Certified Kubernetes Administrator (CKA) Hands-On Training

Master deployments of pods, workloads, scheduling, and services, explore blue-green and canary upgrades, and optimize resources through scaling up and down to keep apps performing.

Discover the differences between the core api group and named api group, showing how core v1 resources like pods live under /api/v1 while named groups use /apis/<group>/<version> paths.

Explain how Kubernetes uses declarative manifests to specify desired state such as ports and container images, while imperative scripts detail how to achieve those results.

Explore namespaces as logical boxes that group pods, services, and deployments, an entry point to isolation without true separation, including default, kube-system, and kube-public namespaces.

Create two namespaces and pods with the same name, observe different IPs, and note that a flat network allows cross-namespace communication, so namespaces offer separation of concern, not security isolation.

Use canary deployments by splitting users into two groups and deploying version 1.2 to one while maintaining 1.1 for the other to test updates, QA, and feature impact.

Implement blue/green deployments by promoting staging to production and turning production into the new staging, enabling safe upgrades with fresh builds from dev.

Learn rolling updates in Kubernetes using a deployment with max unavailable 1 and max surge 1, gradually replacing old pods with engine X version 1.21.

Explore a canary deployment example with two app versions, adjust replicas and image versions, and route users to the chosen version via service selectors in Kubernetes.

Set up a blue/green deployment in Kubernetes by configuring blue with replicas and version labels, creating a green deployment with zero replicas, and updating the service selector to switch traffic.

Demonstrates rolling back a Kubernetes deployment with rollout history and undo to revert to an earlier revision, and explains why kubectl edit won’t update manifests.

Create and inject config maps in Kubernetes to supply environment-specific keys and metadata without altering the container image, enabling workload customization across environments.

Create and apply a config map in the dev namespace, then configure a deployment to pull the user key from that config map as an environment variable.

Understand how secrets hold sensitive information like passwords or API keys, how they differ from config maps, and why they are stored base64 plain text in S CD.

Learn how Kubernetes secrets are stored as base64 in manifests and repos, why they're not secure, and how to mount a secret as a volume inside a pod.

Explain why kubernetes secrets are not ideal for production due to base64-encoded plain text stored in etcd. Explore third-party secret management as a safer alternative.

Learn to deploy and initialize Vault on Kubernetes with Helm, expose the UI via a load balancer, unseal with keys, and use Vault agent sidecars to pull secrets for deployments.

Explore how sidecar containers extend pod capabilities by running alongside your main application container, enabling log export and service mesh functions with shared IPs but distinct ports.

Configure a Kubernetes sidecar by deploying STO and SCO, label the namespace with sto injection enabled, and verify Nginx and the Istio envoy proxy run together.

Compare horizontal pod autoscaler and vertical pod autoscaler, showing when to scale out by adding pods at 75% CPU/memory and why horizontal scaling is preferred for ephemeral pods.

Explore horizontal pod autoscaler behavior on a Nginx deployment, configuring min and max replicas and cpu target utilization. Use kubectl apply to declaratively manage scaling and observe pod growth.

Compare horizontal pod autoscaler with vertical pod autoscaling, noting how it adds pods while vertical increases a pod's CPU and memory. Leverage resource and cost optimization tools for vertical autoscaling.

Discover how Kubernetes achieves self-healing through controllers, such as replica sets and deployments, by using the reconciler loop to restart, reconfigure, or replace unhealthy pods that fail health checks.

Kubernetes allocates finite memory and CPU from worker nodes; set limits and requests, and apply namespace quotas to constrain usage, noting CPU limits should be avoided since CPU isn’t reclaimed.

Learn how to set pod requests and limits in a Kubernetes deployment, including memory and cpu resources, verify quotas in a test namespace, and manage replicas and pods.

Explore how resource quotas enforce hard limits for cpu, memory, and pods in a namespace, show how requests differ from limits, and demonstrate quota enforcement with a failing deployment.

Create a web app namespace and define a memory quota of 512 Mi with requests and limits using kubectl, then verify the quota by listing it in that namespace.

Explore how cloud Kubernetes resources limit pod scheduling and how scaling out adds worker nodes to convert pending pods to running when memory and CPU are scarce.

Using kustomize, configure a customized environment with base resources and overlays for dev, prod, and staging, injecting values via a single values file to adjust replicas on the fly.

Helm is a Kubernetes package manager that bundles manifests into a single chart for one-shot installation of deployments, services, and configs.

Create and customize a Helm chart, configure replicas in values.yaml, and deploy (helm install), upgrade (helm upgrade), or uninstall (helm uninstall) the app, while verifying pods via kubectl get pods.

Learn how labels and selectors use key value pairs on Kubernetes objects to identify apps and environments, and to select workloads for deployments.

Learn how labels group Kubernetes objects and how selectors use environment and app labels to identify the engine X deployment for a service.

Learn how node affinity constrains where pods run by matching labels on gpu-centric and memory-centric nodes. Compare manual node naming with affinity-based labeling and prefer labeling for robust pod scheduling.

Explore manual scheduling in Kubernetes by assigning deployments to specific worker nodes, observing pods on chosen nodes, and handling non-existent targets to understand scheduling behavior.

Understand how taints and tolerations guide pod scheduling, enabling the scheduler to place pods on appropriate nodes and prevent scheduling to unsuitable, mismatched nodes such as gpu-centric versus memory-centric.

Explore how static pods are managed directly by the kubelet on a node, without the API server observing them, unlike deployments and replica sets.

Use a dedicated service account for pods and deployments to avoid the default account; create and bind a pod creator role with get, update, list, and create.

Explore how pods share a single IP address while multiple containers within the same pod communicate through ports, such as 8080 and 80, in a two-replica deployment.

Explore the container network interface (CNI) in Kubernetes, contrasting host networking with CNI-driven pod IP assignment and dynamic network configuration across cluster environments such as Proxmox, Azure, and AWS.

Learn to deploy cloud-centric cnis, upgrade the data plane to psyllium, and configure overlay networks with Terraform for Azure and AWS managed Kubernetes services.

Explore beginner CNIs like weave net and flannel, compare security-centric options such as calico and psyllium, and discuss production-ready features like network policies, eBPF, and pod-to-pod encryption with WireGuard.

Deploy Psyllium as a cni with ebpf, compare to Calico, install via helm, and validate with kubectl, noting the CoreDNS restart and pod networking.

Learn how Calico, a security-centric CNI by Tigera, integrates with Linux and Windows containers, supports EVPF and encryption, and is installed via Helm with TLS cert customization.

Discover how Kubernetes services act as the front end for one or more pods, providing a DNS name via CoreDNS over ephemeral pod IPs, including headless and backend deployments.

Outline a Kubernetes service manifest with apiVersion, kind, metadata, and spec including selector, port, and type. Prefer declarative manifests and integrate the service with the deployment for production readiness.

Compare load balancer, cluster IP, and node port services in Kubernetes, with headless as a one-off option, and explain in-cluster communication and external access.

Change the service type to cluster ip to enable internal communication between services. Use the cluster ip address on port 80 for internal communication, and do not expose externally.

Expose the backend with a node port behind a service to stabilize access despite changing pod IPs. The service routes to the engine X deployment on port 80.

Configure a deployment with a load balancer service, fetch the external IP, and see how Kubernetes provisions cloud load balancers in Azure, AWS, or GCP.

Explore headless services in Kubernetes, which set the cluster IP to none and expose endpoints via DNS instead of IP addresses.

Navigate cloud networking constraints of managed Kubernetes across AWS and Azure, applying TCP routing, private clustering, and authorized IP ranges, and configure gateway ingress controllers and AKS network policies.

Compare kubenet and azure cni in a managed kubernetes service, evaluate network policy options like azure policy and calico, and note psyllium beta and provider limitations.

Explore on-prem Kubernetes with kubeadm using virtual machines and various CNIs like Calico, Weave, Azure CNI, and AWS CNI. Compare customization with managed service simplicity to decide what's best.

Clarify that ingress means traffic coming in and egress means traffic going out. Show how a single ingress controller routes multiple services via distinct paths.

Deploy Nginx ingress and its controller in an AKS/Azure environment, then expose a hello world app via an ingress path using a load balancer.

Install Traefik ingress via helm, create a dedicated traffic namespace, and expose a load balancer in Azure; explore dashboard, http routers, services, routers, middleware, and plugins to compare ingress options.

Explore how TLS and certificates secure authentication and authorization as Kubernetes control plane components, including certificate authorities, client certificates, kubeconfig, and certificate rotation.

Install cert-manager in a Kubernetes cluster using Helm and CRDs, deploy an nginx app, and issue a certificate with a cluster issuer backed by Let's Encrypt staging for an ingress.

Apply network policies as firewall rules to control ingress and egress traffic for pods in namespaces at osi layers 3 and 4, enabling access to database or blocking internet access.

Apply a network policy to block ingress to busy box one and observe traffic when policies are enabled, contrasting flat default CNI networking with policy enforcement.

Discover how Kubernetes annotations attach arbitrary metadata to objects and trigger vault sidecar injection in a deployment, enabling vault operations within your pods.

Explore how the container storage interface enables Kubernetes to provision and manage volumes, persistent volumes, and storage classes across on-prem and cloud environments, using diverse storage interfaces.

Explore on-prem storage with a Synology NAS and cloud storage in Azure, using persistent volume claims backed by NFS, plus Netapp on tap cloud volume options.

Explore storage classes in Kubernetes, describing available storage with a named API group, provisioner, and parameters, including AWS EBS GP2 and NFS, plus reclaim policy and volume binding mode.

Provision persistent volumes using a storage class for dynamic provisioning with Azure premium storage, and create a persistent volume claim to request and bind the storage.

Understand how volume reclaim policies govern data retention for volumes and persistent volume claims, focusing on retain and delete, with mention of the deprecated recycle policy.

A persistent volume represents cluster storage provisioned by an administrator or dynamically via a storage class, and a persistent volume claim requests specific storage from that class.

Compare cloud and on-prem volumes in Kubernetes, highlighting storage class usage, persistent volume claims, automatic PV provisioning in the cloud, and immediate binding behavior.

Explore Kubernetes volume types like config map, emptyDir, hostPath, NFS, local, SMB, and cloud-backed disks, and see how volume mounts relate to volumes across on-prem and cloud environments.

Learn to build on-prem storage with a NAS using NFS and the NFS CSI driver, creating a storage class, PV, and PVC for pods.

Set up on-prem storage with an NFS Synology share, install the NFS CSI driver via Helm, and create a Kubernetes storage class, PV, and PVC using NFS 4.1.

Explore storage in AWS by provisioning a default storage class, creating persistent volumes and persistent volume claims, and wiring them to pods on an EKS cluster with EBS-backed CSI drivers.

Create and attach a persistent volume to a pod by defining the volume and pvc, mount the volume inside the container, and verify status with kubectl.

Explore how to run stateful databases on Kubernetes and Docker, using volumes and deployments to connect to existing databases, and debunk the stateless myth.

Learn to run a mysql container with a docker volume and latest image, connect it to an RDS database, and back up for geo-redundant, kubernetes-ready container deployments.

Configure a MySQL deployment or statefulset in Kubernetes by specifying the container image, port, environment variables, secrets, and a volume for data.

connect a pod to an aws rds database using mysql credentials defined as environment variables, then apply the configuration with kubectl apply -f to run the pod.

Compare Kubernetes logging options, including node-level agents, sidecar logging, and app-level logging; log audit policy and control plane components alongside worker node and networking (CNI) logs.

Monitor logs at both pod and container levels, catching issues hidden by a healthy pod, using sidecar logging agents for service mesh and kubectl logs and describe to inspect events.

Explore how pods house containers and how Kubernetes captures logs per pod, using kubectl logs and kubectl describe to export and route logs to external tools.

Configure audit logging for the Kubernetes API server by applying an audit policy YAML and directing logs to a defined location, capturing who, when, and what happened.

Learn container logging in Kubernetes by sending logs from pods via stdout and stderr, with stdout for normal output and warnings and stderr for errors, avoiding embedded images for logs.

Understand policy enforcement in Kubernetes using OPA, Gatekeeper, and admission controllers. Intercept API server requests and block the latest container image with constrained templates.

Learn to implement gatekeeper to enforce policies with OPA, using a standard configuration and Rego to prevent using the latest container image.

Back up and restore etcd in Kubernetes, the cluster's critical database, and protect volumes across cloud or on-prem environments using etcdctl snapshots.

Explore Kubernetes backups across Azure, AWS, and on-prem environments. Implement backups with Velero, Kasten by Veeam, and Azure backup, focusing on etcd and volumes, retention, and immutability.

Explore three Kubernetes scaling approaches across Azure and AWS, using cluster autoscaler and node pool or node group configurations to auto scale min and max nodes and pods per node.

Explore open source Karpenter for EKS auto scaling, compare it to the standard scaler, and learn to set up an IAM policy, OIDC, and a Karpenter service account with Helm.

Explore scaling in AWS with Terraform, configuring EKS node groups and scaling blocks for desired, max, and min worker nodes; note Azure's default node pool and node count.

Demonstrates scaling in Azure by creating a cluster, adding node pools, and configuring cluster auto scalar with min and max nodes and max pods per node.

Troubleshoot kubeadm by verifying network connectivity and ports for the control plane and workers, ensuring static pods run, and using kubectl logs or describe; reset with kubeadm reset if needed.

Explore monitoring and observability in real-world Kubernetes operations, capturing real-time metrics, traces, and logs, forecasting future performance, and setting alerts to maintain end-to-end health.

Explore workloads, pods, services, and secrets using the Kubernetes dashboard with Minikube; deploy from a GUI using YAML/JSON, while keeping deployments in code via manifests.

Explore the Prometheus and Grafana stack for Kubernetes observability, including metrics, dashboards, exporters, and out-of-the-box Q Prometheus dashboards and Alertmanager integration.

Diagnose pod failures by inspecting logs, describe outputs, and deployment status; troubleshoot pod networking, termination messages, and memory issues by scaling nodes and fixing image pulls.

Summarizes practical cluster and pod troubleshooting with kubectl, using cluster-info-dump, describe nodes, and logs to diagnose API server, scheduler, and controller issues; covers vm shutdowns, network partitions, and operator errors.

Diagnose cni issues by identifying incompatibilities and configuration problems that affect networking. Use weave net and wireguard encryption for pod-to-pod communication, validating pod readiness with kubectl.

Learn a top-down approach to troubleshooting on prem and cloud networks by validating host networks, firewall rules, CNI and policy configurations, and traffic flow in Azure AKS and beyond.

Explore Kubernetes security fundamentals by examining the OWASP Top 10 best practices, including insecure workloads and RBAC configurations, with practical code fixes and attack scenarios.

Scan container images for vulnerabilities with Docker Scout, pulling CVEs and severity, including critical issues, and extend scanning to Kubernetes clusters with Cesca CLY to identify required actions.

Explore how real-world Kubernetes practice differs from certification labs, highlighting GitOps deployments with Argo CD and Flux, and how this section adds practical, job-ready context.

Master the six prerequisites before using Kubernetes: Linux, networking, storage, light programming or automation, application support, and infrastructure scaling.

Compare two home lab paths for a real-world kubernetes environment: with extra cash versus without. Build it with a synology ds223 nas, intel nuc 12 extreme kit, and proxmox.

Design a budget home lab for Kubernetes using an Intel NUC 9 with 12 GB RAM and a Synology DS120j NAS, running a few VMs with Proxmox.

Learn how to coordinate developers, QA, IT, and security in a Kubernetes rollout, covering container images, cluster management, and security practices like image scanning and compliance.

Choose tools, platforms, and capabilities around Kubernetes to automate deployments and maintain the desired state, while assessing business value, team readiness, and potential positives and negatives.

Move cluster deployments from manual portal steps to automated infrastructure as code with Terraform for AKS. Use GitHub Actions to CI/CD and deploy Terraform configurations for reproducible production clusters.

This lecture guides you through deploying an EKS cluster with GitHub Actions, using Terraform, AWS credentials, and repository secrets to automate plan and apply.

Deploy a Kubernetes application with a declarative manifest using Argo CD and kubectl apply, configuring an application resource with namespace, project, repo URL, and path.

Flux, a gitops controller, differs from Argo CD by supporting helm charts and customized configurations. Authenticate to GitHub, connect Flux, and deploy from a git repository.

GitOps uses a read-only git repo to deploy Kubernetes manifests with a pull-based controller, continuously reconciling current and desired states through tools like Argo CD.

Deploy Argo CD with a Kubernetes manifest for HA, install the CLI, and access the UI by retrieving the admin password. Then deploy apps declaratively with Kubernetes manifests.

Deploy Argo CD to an EKS cluster with GitHub Actions, using Helm for installation, and configure HA and a load balancer before deploying apps via Kubernetes manifests.

Demonstrates implementing cost and resource optimization with kubecost and cast ai via helm charts, connecting AKS clusters, and monitoring per-namespace costs, alerts, and potential savings.

Explore pod to pod networking in Kubernetes, including CNI, kube-proxy, and eBPF, and see how a service mesh provides encryption, observability, and traffic rules.

Implement Istio on a Kubernetes cluster by installing the Prometheus add-on, CRDs, and base components, then deploy the Envoy sidecar and use the Kiali dashboard to visualize traffic.