LPI DevOps Tools Engineer: Kubernetes

What this domain tests

Kubernetes on this exam means the API objects and controller behavior you use daily: Pods, Deployments, Services, ConfigMaps and Secrets, probes, resource management, and rollout mechanics.

Core rules

• Apply manifests declaratively with kubectl apply -f. Controllers continuously reconcile actual state to the spec; do not patch running Pods, because a replacement loses the change.
• A Deployment owns ReplicaSets and rolls out changes according to maxSurge and maxUnavailable; kubectl rollout undo reverts to the previous ReplicaSet.
• A Service selects Pods by label. If the selector does not match the Pod template labels, endpoints stay empty and traffic fails.
• Configure three probes: startup (slow boot), readiness (remove from endpoints), liveness (restart). A wrong liveness path causes restart loops.
• Set resources.requests for scheduling and limits to cap usage; requests also determine QoS class.
• Keep configuration in ConfigMaps and credentials in Secrets, injected per environment - not baked into images.

Worked example

A new Deployment shows CrashLoopBackOff. Reasoning path: kubectl get pods shows restarts; kubectl describe pod reveals the event CreateContainerConfigError naming a missing key; kubectl logs --previous shows application errors only if the container actually started. The manifest referenced configMapKeyRef with key DB_URL, but the ConfigMap holds DATABASE_URL. Fix the reference (or the ConfigMap), re-apply, and confirm with kubectl rollout status deployment/app. The lesson: read events before logs, and compare references exactly.

Traps

• imagePullPolicy: Always combined with a mutable tag, so replicas run different code.
• Omitting resource requests; the scheduler overpacks nodes.
• Storing Secrets in ConfigMaps or committing them to Git - base64 is not encryption.
• Forgetting that a Service's targetPort must match the container port.