Linux Foundation Certified Kubernetes Application Developer

The same container can run as a pod, a Deployment, a Job or a CronJob, and the choice changes how it restarts and scales. You match the resource to the work, and treat batch and scheduled tasks as carefully as long-running services.

• Pods and why you rarely run one directly
• Deployments for stateless services
• Jobs, completions and parallelism
• CronJobs, schedules and concurrency policy
• StatefulSets and DaemonSets: when they apply
• Restart policies and backoff limits

You build Manifests that run a service, a one-off migration and a nightly cleanup, each with the right resource.

Some applications need helpers that live and die with them. You build pods with init containers and sidecars, share data through volumes, and decide when a second container is better than a second pod.

• Init containers and start-up ordering
• Sidecar containers for logging and proxying
• The adapter and ambassador patterns
• emptyDir and shared scratch space
• Persistent volumes and claims for application data
• Projected volumes and ephemeral storage

You build A pod with an init container and a log-shipping sidecar sharing one volume with the application.

An image should not change between environments, but its settings must. You inject configuration with ConfigMaps and environment variables, handle credentials with Secrets, and expose pod facts to the application through the downward API.

• ConfigMaps from literals, files and directories
• Environment variables and mounted files compared
• Secrets: types, encoding and the limits of encoding
• The downward API and pod metadata
• Updating configuration without rebuilding
• Immutable ConfigMaps and Secrets

You build One image running in two namespaces with different configuration and credentials.

A pod runs with the identity and limits you give it. You assign ServiceAccounts, set SecurityContexts that drop privileges, cap resources with requests, limits and quotas, and see how authentication and admission control gate every request.

• ServiceAccounts and the tokens pods receive
• Authentication and authorization at the API
• Admission control: what mutates and what rejects
• SecurityContext: users, capabilities, read-only filesystems
• Requests, limits and what happens past a limit
• ResourceQuotas and LimitRanges per namespace

You build A hardened pod spec that runs as a non-root user inside a namespace with enforced quotas.

Teams increasingly consume platform features as custom resources. You read and write CRDs, create instances of them, and learn what operators do behind the API so that you can use them without surprises.

• What a CustomResourceDefinition adds to the API
• Reading a CRD’s schema and versions
• Creating and editing custom resources
• The operator pattern and reconciliation
• Installing and using an existing operator
• Finding the cause when a custom resource is stuck

You build A custom resource definition with a schema, and instances of it managed with kubectl.

Shipping a change safely is part of an application’s design. You tune rolling updates, run blue/green and canary releases with plain Kubernetes objects, and package deployments with Helm and Kustomize.

• Rolling update settings: surge and unavailable
• Blue/green releases by switching a service selector
• Canary releases with replica ratios and labels
• Rollback and revision history
• Installing and customizing Helm charts
• Kustomize overlays for each environment

You build An application released through a canary, then promoted, with a documented rollback.

Kubernetes can only restart what it knows is unhealthy. You add liveness, readiness and startup probes, read logs and resource use from the command line, and debug failing pods from outside and from within.

• Liveness, readiness and startup probes
• Choosing probe type, timing and thresholds
• Reading container logs, current and previous
• kubectl top and basic resource monitoring
• Debugging with exec, port-forward and ephemeral containers
• Finding and fixing deprecated API versions

You build A service with correct probes and a short debugging guide for its three likeliest failures.

An application is only useful when something can reach it, and only safe when nothing else can. You expose pods through services, route outside traffic with Ingress rules, and restrict flows with NetworkPolicies.

• Services and label selectors
• ClusterIP, NodePort and LoadBalancer
• Ingress rules by host and path
• Troubleshooting a service with no endpoints
• NetworkPolicy ingress and egress rules
• Testing connectivity from a debug pod

You build A front end and API exposed through Ingress, with policies that allow only the intended traffic.

Take one application from source code to a running, observable release. You build the image, choose the resources, wire configuration and security, release with a strategy, and expose it, all from the command line.

• Breaking an application into Kubernetes resources
• Building, tagging and publishing the image
• Writing manifests for configuration, security and storage
• Releasing, probing and exposing it
• Debugging a deliberately broken release
• Reviewing the manifests as a teammate would

You build A full application, from image to Ingress, with health checks, limits and a release procedure.