Certified Kubernetes Administrator Practice

Kubernetes is a portable container orchestration platform that automates deployment, scaling, and management of containerized applications. It is not a VM manager, database, or hardware appliance.

A node is a worker machine, either physical or virtual, where pods are scheduled and run. The control plane manages nodes and does not run user workloads directly.

The control plane includes the API server, scheduler, controller manager, and etcd. Worker nodes run pods, and volumes and ingress are workload resources.

kube-scheduler assigns pods to nodes based on resources, constraints, and policies. kubelet runs on nodes, etcd stores state, and kube-proxy maintains network rules.

etcd is a distributed key-value store that holds cluster state. kubelet manages pods on a node, kube-proxy handles networking rules, and the runtime runs containers.

kubelet is the node agent that ensures containers in pods are running. The API server, scheduler, and controller manager are control plane components.

kube-proxy maintains network rules that enable communication to Services from inside or outside the cluster. etcd stores state, the scheduler places pods, and CoreDNS provides DNS.

kubeadm bootstraps a conformant Kubernetes cluster with kubeadm init and kubeadm join. kubectl talks to the API, helm packages charts, and kustomize manages manifests.

kubeconfig stores connection details for clusters, users, and contexts so kubectl knows how to authenticate. It is not a manifest, storage class, or image.

A context selects which cluster, user, and namespace kubectl uses by default. It does not combine nodes, pods, services, or ingresses.

kubectl cluster-info displays information about the cluster and its services. The other commands show secrets, drain nodes, or display resource usage.

A namespace divides cluster resources into logical groups for isolation and management. It is not a server, image, or plugin.

A pod is the smallest deployable unit and can contain one or more containers that share networking and storage. Containers run inside pods.

A DaemonSet ensures that a copy of a pod runs on every node, which is useful for logging and monitoring agents. Deployments and StatefulSets manage a selected set of pods, and Jobs run to completion.

A Deployment manages stateless apps with rolling updates, rollbacks, and scaling. StatefulSet is for stateful apps, DaemonSet runs on every node, and CronJob runs scheduled jobs.

A Job creates one or more pods and ensures they run until completion. Deployments run continuously, DaemonSets run on all nodes, and ReplicaSets maintain a replica count.

A CronJob runs Jobs on a time-based schedule, similar to cron. Deployments and StatefulSets run continuous workloads, and Services expose pods.

A ReplicaSet maintains a desired number of identical pod replicas. DaemonSets run one per node, StatefulSets provide stable identity, and Services provide DNS and load balancing.

nodeSelector schedules a pod only on nodes with specified labels. resources defines requests and limits, securityContext sets security options, and restartPolicy controls container restarts.

A resource request tells the scheduler the minimum CPU and memory a container needs and helps it choose a node. Limits cap usage, labels select nodes, and affinity controls placement.

A resource limit caps CPU and memory usage for a container. Requests are minimum guarantees, quotas limit namespaces, and storage sizes are separate.

A taint marks a node so that only pods with a matching toleration can be scheduled there. It does not delete pods, scale replicas, or create volumes.

A toleration lets a pod be scheduled on a node with a matching taint. It is not a limit, policy, or secret.

A liveness probe determines if a container is alive; if it fails, kubelet restarts the container. Readiness probes check if a pod should receive traffic, not whether it should be restarted.

A Service provides stable networking for pods and load balances traffic. Ingress routes HTTP traffic to Services, ConfigMap holds config, and PersistentVolume provides storage.

NodePort exposes a Service on a static port on every node, making it reachable from outside the cluster. ClusterIP is internal, LoadBalancer provisions a cloud load balancer, and ExternalName maps a DNS name.

A LoadBalancer Service provisions an external load balancer from the cloud provider. NodePort exposes node ports, ClusterIP is internal, and a headless Service has no cluster IP.

An Ingress exposes HTTP and HTTPS routes from outside the cluster to Services. ConfigMap holds config, namespaces partition resources, and ServiceAccounts identify pods.

ClusterIP is the default Service IP, reachable only from inside the cluster. Public IPs and node IPs are external, and ingress uses its own routing rules.

Kubernetes DNS resolves Service names as service.namespace.svc.cluster.local. The other forms are not valid DNS patterns.

A CNI plugin such as Calico or Flannel implements pod networking. CSI plugins provide storage, ingress controllers route HTTP, and storage classes define storage types.

A PersistentVolume is storage provisioned at the cluster level and consumed by pods through claims. Temporary filesystems and ConfigMaps do not provide durable storage.

A PVC requests storage of a certain size and class and binds to a PersistentVolume. It is not the storage itself, a class, backup, or snapshot.

A StorageClass defines provisioner and parameters for dynamically creating PersistentVolumes. PersistentVolume is static storage, and namespaces and ingress are not storage resources.

A ConfigMap stores non-sensitive configuration such as environment variables and files. Secrets store sensitive data, volumes provide storage, and NetworkPolicies filter traffic.

A Secret stores sensitive data such as passwords, tokens, and keys. ConfigMaps store non-sensitive config, and DNS and scheduling are handled by other components.

A Role defines permissions within a namespace. ClusterRoleBinding binds cluster-wide roles, PersistentVolume provides storage, and NetworkPolicy filters traffic.

A RoleBinding grants the permissions in a Role to a subject such as a user or ServiceAccount. Secrets, ConfigMaps, and DaemonSets do not bind roles.

A ServiceAccount provides an identity for pods when they call the Kubernetes API. It is not an SSH login, storage account, or network Service.

securityContext controls privileges, capabilities, and user IDs for a pod or container. nodeSelector places pods, quotas limit resources, and HPA scales replicas.

A NetworkPolicy defines which pods can communicate with each other based on labels and ports. It is not a DNS, backup, or storage policy.

kubectl logs prints container logs from a pod. top shows resource usage, apply applies manifests, and rollout manages deployment updates.

kubectl describe shows detailed status and events for a resource. get events lists events, exec runs commands in a container, and scale changes replica counts.

kubectl get events lists recent cluster events, useful for troubleshooting. The other commands describe secrets, show node usage, and mark nodes unschedulable.

kubectl exec runs a command in an existing container, such as kubectl exec pod -it -- /bin/sh. run creates a pod, create creates resources, and expose creates a Service.

kubectl drain evicts pods from a node safely so maintenance can be performed. It does not delete the cluster, restart the API server, or create backups.

kubectl cordon marks a node unschedulable so new pods are not placed there, while existing pods keep running. It does not delete the node or restart pods, and taints are set separately.

kubectl apply -f applies configuration from a file or directory. logs prints logs, drain evicts pods, and top shows resource usage.

kubectl delete removes resources such as pods, deployments, and services. create adds resources, describe shows details, and edit modifies resources.

kubectl get pods -A lists pods across all namespaces. get nodes lists nodes, get svc lists Services, and get ns lists namespaces.

kube-controller-manager runs built-in controllers for nodes, replicas, endpoints, and more. The scheduler places pods, cloud-controller-manager handles cloud APIs, and kubelet runs on nodes.

A StatefulSet gives stateful workloads stable network identity and persistent storage. DaemonSets run everywhere, Jobs run batches, and Services expose networking.

Pod affinity and anti-affinity control placement relative to other pods using labels. Resource limits, secret encryption, and volumes are separate concerns.

An HPA adjusts the number of pod replicas based on metrics such as CPU or custom metrics. It does not scale nodes, storage, or DNS.

A headless Service sets clusterIP: None so DNS returns pod IPs directly, useful for stateful workloads. It still exists and can be deleted; it is not a traffic blocker.

kubectl top displays CPU and memory usage for nodes or pods when metrics are available. It does not show DNS, deployments, or logs.

kube-apiserver, kube-scheduler, and etcd are control plane components. kubelet runs on worker nodes and manages pods.

Deployment, DaemonSet, and Job are workload controllers. A pod is the unit they manage, not a controller itself.

kubectl drain evicts pods so a node can be maintained, but it does not permanently remove the node from the cluster. Deleting the node object is a separate operation.

kubectl get lists resources, describe shows detailed status, logs prints container logs, and exec runs commands inside a container.