CKAD flashcards
CKAD · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Job restartPolicy values
- A Job's pod template accepts only Never or OnFailure; Never creates a replacement pod when a container fails, OnFailure restarts the container inside the same pod.
- emptyDir volume lifetime
- An emptyDir is created when the pod is assigned to a node and is deleted when the pod leaves the node; container restarts keep its contents intact.
- init container execution order
- initContainers run one at a time in declaration order and must each exit 0 before app containers start; a failing one triggers pod restart per the restartPolicy.
- Image pull policy defaults
- IfNotPresent is the default for images with a real tag; Always is the default for the :latest tag or an untagged image; Never fails if the image is not already on the node.
- DaemonSet use case
- A DaemonSet runs exactly one copy of a pod on every eligible node, typically for node-level agents such as log shippers, CNI plugins or monitoring daemons.
- ReadWriteOnce access mode
- ReadWriteOnce allows a volume to be mounted read-write by a single node; multiple pods scheduled to that same node can still share the mount.
- Multi-stage COPY --from
- COPY --from=<stage> copies files from an earlier build stage into the final image, so compilers, dependencies and build caches stay out of the shipped image.
- maxSurge and maxUnavailable
- In a rolling update both default to 25 percent; maxSurge caps pods above the desired replica count and maxUnavailable caps pods below it during the rollout.
- Recreate deployment strategy
- Recreate terminates all existing pods before starting new ones, producing downtime but guaranteeing that two versions of the application never run at the same time.
- Rolling back a Deployment
- kubectl rollout undo deployment/<name> reverts to the previous revision; add --to-revision=N to target a specific revision shown by kubectl rollout history.
- Canary traffic split mechanism
- Two Deployments share a common label selected by the Service and each carries a unique version label, so the request share follows the replica ratio.
- helm template command
- helm template renders a chart's manifests locally and prints them without contacting the cluster, useful for inspecting output or piping into kubectl apply.
- What creates a new ReplicaSet
- Editing the pod template of a Deployment creates a new ReplicaSet and starts a rollout; changing only spec.replicas scales the existing ReplicaSet without a new revision.
- Liveness versus readiness probe
- A failing liveness probe restarts the container, while a failing readiness probe only removes the pod from Service Endpoints until the probe passes again.
- Probe timing defaults
- Defaults are periodSeconds 10, timeoutSeconds 1, failureThreshold 3 and successThreshold 1; an httpGet probe treats HTTP status codes 200 through 399 as success.
- Exit code 137 meaning
- Exit code 137 indicates the container was killed by SIGKILL, typically an OOM kill after exceeding the memory limit or a restart triggered by a failed liveness probe.
- kubectl logs previous instance
- kubectl logs <pod> -c <container> --previous shows logs from the prior terminated container instance, which is how a container that already crashed is inspected.
- kubectl debug ephemeral container
- kubectl debug -it <pod> --image=busybox --target=<container> adds an ephemeral container sharing the target's process namespace; it cannot be removed without recreating the pod.
- startupProbe behavior
- While a startupProbe is running, liveness and readiness probes are disabled; once it succeeds they take over, protecting slow-starting applications from premature restarts.
- ConfigMap volume versus env refresh
- Keys mounted as a volume are updated inside the container after the ConfigMap changes, but values injected as environment variables never refresh without a pod restart.
- Secret data versus stringData
- Fields under data must be base64-encoded, while stringData accepts plain text that the API server encodes and merges into data when the object is written.
- Guaranteed QoS class
- A pod is Guaranteed only when every container sets CPU and memory requests equal to their limits; such pods are the last candidates for eviction under node pressure.
- CPU limit exceeded behavior
- Exceeding a CPU limit throttles the container rather than killing it, whereas exceeding a memory limit triggers an OOM kill that reports exit code 137.
- LimitRange versus ResourceQuota
- ResourceQuota caps aggregate namespace consumption and object counts, while LimitRange supplies default requests and limits and enforces per-container minimum and maximum values.
- ServiceAccount token mount path
- The projected token appears at /var/run/secrets/kubernetes.io/serviceaccount unless automountServiceAccountToken is false on the pod or its ServiceAccount.
- RBAC Role versus ClusterRole
- A Role with a RoleBinding grants namespaced permissions, a ClusterRole with a ClusterRoleBinding grants cluster-wide access, and a RoleBinding may also reference a ClusterRole.
- Headless Service behavior
- A Service with clusterIP None has no virtual IP; DNS returns the individual pod A records, supporting StatefulSet identity and client-side load balancing.
- Default-deny ingress policy
- A policy with an empty podSelector, policyTypes Ingress and no ingress rules selects every pod in the namespace and blocks all inbound traffic to them.
- Service port versus targetPort
- port is the port the Service exposes on its virtual IP, targetPort is the container port traffic is forwarded to, and nodePort is the port opened on every node.
- Ingress pathType values
- pathType is Prefix, Exact or ImplementationSpecific; Prefix matches on slash-separated path elements, while Exact requires an identical path with no partial matching.
- NodePort default range
- NodePort Services allocate a port from the 30000-32767 range by default, which is configurable through the API server flag --service-node-port-range.
- Cluster DNS service name format
- A Service resolves as <name>.<namespace>.svc.cluster.local; pods in the same namespace can use the bare Service name through the cluster DNS search domains.