Linux Foundation Certified Kubernetes Administrator

Troubleshooting starts with knowing which component does what. You trace a request from kubectl through the API server, etcd, scheduler, controllers and kubelet, and learn the interfaces that let runtimes, networks and storage plug in.

• The API server, etcd, scheduler and controller manager
• The kubelet, kube-proxy and the container runtime
• Control loops and desired state
• Static pods and where component manifests live
• CRI, CNI and CSI as plug-in interfaces
• Following one pod from create to running

You build A labeled diagram of a live cluster, checked against the real processes and manifests on its nodes.

Create a working cluster from bare machines. You prepare the nodes, install a container runtime and the Kubernetes packages, initialize the control plane, join workers, and choose a pod network that fits.

• Preparing nodes: kernel modules, swap and sysctl settings
• Installing containerd, kubelet, kubeadm and kubectl
• kubeadm init and its configuration file
• Joining worker nodes and checking their health
• Installing a CNI plugin and setting the pod CIDR
• Reading what kubeadm created on disk

You build A three-node cluster built from scratch with kubeadm, ready to run workloads.

One control plane node is one point of failure. You build a control plane across several machines, protect and restore etcd, then keep the cluster current with careful upgrades and node maintenance.

• Stacked and external etcd topologies
• A load-balanced endpoint for several API servers
• Backing up and restoring etcd with snapshots
• Upgrading control plane and worker nodes in order
• Cordon and drain for safe maintenance
• Checking and renewing cluster certificates

You build A highly available control plane, with a tested etcd backup and a rehearsed version upgrade.

Access control decides what every person and every workload can touch. You write roles and bindings with least privilege, create identities for users and pods, and prove the result by testing what each identity can do.

• Authentication and authorization in the API server
• Roles, ClusterRoles and their bindings
• Service accounts and the tokens workloads use
• Issuing a user certificate through a signing request
• Testing permissions with kubectl auth can-i
• Finding bindings that grant too much

You build Roles and bindings that give a team access to its namespace, with a test showing what is denied.

Real clusters run installed software, not hand-written YAML. You deploy applications with Helm, tailor manifests with Kustomize, and see how custom resources and operators add new object types to the API.

• Installing, upgrading and rolling back Helm releases
• Chart values and templates
• Kustomize bases, overlays and patches
• Custom resource definitions
• What an operator does and how to run one
• Choosing between Helm and Kustomize

You build One application deployed with Helm and patched for each environment with Kustomize overlays.

Deployments carry most real traffic. You roll out new versions, watch the rollout, back out a bad release, and give applications their settings and credentials through ConfigMaps and Secrets.

• Deployments, ReplicaSets and pods
• Rolling update settings and rollback
• Pausing and inspecting a rollout
• ConfigMaps as environment variables and files
• Secrets and how they are really stored
• DaemonSets, StatefulSets and Jobs

You build A deployment that updates without downtime, with settings injected from a ConfigMap and a Secret.

The scheduler places pods using the rules you give it. You set requests and limits, steer pods with affinity, taints and tolerations, and let the Horizontal Pod Autoscaler respond to load.

• How the scheduler filters and scores nodes
• Resource requests, limits and quality of service
• Node selectors and node affinity
• Taints, tolerations and dedicated nodes
• Horizontal Pod Autoscaler and the metrics it needs
• Resource quotas and limit ranges

You build A workload pinned to dedicated nodes that scales out under load and back in when it passes.

Pods come and go, so traffic needs stable addresses. You expose applications with services, route HTTP with Ingress and the Gateway API, and see how CoreDNS makes names resolve inside the cluster.

• Pod-to-pod connectivity and the pod network
• ClusterIP, NodePort and LoadBalancer services
• How services find pods through endpoints
• How CoreDNS resolves service names
• Ingress controllers and Ingress rules
• Gateway, GatewayClass and HTTPRoute

You build An application reachable by name inside the cluster and by host and path from outside it.

By default every pod can talk to every other pod. You write policies that deny everything and then allow only the flows an application needs, and learn why the CNI plugin must support enforcement.

• Default-deny for ingress and egress
• Selecting pods, namespaces and IP blocks
• Allowing one tier to reach the next
• How several policies combine
• Testing a policy from inside a pod
• What happens when the CNI does not enforce policy

You build A three-tier application locked down by policies, with tests showing allowed and blocked paths.

Containers lose their files when they restart, so data needs somewhere to live. You provision volumes dynamically through storage classes, choose access modes and reclaim policies, and attach claims to pods.

• Volumes, persistent volumes and claims
• Storage classes and dynamic provisioning
• Access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany
• Reclaim policies and what happens on delete
• Expanding a claim and mounting it into pods
• Diagnosing a claim stuck in Pending

You build A stateful application whose data survives pod deletion, on a dynamically provisioned volume.

When something breaks, the skill is finding the failing layer quickly. You work from symptom to cause across applications, services, nodes and control plane components, using logs, events and resource usage.

• A method: from symptom to failing layer
• Pods stuck in Pending, CrashLoopBackOff or ImagePullBackOff
• Reading events, describe output and container logs
• A NotReady node: kubelet, runtime and system journal
• Control plane components that will not start
• Service and DNS failures
• Finding resource pressure with metrics-server

You build A diagnosis log for five injected faults, each traced to its cause and fixed.

Build a cluster, deploy a multi-tier application with its access, networking and storage, then break it in ways you did not plan. You repair the damage against the clock and write up what you found.

• Planning the build and the order of work
• Deploying an application with storage, services and policy
• Securing it with roles and network rules
• Rehearsing an upgrade and an etcd restore
• Diagnosing faults someone else injected
• Writing a runbook from what you learned

You build A cluster running a complete application, with a runbook for its upgrade, backup and recovery.