KCA case studies
KCA · Put your knowledge to work in context.
The KCA is a hands-on certification for Kubernetes practitioners who want independent, third-party evidence of their ability to operate clusters day to day. It suits platform engineers, DevOps and SRE staff, and developers who already deploy workloads and now need to prove they can install, secure, network, and repair a cluster under time pressure. The published blueprint splits the exam into six domains: core concepts (25%), installation, configuration and validation (15%), security (20%), networking (15%), troubleshooting (15%), and workloads and scheduling (10%). Questions are multiple choice, but the weighting signals where depth pays off: core objects and security together account for nearly half the score, so kubectl fluency with Pods, Deployments, Services, RBAC, and Secrets matters more than trivia. The KCA case studies are 5 cases and about 3,942 words.
1Control-plane upgrade from 1.25 to 1.29 goes wrong on a live kubeadm cluster
A team must take a kubeadm cluster from v1.25.9 to v1.29.x. Topology: 3 control-plane nodes, 5 workers, containerd 1.6, Calico 3.25.
815 words, about 4 min2Restricted Pod Security blocks the CI deployer while RBAC blocks a second team
Namespace ci-builds carries pod-security.kubernetes.io/enforce: restricted . A CI controller creates batch/v1 Jobs there with ServiceAccount ci-deployer , bound by a Role granting create,get,list,watch,delete on pods , pods/log , jobs.batch and deployments.apps in ci-builds .
756 words, about 4 min3Five-second first request after an egress NetworkPolicy rollout
Pods in namespace payments call an external provider at api.psp.example.com over HTTPS. After a default-deny egress NetworkPolicy was rolled out (allowing UDP/TCP 53 to kube-dns and TCP 443 to 203.0.113.0/26 ), the first request from each pod takes 5.1 s; later requests on the same keep-alive connection take about 90 ms.
775 words, about 4 min4DiskPressure, stuck Terminating pods and Pending replacements
A nine-node cluster (3 control plane, 6 workers) on v1.29 runs batch Jobs. At 02:14 worker-4 flips to NotReady .
751 words, about 4 min5Memory-based HPA pinned at maxReplicas starves other Deployments
An e-commerce team runs checkout-api , a JVM Spring Boot Deployment in shop-prod . Container spec: requests cpu: 250m , memory: 2Gi ; limit memory: 2Gi ; JVM flags -Xmx1400m , no MaxRAMPercentage .
845 words, about 4 min