Certified Kubernetes Administrator (CKA) Flashcards

It is organized into 5 competency domains: Cluster Architecture, Installation & Configuration; Workloads & Scheduling; Services & Networking; Storage; and Troubleshooting.

Troubleshooting is the most heavily weighted domain at 30% of the exam.

Candidates get 2 hours (120 minutes) to complete 15-20 performance-based tasks.

A score of 66% or above is required to pass.

The CKA certification is valid for 2 years from the date it is earned.

It is remotely proctored through PSI's Bridge platform using the PSI Secure Browser, with live monitoring via streaming audio, video, and screen sharing.

It is a hands-on, performance-based test where candidates solve multiple real tasks directly from a command line on a live Kubernetes cluster, rather than answering multiple-choice questions.

kubectl create imperatively creates a new resource and fails if it already exists; kubectl apply declaratively creates or updates a resource by reconciling a YAML manifest against the live state, making it safe to re-run.

It is the front-end control-plane component that exposes the Kubernetes API, validates and processes REST requests, and is the only component that talks directly to etcd.

etcd is the cluster's consistent, distributed key-value store holding all cluster state and configuration data, including object specs and status.

It watches for newly created Pods with no assigned node and selects a node for them to run on based on resource requirements, constraints, affinity rules, and taints/tolerations.

It is the primary node agent that ensures containers described in PodSpecs are running and healthy, reporting node and pod status back to the control plane.

A Deployment manages a ReplicaSet of Pods declaratively, providing rolling updates, rollbacks, and self-healing to maintain a desired number of Pod replicas.

A StatefulSet manages stateful applications by giving Pods stable, unique network identities and persistent storage that survives rescheduling — used for workloads like databases that need stable identity and ordered deployment/scaling.

A controller that ensures a copy of a Pod runs on every (or a selected subset of) node in the cluster — commonly used for log collectors, monitoring agents, or CNI plugins.

A Service defines a stable virtual IP and DNS name that load-balances traffic to a dynamic set of Pods selected by label selectors, decoupling clients from individual Pod IPs which change as Pods are recreated.

ClusterIP (internal-only virtual IP, the default), NodePort (exposes the service on a static port on every node), LoadBalancer (provisions an external cloud load balancer), and ExternalName (maps the service to a DNS name).

An API object that manages external HTTP/HTTPS access to Services within a cluster, typically providing host- and path-based routing, TLS termination, and load balancing, and requires an Ingress controller to function.

A Secret is intended for sensitive data (passwords, tokens, keys) and is base64-encoded rather than stored in plain text, with tighter access controls, though it is not encrypted at rest by default without additional configuration.

A PersistentVolume is a cluster-level piece of storage provisioned by an admin or dynamically via a StorageClass; a PersistentVolumeClaim is a user's request for storage that binds to a matching PV, abstracting the underlying storage details from Pods.

Taints are applied to nodes to repel Pods from scheduling onto them unless the Pod has a matching toleration, allowing nodes to be reserved for specific workloads.

kubectl describe pod <name> to inspect events, container statuses, and conditions, often followed by kubectl logs <name> to check container output.

Use kubectl drain <node>, which safely evicts running Pods (respecting PodDisruptionBudgets) and cordons the node to prevent new scheduling; kubectl uncordon reallows scheduling afterward.

A NetworkPolicy is a namespace-scoped resource that controls traffic flow between Pods (and to/from external endpoints) at the IP/port level, enforced by a compatible CNI plugin — it is deny-by-default only once a policy selects a Pod.

kubeadm is the official bootstrapping tool used to initialize a Kubernetes control-plane node (kubeadm init) and join worker nodes (kubeadm join), and is also used for cluster upgrades.

Use etcdctl snapshot save to create a point-in-time backup of the etcd data store, and etcdctl snapshot restore to recover cluster state from that snapshot — critical for disaster recovery of control-plane state.