts with an empty cache every run, which is why naive pipelines rebuild everything every time.
-
Creating a User with a CertificateSigningRequestPaid
Kubernetes has no User object.
-
Docker Disk Usage and Cleanup
Where the space actually goes - measured, not guessed.
-
Draining a Node for MaintenancePaid
`kubectl drain` refuses twice before it works, and each refusal names the flag it wants: DaemonSet pods, then pods with no controller.
-
Podman Remote Client Setup
`podman system connection add` succeeds without testing anything, then the first real command fails with an ssh handshake error.
-
Podman Capability Dropping and Restoration
Each failure names the next capability: chown, then bind.
-
Essential Podman CLI Commands
The dozen commands that cover most days, and the `--format` template that turns any of them into a single line you can script against.
-
PVC Expansion and Volume SnapshotsPaid
Patch a PVC from 64Mi to 128Mi and it reports 128Mi requested against 64Mi actual, with FileSystemResizePending.
-
Cloud Native Standards: CRI, CNI, CSI and OCI
CRI, CNI, CSI and OCI are not trivia - they are why you can swap Docker for containerd, Flannel for Calico, or one storage backend for another without Kubernetes noticing.
-
Generating Kubernetes YAML from Podman
`podman kube generate` turns a pod you built by hand into a real `apiVersion: v1 / kind: Pod` manifest.
-
Podman Quadlet and Deprecated systemd Generation
`podman generate systemd` still runs and opens with `[DEPRECATED]`.
-
Owner References and the Controller Chain
Two numbers tell you whether a controller has caught up with your change, and one field explains why deleting a Pod does not help.
-
Progressive Delivery and Automated RollbackPaid
A Deployment gives you one rollout strategy and no opinion about whether the new version is any good.
-
ClusterIP Services and Virtual IPs
A Service gets an IP address that answers HTTP and refuses ping, because nothing owns it.
-
Podman Containers as systemd Units
A nine-line `.container` file becomes a real systemd service, and `systemctl --user enable` then fails on it because the unit is generated, not installed.
-
Gateway API and GatewayClass
The Gateway API is not in Kubernetes - it arrives as CRDs you install.
-
Pod Restart Policies and Job Completion
Every other workload object exists to keep something running.
-
nodeSelector and Scheduling Constraints
Two Pods with an identical nodeSelector pointing at the same node.
-
Docker Image Tagging and Publishing
How an image name is actually parsed, why :latest is a trap, and a full push and pull against a registry running in a container on your own machine - no account, no credentials, real digests.
-
Taints and TolerationsPaid
A nodeSelector says where a Pod wants to go.
-
Ingress Path Routing and Rewrites
An Ingress object is a routing table that does nothing on its own - a controller has to be running to read it.
-
The Downward APIPaid
Inject a Pod's own name, node and IP as environment variables, mount its labels as files, then find that a 50m CPU request arrives as the number 1 and that the files update while the variables never do.
-
The Kubernetes Network ModelPaid
Three separate address ranges are in play and confusing them causes most Kubernetes networking problems.
-
LimitRange Defaults for Pods
A Pod created with no resources at all comes back holding a CPU request, a memory request and both limits.
-
Reading Pod Status and Container State
Six broken Pods at once.
-
Debugging Containers with Ephemeral Containers
kubectl logs picks a container for you without saying which until you ask.
-
Three-Node kubeadm Cluster SetupPaid
Build a control plane and two workers, then use the second worker for what it is actually for: watch six replicas spread across both, drain one node and see every pod reschedule onto the other while the Service keeps answering.
-
Volume Types and What Each One Loses
An emptyDir shared by two containers, deleted with its Pod.
-
Service Types: ClusterIP, NodePort and LoadBalancer
A NodePort answers on all four nodes, including the ones running nothing.
-
TLS for IngressPaid
Add four lines and a Secret and the Ingress serves HTTPS.
-
Topology Spread ConstraintsPaid
Nine replicas, maxSkew of 1, and only three ever schedule.
-
Two-Node kubeadm Cluster SetupPaid
Add a real worker to a kubeadm cluster.
-
Upgrading a Cluster with kubeadmPaid
A real minor-version upgrade of a two-node cluster, control plane then worker.
-
Volume SnapshotsPaid
A snapshot is three objects with the same shape as PVC, PV and StorageClass.
-
Volumes: emptyDir and hostPathPaid
Two containers share an emptyDir, then the Pod is deleted and the data is gone.
-
What Kubernetes Is and What It DoesPaid
Kubernetes is a database of desired state with programs that keep reality matching it.
-
First kubectl Session: Inspecting a ClusterPaid
Six commands that tell you what cluster you are pointed at, what it can be asked for, and what every field in a manifest means.
-
Node Affinity: Required and PreferredPaid
nodeSelector is all or nothing.
-
Troubleshooting Node NotReady
Stop a kubelet and watch what happens: the node goes NotReady with Ready=Unknown, two taints appear on their own, containers keep serving, and the Pod still reports Running because nothing is left to say otherwise.
-
Troubleshooting OOMKilled and Exit Code 137
A container asks for 200MB against a 64Mi limit and is killed mid-write.
-
PersistentVolumes and PersistentVolumeClaimsPaid
Create a 1Gi volume by hand, then two claims: one asks for 5Gi and waits forever, the other asks for 500Mi and gets the whole gigabyte.
-
Troubleshooting Pod Pending
The scheduler explains itself precisely and almost nobody reads it.
-
Pods: The Basic Deployment UnitPaid
Kubernetes does not run containers, it runs Pods.
-
PriorityClasses and PreemptionPaid
Fill a node with low-priority Pods, then schedule a high-priority one and watch the scheduler delete a running Pod to make room.
-
Probes and Pod LifecyclePaid
Three probes that look similar and do entirely different things: one gates traffic, one restarts the container, one buys time at startup.
-
Troubleshooting PVC Pending
Three claims, all Pending, and only the event type tells them apart: one is waiting on purpose, one names a class that does not exist, and one asks for something the backend cannot do and does not say so.
-
Troubleshooting RBAC Forbidden Errors
Three Forbidden errors from one ServiceAccount, differing by verb, by resource and by namespace.
-
RBAC Roles and BindingsPaid
Four object kinds, one verb-and-resource model, and a command that answers permission questions without trial and error.
-
ReplicaSetsPaid
Create a ReplicaSet by hand, watch it replace a deleted Pod, then create a Deployment and follow the ownership chain it builds.
-
Resource Requests, Limits and QoS ClassesPaid
Requests are what the scheduler reserves.
-
Resetting and Rejoining a Node with kubeadmPaid
Take a node out of a cluster and put it back, and take a machine all the way back to bare Ubuntu.
-
Docker Restart Policies and Resource Limits
What actually happens when a container dies, and what stops one container taking the host down with it.
-
Rolling Update Strategy: maxSurge and maxUnavailablePaid
Poll a Deployment through two rollouts and read the counts. maxSurge shows up as READY exceeding the replica count; Recreate shows up as AVAILABLE dropping to zero.
-
securityContext and Non-Root ContainersPaid
Containers run as root unless you say otherwise.
-
Troubleshooting a Service With No Endpoints
Two broken Services with identical symptoms.
-
Services: ClusterIP, NodePort and LoadBalancerPaid
Three Service types that stack on top of each other, one address that nothing owns and that ping cannot reach, and a LoadBalancer that stays Pending forever on bare metal.
-
Single-Node kubeadm Cluster SetupPaid
Take one Ubuntu 26.04 machine from nothing to a working Kubernetes cluster with kubeadm: containerd on the systemd cgroup driver, the kernel settings kubelet needs, Calico for pod networking, the control-plane taint removed, and a workload proving DNS and Service routing both work.
-
StatefulSets: Stable Identity and Ordered StartupPaid
A Deployment's Pods are interchangeable and get random names.
-
Static PodsPaid
Your control plane is four static pods.
-
Storage for StatefulSets: volumeClaimTemplatesPaid
volumeClaimTemplates gives every replica its own claim, named by ordinal.
-
StorageClasses and Dynamic ProvisioningPaid
A claim with no PersistentVolume behind it, deliberately stuck Pending until a Pod appears.
-
Gateway APIPaid
Ingress replaced with three objects owned by three different people, plus weighted splits and header matching without a single annotation.
-
Helm BasicsPaid
Helm templates YAML and remembers what it sent, which is what makes rollback work.
-
Highly Available Control Planes and etcd QuorumPaid
A three-node control plane built from scratch: keepalived and haproxy in front, stacked etcd behind, and a controlPlaneEndpoint that has to exist before the first init.
-
HorizontalPodAutoscalerPaid
Put real load on a Deployment and watch it go from one replica to six.
-
Docker Image Layers and Build Cache
Why instruction order decides whether your build takes one second or ninety.
-
Troubleshooting ImagePullBackOff
Two Pods with the same status and completely different problems: one image tag does not exist, one registry cannot be resolved.
-
Troubleshooting Ingress 404 and 502 Errors
The status code tells you which hop failed, and that is most of the diagnosis. 404 means nothing matched, 503 means matched but no backend, 502 means the backend answered badly.
-
Ingress ControllersPaid
An Ingress is a request that some controller has to answer.
-
Ingress Routing RulesPaid
The obvious path-based Ingress returns 404, and the 404 comes from your application rather than the controller.
-
Init Containers and Startup OrderPaid
Init containers run to completion, one at a time, before any app container starts.
-
Jobs and CronJobsPaid
Every other controller keeps Pods running forever.
-
kube-proxy: iptables and IPVS ModesPaid
Trace one Service from its ClusterIP through three iptables chains to the DNAT rule that rewrites the packet, then switch a cluster to IPVS and read the same routing out of ipvsadm.
-
kubectl debug and Ephemeral Containers
A distroless container refuses every exec because it contains no shell.
-
kubeconfig Contexts and Multi-Cluster AccessPaid
Stop SSH-ing to the control plane to run kubectl.
-
Troubleshooting a Kubelet That Will Not Start
Break the kubelet's config and restart it. systemctl reports activating, which reads like progress and means a restart loop.
-
Kustomize BasicsPaid
One base, one overlay per environment, no templating language.
-
Labels, Selectors and nodeSelectorPaid
Labels are the only way anything in Kubernetes finds anything else.
-
LoadBalancer Services on Bare Metal with MetalLBPaid
A LoadBalancer Service off-cloud sits at Pending forever, because nothing is listening for it.
-
Metrics Server and Resource Pressure
The same node reads 1% CPU in kubectl top and 5% in describe node.
-
Moving Docker Images Without a Registry
Registries are the normal path, but not always an available one.
-
Docker Multi-Stage Builds
Compilers, headers and package managers belong in the build, not in the thing you ship.
-
Namespaces, ResourceQuotas and LimitRangesPaid
A quota caps a namespace in total, a LimitRange constrains each container, and they are enforced at different moments by different code.
-
Troubleshooting NetworkPolicy-Blocked Traffic
A NetworkPolicy denial times out rather than refusing, which makes it look like a dead backend.
-
NetworkPolicy Default DenyPaid
Prove that an empty cluster lets everything talk to everything, close it with a four-line policy, then open exactly one path.
-
NetworkPolicy PatternsPaid
Allow a whole namespace, then restrict egress and watch the Pod lose DNS while still reaching the same backend by IP.
-
Choosing and Installing a CNI PluginPaid
Why a fresh kubeadm cluster has no pod network, what a CNI plugin actually installs, how to choose between Calico, Cilium and Flannel, and how to read what Calico did to your nodes: one address block per node, routes to its neighbours, and encapsulation it turns out not to be using.
-
Cluster Triage Order
Under pressure, the order you check things in matters more than knowing every command.
-
Docker Compose Multi-Service Applications
The shape almost every real project takes: an application talking to a database over the project network, with the data on a named volume that survives a teardown.
-
Docker Compose Environment and Secrets
Four different things all called environment, doing four different jobs.
-
Docker Compose Health Checks and Dependencies
Up does not mean ready, and the gap between them is where flaky startups live.
-
Docker Compose Profiles, Overrides and Watch
Three features that turn one Compose file into a workflow: optional services behind profiles, per-machine overrides that merge automatically, and live file sync that updates a running container without a rebuild.
-
ConfigMaps and SecretsPaid
Four ways to hand configuration to a container, and the one difference that catches everyone: patch a ConfigMap and the mounted file updates while the environment variable does not.
-
Docker Container Logs and Rotation
Container logs are files on the host and by default they grow without limit.
-
Container Logs with kubectl logs
A two-container Pod, and the flags that turn kubectl logs from a firehose into an answer: picking a container, all of them at once with prefixes, a time window, timestamps, and selecting by label across Pods.
-
Control Plane and Node ComponentsPaid
Every diagram of Kubernetes architecture shows five boxes.
-
Troubleshooting a Down Control Plane
Take the API server away and every kubectl command dies with it. crictl still answers, because it talks to the runtime rather than the cluster, and it is the only view you have left of a control plane that cannot report on itself.
-
CoreDNS and Service DiscoveryPaid
Resolve one Service four ways, get a headless Service to hand back every Pod IP, and measure the real cost of a short name by counting the queries CoreDNS receives: five for `fleet`, one for the fully qualified name.
-
Troubleshooting CrashLoopBackOff
A container that exits 3 on startup, caught mid-cycle.
-
CSI DriversPaid
Kubernetes has no storage code of its own.
-
Custom Resources and OperatorsPaid
A CRD gives you a real Kubernetes resource with validation, printer columns, RBAC and kubectl support, for the cost of one YAML file.
-
DaemonSetsPaid
A DaemonSet has no replica count.
-
Declarative Versus Imperative Object ManagementPaid
Create the same Deployment twice, once with a command and once with a file, then look at what each left behind on the object.
-
Deployment Rollouts and RollbacksPaid
Write a Deployment, follow the ownership chain down to the Pods, roll an image forward and back, read what a revision records, and push a broken image to watch the rollout stall while the old ReplicaSet keeps serving every request.
-
Troubleshooting DNS Resolution Failures
A name that does not exist answers instantly; a resolver that cannot be reached takes the whole timeout.
-
Docker Compose Fundamentals
One file replaces a page of docker run flags.
-
Endpoints and EndpointSlicesPaid
A Service is a selector; the EndpointSlice is the answer to it.
-
etcd Backup and RestorePaid
Take a snapshot, create something after it, then restore and watch that thing cease to exist.
-
Troubleshooting Unhealthy etcd
Stop etcd and the API server stays up, which changes the symptom completely: requests time out instead of being refused, and livez reports every check ok except one.
-
Events, describe and Object Status
Almost every Kubernetes failure explains itself in one of three places: an event, the Events section of describe, or a status condition.
-
Four-Node kubeadm Cluster SetupPaid
Build a control plane and three workers, then use the third worker to reach the placement features that need it: pod anti-affinity with somewhere to spread to, topology spread constraints, and a drain that leaves two healthy workers behind.
-
Access Modes and Reclaim PoliciesPaid
Ask a node-local provisioner for ReadWriteMany and watch the claim hang.
-
Docker Volume Backup and Restore
A named volume has no export command.
-
Building Images with Dockerfiles
Write a five-instruction Dockerfile, build it, run it, then build it again and watch the cache turn a 0.6 second build into 0.1.
-
Docker Build Cache Mounts and Secrets
Two BuildKit features that solve problems the layer cache cannot: a package cache that survives --no-cache, and a way to use a private token during a build without it ending up in the image.
-
Docker Buildx and Multi-Platform Images
One tag serving amd64, arm64 and arm/v7.
-
Calico Internals and Policy EnforcementPaid
Pod networking stops being magic once you can see the pieces: a per-node IPAM block, one veth and one host route per Pod, a blackhole for the local block, and Felix rendering policy into the node's packet filter.
-
Docker Daemon Configuration
daemon.json changes every container on the host, and a malformed file stops Docker starting at all.
-
Docker User-Defined Networks and DNS
Why containers on the default bridge cannot find each other by name, and how one command fixes it.
-
Docker Containers, Images, Registries and Daemon
The four things every later guide assumes you understand, each demonstrated with a command rather than a diagram: why the client and daemon are separate, how an image differs from a container, what a registry actually stores, and where a digest comes from.
-
Docker Daemon and Container Events
The event stream is the timeline logs do not give you.
-
Docker Contexts and Remote Hosts
Drive a Docker host across the network from your own machine, using SSH rather than an exposed daemon port.
-
Dockerfile Instructions in Practice
ARG versus ENV, ENTRYPOINT versus CMD, and why USER matters - shown with one Dockerfile that exercises all of them and the inspect output proving what each instruction actually recorded.
-
Docker Build Context and .dockerignore
What the trailing dot in docker build actually sends, why a stray 3MB file made the image 6MB bigger, and how one .dockerignore file cut the transfer from 3.00MB to 138B.
-
Essential Docker CLI Commands
The dozen commands that cover most day-to-day container work, grouped by what you are trying to do rather than alphabetically.
-
Inspecting Docker Containers and Processes
How to answer the four questions you ask when something is wrong: what state is it in, what is it printing, what is it running, and what is it consuming.
-
Docker Engine Installation on Ubuntu 26.04
Install Docker Engine from the official apt repository on Ubuntu 26.04, confirm the daemon is running, watch a real multi-layer image pull, and drop the sudo prefix.
-
Docker Network Drivers Beyond Bridge
Bridge is the default, not the only option.
-
Docker Volumes and Bind Mounts
Anything written inside a container dies with it.
-
Docker PID 1, Signals and Graceful Shutdown
Why docker stop takes ten seconds and ends in exit 137, even for a process that should die instantly.
-
Docker Private Registry Authentication
Run a registry that demands credentials, watch an unauthenticated push get refused, log in properly - then look at where Docker actually put your password.
-
Docker Port Publishing and Container Networking
Why -p 8080:80 works, why two containers on the default bridge cannot find each other by name, and why creating your own network fixes it.
-
Running and Managing Docker Containers
Run a throwaway container, then a long-running web server, and drive it through its whole lifecycle - start, stop, restart, remove.
-
Docker Image Vulnerability Scanning
Scan a deliberately old base image, read what comes back, then prove the fix: the same scan against a current base returns zero findings.
-
Docker Engine Upgrade, Pinning and Removal
How to see which versions exist, upgrade safely, pin a version so an unrelated apt upgrade cannot move it, roll back, and remove Docker without destroying the volumes that hold your data.
-
Docker Container Process Model
A container is an ordinary Linux process with a restricted view of the machine.