CKA (Other exams) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

kubeadm init

Bootstraps a Kubernetes control plane: generates certificates, writes static pod manifests to /etc/kubernetes/manifests, and prints a join command for worker nodes.

Static pod

A pod managed directly by the kubelet from a manifest file on disk, not by the API server. Control plane components run as static pods in /etc/kubernetes/manifests.

etcd snapshot

A point-in-time backup of the etcd datastore created with etcdctl snapshot save. Restore with snapshot restore into a new data directory, then point etcd at it.

RBAC RoleBinding

Grants the permissions in a Role or ClusterRole to subjects (users, groups, service accounts) within one namespace. ClusterRoleBinding grants cluster-wide.

kubeadm certs renew

Renews control plane certificates (apiserver, etcd, front-proxy). Run kubeadm certs check-expiration to see remaining validity; kubelet certs rotate automatically.

kubeconfig precedence

The --kubeconfig flag overrides the KUBECONFIG environment variable, which overrides ~/.kube/config. KUBECONFIG can list multiple files merged in order.

Rolling update defaults

Deployments default to maxSurge 25% and maxUnavailable 25%. Rollback with kubectl rollout undo; revisionHistoryLimit defaults to 10 old ReplicaSets.

Pod QoS classes

Guaranteed requires requests equal limits for all containers; Burstable has requests below limits; BestEffort has none. Eviction order is BestEffort, then Burstable, then Guaranteed.

Taint effect NoExecute

Evicts running pods that lack a matching toleration and prevents new ones from scheduling. NoSchedule only blocks new pods; PreferNoSchedule is a soft preference.

nodeAffinity requiredDuringScheduling

A hard scheduling constraint: the pod only schedules onto nodes matching the label expression. preferredDuringScheduling is a soft weight-based preference instead.

ResourceQuota

Namespace-level admission limit on aggregate resource requests/limits and object counts (pods, services, PVCs). Pods exceeding the quota are rejected at admission time.

HorizontalPodAutoscaler

Scales a Deployment or StatefulSet replica count based on metrics from metrics-server, such as CPU utilization relative to requests. Behavior fields dampen scaling flapping.

DaemonSet

Runs exactly one pod per eligible node, commonly for log agents, CNI, and kube-proxy. It tolerates control-plane taints by default and uses RollingUpdate strategy.

CronJob timeZone

The spec.timeZone field (v1.27+) sets the IANA time zone for the cron schedule. Without it, the controller interprets the schedule in UTC.

Service types

ClusterIP exposes a virtual IP inside the cluster; NodePort also opens a port on every node; LoadBalancer provisions a cloud LB; ExternalName returns a DNS CNAME.

Headless Service

A Service with clusterIP: None. DNS returns individual pod IPs instead of a virtual IP, which StatefulSets use for stable per-pod DNS names.

kube-proxy IPVS mode

Programs IPVS virtual servers for Service load balancing instead of iptables chains. Scales better with many Services and supports scheduling algorithms like rr and lc.

CoreDNS

The cluster DNS server deployed as the kube-dns Service in kube-system. It resolves <service>.<namespace>.svc.cluster.local and forwards external queries upstream.

NetworkPolicy default deny

A policy with podSelector: {} and policyTypes: [Ingress] and no ingress rules denies all ingress to selected pods. Policies are additive allow-lists.

Ingress pathType

Prefix matches path segments, Exact matches the full path, and ImplementationSpecific delegates matching to the controller. Host and TLS blocks are optional.

CNI plugin

Container Network Interface plugin (Calico, Cilium, Flannel) that assigns pod IPs and programs routes. Kubelet invokes it when creating a pod sandbox; absence leaves pods in ContainerCreating.

emptyDir volume

A scratch volume created when the pod starts and deleted when the pod is removed. Data survives container restarts within the same pod but not pod rescheduling.

PV access modes

ReadWriteOnce allows one node; ReadOnlyMany allows many nodes read-only; ReadWriteMany allows many nodes read-write; ReadWriteOncePod allows a single pod. Plugin support varies.

volumeBindingMode

Immediate binds a PVC as soon as it is created; WaitForFirstConsumer delays binding until a pod using the PVC is scheduled, respecting node topology constraints.

Default StorageClass

A StorageClass annotated storageclass.kubernetes.io/is-default-class: "true". PVCs without a storageClassName use it for dynamic provisioning; an empty string disables it.

StatefulSet volumeClaimTemplates

Creates one PVC per replica, named <template>-<statefulset>-<ordinal>. These PVCs persist after pod deletion and are reattached when the pod is recreated.

PVC expansion

Increase spec.resources.requests.storage on a PVC only if the StorageClass has allowVolumeExpansion: true. Some drivers require a pod restart to complete file system resize.

PV Released state

A PV whose bound PVC was deleted. With reclaimPolicy Retain it stays Released and must be manually reclaimed by removing the claimRef before reuse.

CrashLoopBackOff

The container repeatedly exits and kubelet restarts it with exponential backoff. Inspect previous logs with kubectl logs --previous and probe failures in describe output.

OOMKilled exit code 137

Indicates the container exceeded its memory limit and was killed by the kernel OOM killer. Raise limits.memory or fix the leak; check Last State in kubectl describe pod.

Node NotReady

The node's Ready condition is False, often due to a stopped kubelet, expired certificates, or a missing CNI. Check journalctl -u kubelet and node conditions.

kubectl debug ephemeral container

Attaches a temporary container to a running pod with a chosen image and optional --target to share process namespace, useful when the app image lacks debugging tools.