Kubernetes

19 units, 90 lessons and 173 questions on Kubernetes. Includes a full-length CKA (Kubernetes v1.35) mock exam drawn in the published domain weights, marked with a per-domain breakdown. Free, and open without an account.

The exam it prepares for: Certified Kubernetes Administrator (CKA (Kubernetes v1.35)), pass Not published on the exam page; the exam is hands-on.

What is in it

Container Fundamentals

Master Docker and containerization basics before diving into Kubernetes

  • What are Containers? — Understanding containerization basics
  • Docker Images & Containers — Learn about Docker images and containers
  • Building Docker Images — Create your own Docker images
  • Container Networking — How containers communicate
  • Container Volumes — Persisting data in containers

Kubernetes Introduction

Learn what Kubernetes is and its core architecture

  • Why Kubernetes? — The problems Kubernetes solves
  • Kubernetes Architecture — Control plane and worker nodes
  • kubectl Basics — Your primary tool for Kubernetes
  • Minikube & Local Setup — Setting up your learning environment
  • Kubernetes API — Understanding the K8s API

Pods & Workloads

Understand the smallest deployable units in Kubernetes

  • Introduction to Pods — The smallest unit in Kubernetes
  • Creating Your First Pod — Deploy a pod from YAML
  • Multi-Container Pods — Running multiple containers in a pod
  • Pod Lifecycle — Understanding pod phases and states
  • Labels & Selectors — Organizing and selecting pods
  • ReplicaSets — Maintaining pod replicas

Services & Networking

Learn how to expose and connect your applications

  • Kubernetes Networking Model — Understanding pod-to-pod communication
  • Service Types — ClusterIP, NodePort, LoadBalancer
  • Creating Services — Expose your applications
  • Service Discovery — DNS and environment variables
  • Ingress Controllers — HTTP(S) routing to services
  • Network Policies — Control traffic between pods

Configuration & Secrets

Manage application configuration and sensitive data

  • Environment Variables — Basic configuration methods
  • ConfigMaps — Store non-sensitive configuration
  • Using ConfigMaps — Inject config into pods
  • Secrets — Handle sensitive information
  • Secret Types — Different secret types and use cases
  • External Secrets — Integrating with secret managers

Storage & Persistence

Handle data persistence in Kubernetes

  • Volumes — Temporary storage in pods
  • PersistentVolumes — Cluster-wide storage resources
  • PersistentVolumeClaims — Requesting storage
  • StorageClasses — Dynamic volume provisioning
  • StatefulSet Storage — Stable storage for stateful apps

Deployments & Scaling

Master application lifecycle and horizontal scaling

  • Deployments — Declarative updates for pods
  • Rolling Updates — Update applications without downtime
  • Rollbacks — Reverting to previous versions
  • Horizontal Pod Autoscaling — Auto-scale based on metrics
  • Resource Requests & Limits — Managing CPU and memory
  • Health Checks — Liveness and readiness probes

Security & RBAC

Secure your cluster with role-based access control

  • Security Contexts — Pod and container security settings
  • Service Accounts — Identity for pods
  • RBAC Basics — Role-based access control
  • Roles & RoleBindings — Namespace-level permissions
  • ClusterRoles — Cluster-wide permissions
  • Pod Security Standards — Enforce security policies

Monitoring & Logging

Observe and debug your applications

  • Metrics Server — Basic resource metrics
  • Prometheus Basics — Introduction to Prometheus
  • Grafana Dashboards — Visualizing metrics
  • Logging Patterns — Centralized logging strategies
  • ELK Stack — Elasticsearch, Logstash, Kibana
  • Distributed Tracing — Tracing requests across services

Advanced Patterns

StatefulSets, DaemonSets, Jobs, and CronJobs

  • StatefulSets — Managing stateful applications
  • DaemonSets — Run pods on every node
  • Jobs — Run tasks to completion
  • CronJobs — Scheduled tasks
  • Init Containers — Setup containers for pods
  • Pod Disruption Budgets — Maintain availability during updates

Helm & Package Management

Use Helm to manage Kubernetes applications

  • Introduction to Helm — The package manager for Kubernetes
  • Helm Charts — Understanding chart structure
  • Installing Charts — Deploy applications with Helm
  • Creating Charts — Build your own Helm charts
  • Chart Repositories — Managing and sharing charts
  • Helm Hooks — Lifecycle management

Cluster Administration

Learn to build and manage production clusters

  • Cluster Setup Methods — kubeadm, kops, and more
  • etcd Management — The cluster database
  • Cluster Upgrades — Upgrading Kubernetes versions
  • Backup & Disaster Recovery — Protecting cluster state
  • Node Management — Adding, removing, and maintaining nodes
  • Cluster Troubleshooting — Debugging cluster issues

Custom Resources & Operators

Extend Kubernetes with custom functionality

  • Custom Resource Definitions — Extending the Kubernetes API
  • Controllers — The control loop pattern
  • Operator Pattern — Application-specific controllers
  • Operator Framework — Building operators easily
  • Admission Controllers — Intercepting API requests
  • Webhooks — Validating and mutating webhooks

Production Best Practices

Master production-grade Kubernetes deployments

  • Multi-Tenancy — Sharing clusters safely
  • GitOps — Git as source of truth
  • CI/CD Integration — Automated deployments
  • Cost Optimization — Running Kubernetes efficiently
  • Service Mesh — Istio and other service meshes
  • Production Checklist — Final best practices

CKA · Cluster architecture, installation and configuration

Control plane components, RBAC, cluster upgrades, etcd backup and restore. 25% of the exam.

  • RBAC: roles, bindings and scope — A Role grants permissions in one namespace; a ClusterRole grants them cluster-wide or on cluster-scoped resources. A RoleBinding can bind a ClusterRole into a single namespace, which is how one definition is reused.
  • etcd backup and restore — etcd holds the entire cluster state. etcdctl snapshot save takes a backup; restoring creates a new data directory the API server must then be pointed at. The endpoints, cert, key and CA flags are always required.

CKA · Workloads and scheduling

Deployments and rollouts, configuration, resource limits, and how the scheduler places pods. 15% of the exam.

  • Scheduling: requests, taints and affinity — Requests decide where a pod fits; limits decide when it is throttled or killed. A taint repels pods unless they tolerate it; node affinity attracts them. Tolerating a taint does not guarantee placement.
  • Rollouts, ConfigMaps and Secrets — A Deployment rolls out by creating a new ReplicaSet and shifting replicas. A ConfigMap mounted as a volume updates in the pod; one consumed as an environment variable does not until the pod restarts.

CKA · Services and networking

Service types, DNS, Ingress, network policies and the cluster network model. 20% of the exam.

  • Services and how traffic reaches a pod — ClusterIP is internal, NodePort opens a port on every node, LoadBalancer asks the cloud for one. A Service finds its pods by label selector, and the Endpoints or EndpointSlice object is the evidence it found them.
  • Network policies — Pods accept all traffic until a NetworkPolicy selects them; from then on only what is explicitly allowed. Policies are additive, and they require a CNI plugin that implements them.

CKA · Storage

Volumes, persistent volumes and claims, storage classes and access modes. 10% of the exam.

  • PersistentVolumes, claims and binding — A PVC asks for storage; a PV provides it; a StorageClass creates one on demand. Binding matches capacity, access mode and class, and a claim that matches nothing stays Pending.

CKA · Troubleshooting

Cluster and node failures, misconfigured workloads, logs and network problems. The largest domain at 30%, and the one most study material under-serves.

  • Reading pod failure states — Pending is scheduling; ImagePullBackOff is the registry; CrashLoopBackOff is the application exiting; CreateContainerConfigError is a missing ConfigMap or Secret. The state names the layer to look at.
  • Diagnosing cluster and network problems — Events first, then logs, then the component. kubectl describe surfaces the events attached to an object; component logs are in the static pods or the journal, depending on how the cluster was built.

Open the Kubernetes course · sit the CKA (Kubernetes v1.35) mock exam · try 10 practice questions first