CKA (Other exams) cheat sheet

kubeadm init bootstraps control plane: static pods for kube-apiserver, controller-manager, scheduler live in /etc/kubernetes/manifests; kubelet watches that directory.

kubeadm join requires a bootstrap token (kubeadm token create --print-join-command) and a CA cert hash; tokens are stored as Secrets in kube-system with type bootstrap.kubernetes.io/token.

etcd snapshot: ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=... --key=... snapshot save /backup.db; restore uses snapshot restore with --data-dir.

RBAC evaluation: request is allowed if any RoleBinding/ClusterRoleBinding grants it; deny is implicit. ClusterRole + ClusterRoleBinding = cluster-wide; RoleBinding can bind a ClusterRole but only within the namespace.

Certificate renewal: kubeadm certs renew all; check expiry with kubeadm certs check-expiration; kubelet client certs rotate automatically when --rotate-certificates=true.

Upgrade order: upgrade kubeadm, then control plane (kubeadm upgrade apply vX.Y.Z), then kubelets (kubeadm upgrade node on each node), then drain/uncordon workloads; never skip minor versions.

Node components: kubelet registers Node object; kube-proxy programs iptables/IPVS; container runtime implements CRI. Use crictl for runtime-level debugging.

Static pod manifests are not managed by the API server; editing a file in /etc/kubernetes/manifests triggers kubelet to recreate the pod (brief API server outage possible).

kubeconfig precedence: --kubeconfig flag > KUBECONFIG env (colon-separated merge) > ~/.kube/config; kubectl config view --minify shows the effective context.

Deployment rolling update defaults: maxSurge 25%, maxUnavailable 25%; rollback with kubectl rollout undo deployment/NAME --to-revision=N; history limited by revisionHistoryLimit (default 10).

Pod QoS classes: Guaranteed (requests==limits for all containers), Burstable (requests<limits), BestEffort (no requests/limits). Eviction order: BestEffort first, then Burstable, Guaranteed last.

Taints and tolerations: NoSchedule blocks new pods without toleration; NoExecute evicts existing pods; PreferNoSchedule is soft. Toleration operator Exists matches any value.

nodeSelector is exact label match; nodeAffinity supports requiredDuringSchedulingIgnoredDuringExecution (hard) and preferred (soft); podAffinity/antiAffinity use topologyKey.

ResourceQuota limits aggregate namespace usage (requests.cpu, limits.memory, pods count); LimitRange sets per-pod defaults and min/max; admission rejects pods exceeding quota.

HorizontalPodAutoscaler v2 reads metrics from metrics-server; scaleTargetRef points to Deployment/StatefulSet; behavior.scaleDown.stabilizationWindowSeconds dampens flapping.

DaemonSet runs one pod per eligible node; tolerates node-role.kubernetes.io/control-plane:NoSchedule by default in recent versions; update strategy RollingUpdate with maxUnavailable.

Job completions/parallelism control batch work; backoffLimit caps retries; ttlSecondsAfterFinished deletes completed Jobs. CronJob schedule uses standard cron syntax with timeZone field (v1.27+).

PriorityClass sets pod priority; higher value preempts lower-priority pods on a node when resources are insufficient; system-cluster-critical is reserved for core components.

Service types: ClusterIP (default, virtual IP), NodePort (30000-32767 range by default), LoadBalancer (cloud LB), ExternalName (CNAME). headless (clusterIP: None) returns pod IPs via DNS.

kube-proxy modes: iptables (default, random backend selection), IPVS (better scale, supports more schedulers), nftables (newer). Endpoints/EndpointSlice objects list ready pod IPs.

DNS: pod resolves ..svc.cluster.local; CoreDNS Service is kube-dns in kube-system. ndots:5 in resolv.conf causes search-list expansion before absolute lookup.

NetworkPolicy is additive allow-list; default deny all ingress with podSelector {} and no ingress rules. Egress policies require egress rule blocks; policyTypes must include Egress.

Ingress requires an Ingress controller (e.g., ingress-nginx); rules match host and path with pathType Prefix/Exact/ImplementationSpecific; TLS block references a Secret of type kubernetes.io/tls.

CNI plugin (Calico, Cilium, Flannel) provides pod networking and IPAM; kubelet calls CNI on pod sandbox creation. Missing CNI => pods stuck in ContainerCreating.

Service endpoints empty => selector mismatch or pods not Ready; check kubectl get endpointslices and pod readiness probes.

ClusterIP is only reachable inside the cluster; use kubectl port-forward or NodePort/LoadBalancer for external access during debugging.

Ingress vs Gateway API: Ingress is stable and simple; Gateway API (GatewayClass, Gateway, HTTPRoute) is the successor with role-oriented resources.

Volume types: emptyDir (pod lifetime), hostPath (node path, unsafe), configMap/secret (projected files), persistentVolumeClaim (binds to PV), projected (combines sources).

PV access modes: ReadWriteOnce (single node), ReadOnlyMany, ReadWriteMany (shared FS), ReadWriteOncePod (single pod, v1.22+). Not all plugins support all modes.

PVC binding: Immediate vs WaitForFirstConsumer volumeBindingMode; StorageClass provisioner creates PV dynamically; reclaimPolicy Retain/Delete/Recycle.

Default StorageClass is annotated storageclass.kubernetes.io/is-default-class: "true"; PVC without storageClassName uses it; empty string disables dynamic provisioning.

StatefulSet uses volumeClaimTemplates to create per-replica PVCs named --; PVCs persist after pod deletion.

Expand a PVC only if StorageClass allowVolumeExpansion: true; edit spec.resources.requests.storage; file system resize may require pod restart for some drivers.

A PV in Released state after PVC deletion must be manually reclaimed (remove claimRef) if reclaimPolicy is Retain; Available state means unbound.

CSI drivers implement dynamic provisioning; check CSIDriver and CSINode objects; VolumeSnapshot requires snapshot.storage.k8s.io CRDs and a snapshot controller.

Mount propagation (hostPath mountPropagation: Bidirectional) is needed for CSI node plugins to see mounts created by kubelet.

Pod states: Pending (unschedulable or no PV), ContainerCreating (image pull, CNI, volume mount), CrashLoopBackOff (app exit), ImagePullBackOff (registry/auth/name), Terminating (finalizers).

kubectl describe pod Events section is the first diagnostic; kubectl logs -p shows previous container logs; kubectl logs --all-containers for multi-container pods.

Node NotReady: check kubelet systemctl status kubelet, journalctl -u kubelet, and node conditions via kubectl describe node; common causes: disk pressure, certificate expiry, CNI down.

kubectl exec -it POD -- sh for in-container checks; kubectl debug with ephemeral containers (--image=busybox --target=container) when image lacks tools.

Service unreachable: verify endpoints, NetworkPolicy, kube-proxy pods, and DNS resolution with nslookup from a debug pod; check conntrack table exhaustion on nodes.

API server unavailable: check static pod logs via crictl logs on control-plane node; etcd health via etcdctl endpoint health; certificates in /etc/kubernetes/pki.

OOMKilled exit code 137 indicates memory limit exceeded; check kubectl describe pod Last State; increase limits or fix leak. Exit code 1 = application error.

kubectl get events --sort-by=.lastTimestamp -A gives cluster-wide recent events; useful for scheduling and image pull failures.

Control plane component logs: kubectl logs -n kube-system kube-controller-manager- (static pod) or crictl logs when API is down.

CrashLoopBackOff: kubectl logs POD --previous; check liveness/readiness probe failures (probe timeouts, wrong port/path); kubectl describe pod shows probe events.

Pending due to insufficient resources: kubectl describe pod shows FailedScheduling with node resource summary; check requests vs allocatable; consider PriorityClass or node scaling.

ImagePullBackOff: verify image name/tag, imagePullSecrets, registry reachability from node (crictl pull), and that the node can resolve the registry DNS.

Readiness probe failure removes pod from Service endpoints; liveness probe failure restarts container; startupProbe gates the other probes for slow-starting apps.

PVC Pending: check StorageClass exists, provisioner pod running, and events on PVC; WaitForFirstConsumer requires a scheduled pod before binding.

kubectl top nodes/pods requires metrics-server; if missing, install metrics-server and check its APIService is Available (kubectl get apiservice v1beta1.metrics.k8s.io).

Node disk pressure evicts pods; check df -h on node and kubelet eviction thresholds (imagefs, nodefs); clean unused images with crictl rmi --prune.

NetworkPolicy debugging: temporarily apply an allow-all policy to isolate; use kubectl exec from a test pod to curl service ClusterIP and pod IP directly.

kubelet fails to start: check /var/lib/kubelet/config.yaml, kubelet.env, and that the container runtime socket exists (cri-dockerd or containerd).