Kubernetes Master Course| Certified Kubernetes Administrator

Explore the Kubernetes architecture, from control plane and master to worker nodes, learning how API server, etcd, controller manager, scheduler, kubelet, and container runtime orchestrate pods.

Explore the Kubernetes API server, the gatekeeper of the control plane. It exposes a REST interface, persists configuration in the data store, and enforces authentication, authorization, and admission.

Learn how the controller manager runs multiple controllers to reconcile a resource's desired and actual state. These controllers watch the API server and ensure correct create, update, and delete operations.

Explore how the Kubernetes scheduler, the control plane component, selects a worker to host a resource by filtering candidates, scoring them, and balancing load using labels and taints.

Learn how etcd serves as the distributed, open-source key-value store backing Kubernetes state, its role in high availability, and how to back up, query, and secure cluster data.

The kubelet runs as a service on every node, registering the node with the api server and creating pods for containerized apps. It watches the api server and ensures health.

Route service IP traffic to backend pods via kube-proxy, using iptables or ipv6 routing for round-robin load balancing across ephemeral pod instances.

Explore how the CRI decouples kubelet from runtimes like Docker and Rocket through a plugin architecture, enabling plug-and-play support for multiple container runtimes.

Explore the Kubernetes API architecture by examining API objects, API groups, and versioning, including core and named groups, RESTful communication, and the API entry points /api and /apis.

Explore the community API demonstration lab to learn how to create, update, and delete resources via the API, using command line or manifest, and study core and named API groups.

Explore the Kubernetes object model and resources like pods, deployments, secrets, and volumes, and learn how manifests define desired state in yaml or json and controllers keep it in sync.

Understand semantic versioning and how major, minor, and patch releases shape backward compatibility, security patches, and upgrade paths for Kubernetes clusters.

Learn how Kubeadm bootstraps a cluster with automated certificate creation, static pods, and phase-based control plane setup, offering a simple path from install to upgrade, agnostic to network and storage.

Install a Kubernetes cluster with kubeadm, using one control plane and two workers, select compatible versions, enable bridge traffic, and deploy a Flannel pod network.

Create a highly available kubeadm cluster using multiple control planes, a load balancer, and a virtual IP to balance API calls, covering stacked and external topologies.

Learn how to safely drain nodes in a Kubernetes cluster, balancing involuntary and voluntary disruptions, using pod disruption budgets, cordon and drain, and eviction strategies for deployments and daemonsets.

Upgrade your kubeadm cluster by upgrading control plane first, draining and cordoning nodes, then upgrading kubectl and worker nodes one at a time, verifying versions and compatibility to avoid disruptions.

Master the Kubernetes etcd backup and restore process by backing up the cluster data and status using etcd snapshots, restoring resources, and understanding automation considerations.

Discover Kubernetes core concepts as the fundamental building blocks for configuring and deploying applications, including pods, contexts, namespaces, and labels with selectors to enable declarative deployments.

Explore how Kubernetes namespaces partition resources for isolation and multi-tenancy, defining namespace-scoped vs cluster-scoped objects, with DNS-compatible names, default and system namespaces.

Explore creating and managing Kubernetes namespaces, declaratively with manifests or imperatively via create namespace, and learn to apply quotas, labels, and resource limits across teams.

Learn how pods function as the smallest unit in a Kubernetes cluster, hosting one application with one or more containers, sharing a network namespace and a single IP.

This pods demo lab guides you through creating pods, imperatively with kubectl and declaratively with manifests, using images and containers, and tracking status with describe, events, namespace, and node context.

Learn how static pods are managed by Kubelik, not by the scheduler or API server, using a manifest placed in the static manifests path.

Generate manifests and place them in the static pod directory to create static pods. Node names append to pod names, and the control plane monitors health with the API server.

Explore multi container pods in Kubernetes, where a single main application uses sidecar and ambassador containers to initialize data, proxy requests, and share network and storage.

Explore init containers in Kubernetes, learning how to initialize apps before the main container runs, coordinate sequential tasks, share volumes, manage resources, and handle restarts.

Demonstrates using init containers in a pod manifest to sequentially initialize a web server, share data via a volume, and update the index file to drive the engine x server.

Explore how labels attach to Kubernetes resources to describe identity, group by common traits, and route traffic, using key-value pairs created imperatively or declaratively and updated on the fly.

Demonstrates creating and managing labels with kubectl label, overwriting values with the overwrite flag, viewing labels in columns, and describing metadata to verify labeling—essential for exam prep.

Explore label selectors to filter Kubernetes resources by label criteria, using equality and set-based operators to target pods, namespaces, or nodes, and perform actions on the selected subset.

Master Kubernetes label selectors and operators: equality, in, not in, exists, not exists, for filtering pods, deployments, daemonsets, replica sets, nodes, and namespaces with practical lab examples.

Annotations provide extra descriptive, non-identifying metadata on Kubernetes resources, letting you store contact details, links, build numbers, and troubleshooting info without altering labels or resource identity.

Expose cloud native apps with Kubernetes services that provide a durable endpoint for pods, using labels and selectors to form endpoints, and kube-proxy to route traffic.

Explore how the cluster ip service provides a virtual IP for in-cluster communication, linking services to pod ports via a proxy and iptables, configured with manifests.

Explore how cluster IP services enable internal pod-to-pod communication in Kubernetes, expose deployments with kubectl expose, generate manifests with dry-run, and understand endpoints, selectors, and internal load balancing.

Explain how to create and use a NodePort service by reusing a manifest, mapping a node port to a service port, and exposing pods via an external ip.

Learn how the Kubernetes load balancer service extends Northport and cluster IP to provide a front-end IP for external clients, routing to worker nodes with auto or manual provisioning.

Explore how to configure a Kubernetes load balancer service with external IPs, endpoints, and port mappings for reliable app access, plus practical troubleshooting.

Explore Kubernetes workloads from pods as the atomic unit to higher level controllers like replica sets, deployments, and daemon sets, using pod templates.

Configure replica sets to maintain the desired end state of pods using a template, replicas count, and selectors with labels or match expressions to manage pod availability.

Deployments provide a declarative, zero-downtime way to run applications by managing replica sets and pods with rolling updates and safe rollbacks through revision history and upgrade strategies.

Explore deploying and upgrading apps with Kubernetes deployments, using declarative manifests and rolling updates to achieve zero downtime, while managing replicas, selectors, and revision history.

Deploy daemonsets to run an agent on every node, bypassing the default scheduler to ensure coverage for monitoring and security tasks, with rolling updates and node selectors.

Explore DaemonSets through a declarative lab, learn how to deploy one pod per node with node selectors, rolling updates, and revision tracking, while understanding CNI networking prerequisites.

Explore taints and tolerations in Kubernetes, how taints mark nodes as off-limits, how pods tolerate them via manifests, and how scheduler and eviction behavior govern pod placement.

Demonstrate taints and tolerations in Kubernetes with a hands-on lab, showing how taints block pod scheduling, how to add tolerations with keys and operators, and how to remove taints.

Understand how node selectors constrain the default scheduler by matching node labels, and how node name pins a pod to a specific node, including taints and tolerations.

Explore node affinity in Kubernetes, comparing node selectors with equality-based and expression-based selectors and operators, and learn hard versus soft rules for required and preferred scheduling.

Explore node affinity in kubernetes by creating a pod manifest with required and preferred rules, using matchExpressions to select nodes and observe scheduling behavior.

Learn advanced scheduling with pod affinity and anti-affinity, using labels and selectors to co-locate or separate pods across nodes, zones, and regions.

Configure pod affinity in Kubernetes using a manifest template to co-locate pods with matching labels based on topology keys, applying required and preferred rules.

Explore how to run multiple schedulers in a Kubernetes cluster by deploying a custom scheduler alongside the default, configuring a service account, roles, and deployment options.

Learn to configure resource requests and limits for cpu and memory at the container level, and apply namespace resource quotas to manage pod scheduling, eviction, and performance.

Configure and enforce resource requests and limits for containers to prevent CPU and memory contention, eviction, and degraded pod performance in Kubernetes.

Create a resource quota manifest with api version v1 and kind ResourceQuota to enforce cpu and memory hard limits in a namespace, and monitor usage.

Master docker entrypoints and cmd by building containers, overriding entrypoints with args or environment variables, and running bash scripts that pass lesson and interval variables.

Learn how commands and arguments configure containerized applications in Kubernetes, including Dockerfile entrypoint, overriding commands, and the impact of argument order on runtime behavior with containers.

Learn how environment variables pass configuration to applications in Kubernetes, compare them with ARGs, and see how to set, access, and decouple configuration from pod specs for secure, updateable deployments.

Explore how ConfigMaps decouple application data from pods within namespaces, enabling environment-specific key-value configuration via files, environment variables, and volumes.

Explore Kubernetes config maps with a hands-on demo lab. Learn to create, inject, and apply config map data from literals, files, and environment variables to pods.

Use Kubernetes secrets to pass confidential data to pods, with base64 encoding and TLS certificates; work with secret types such as opaque, tls, and docker registry secrets.

Explore declarative and imperative secret management in Kubernetes, including generic, TLS, and docker registry secrets; inject via environment variables or volumes and follow base64 and security best practices.

Explore how Kubernetes networking connects pods within and across nodes, detailing IP addressing, network namespaces, and how services and kube-proxy provide stable, fixed IP access.

Explore linux network namespaces as isolated environments and learn how interfaces, IP addresses, and routing enable container connectivity. Learn bridges and iptables to interconnect namespaces and manage traffic.

Demonstrate Linux network namespaces and bridging to connect isolated networks in a hands-on lab. Learn how interfaces, routes, iptables, and forwarding underpin container networking for Kubernetes.

Explore Docker container networking, including network namespaces, the default bridge docker0, IP addressing, masquerade via iptables, and cross-host communication with overlay drivers.

Understand that the CNI, container network interface, abstracts Kubernetes networking and connects pods via plugins configuring namespaces, IPs, and routing.

Learn to build a custom CNI plugin from scratch for a Kubernetes cluster, defining the CNI config, creating the binary, setting up a bridge network, and enabling inter-node pod networking.

Install the flannel CNI on a three-node Kubernetes cluster by applying the flannel YAML, configuring a 244.0.0/16 pod subnet, and using a bridge for pod networking.

Install weave CNI for Kubernetes with a YAML manifest, including service accounts and a daemonset, and learn exam-ready tips and common troubleshooting like iptables issues.

Explore Calico CNI, a scalable layer 3 networking solution for enterprise and data centers, using a BGP-based control plane with Felix and Bird, and IP IP encapsulation.

Install Calico CNI to manage Kubernetes networking; deploy Calico with Felix and Bird, configure BGP and IPIP encapsulation, apply the Calico manifest via kubectl, and verify connectivity across pods.

Explore how ingress, with the ingress controller and egress proxy, routes external traffic to cluster services using layer 7 routing, TLS termination, and host and path routing rules.

Demonstrates setting up Kubernetes ingress on Google Cloud with external load balancer, using path-based routing and virtual host mapping to direct traffic to multiple services, plus TLS offload.

Explore how Kubernetes volumes persist and share data across containers in a pod, covering ephemeral volumes, host path storage, and durable external storage via CSI and cloud providers.

Learn to configure and persist data in Kubernetes by using volumes in a pod, including emptyDir, git repository volumes, hostPath, and Google Cloud disk, with a sidecar pattern.

Persistent volumes decouple external storage from developers, enabling cluster-wide storage pools and persistent data across pods via persistent volume claims, with admins provisioning PVs backed by various storage backends.

Explore creating and managing Kubernetes persistent volumes and claims by building PV manifests, configuring capacity, access modes, and reclaim policy, then bind them with PVCs.

Understand how persistent volume claims bind to persistent volumes backed by external storage to provide namespace-scoped storage for pods across nodes, with binding, access modes, storage classes, and PVC lifecycle.

Explore persistent volume claims in Kubernetes by creating and binding PVCs to volumes, configuring capacity, access modes, and storage classes, including dynamic provisioning and data retention policies.

Storage classes enable dynamic provisioning of persistent volumes to PVCs, automating storage management and reducing manual PV/PVC maintenance. They specify a provisioner and reclaim policy, and support volume expansion.

Demonstrate storage classes in a hands-on lab, creating gold and platinum classes for dynamic provisioning. Explain default standard class, reclaim policy, access modes, and PV/PVC provisioning for Google Cloud backends.

Explore how compromised container images and insecure manifests enable unauthorized access in Kubernetes, highlighting token and service account misuse, and the Shellshock risk.

Learn how TLS certificates secure access to the Kubernetes API server using public and private keys, certificate authorities, and certificate signing requests.

Explore how Kubernetes authenticates users and machines through the API server, using certificates, tokens, passwords, and third-party providers, with service accounts for pods and groups for scalable access.

Learn how Kubernetes service accounts authenticate pods with the API server, where tokens live in secret volumes, and how to create or customize accounts and secrets.

Learn how the kubeconfig file stores user, cluster, and context credentials, including certificates and tokens, for authenticating to multiple Kubernetes clusters from a single command line.

Learn to create a kubeconfig file from scratch, configure kubectl with clusters, users, and contexts, and use certificate-based authentication for admin and service accounts.

Use kubectl proxy to authenticate to the API server with a kubeconfig and authentication context, leveraging certificates for authorization.

Grant and manage cluster permissions for authenticated users and service accounts, mapping actions to API verbs (create, read, update, delete) at namespace or cluster scope.

Master Kubernetes rbac by defining roles with verbs and resources in namespace manifests, and binding them to users or service accounts using declarative and imperative approaches.

Explore roles and rolebindings to grant namespace‑level permissions with declarative manifests, using verbs and resources per API group and dry-run to bootstrap bindings to users or service accounts.

Create and bind roles with role bindings for a service account and a user in Kubernetes. See how roles control access to pods, deployments, and other resources across namespaces.

Learn how cluster roles and cluster role bindings link to user accounts to grant permissions across namespace and cluster scope resources, including non-resource URLs, via declarative and imperative tooling.

Create cluster roles and cluster role bindings to grant cluster-wide permissions across namespaces, enabling access to pods, nodes, and namespaces for users and service accounts.

Automate certificate signing requests in Kubernetes using community CSR features, enabling delegated admins to submit CSRs that cluster admins approve and sign for authenticated access.

Explore security contexts in Kubernetes to secure pod and container level permissions. Learn to control volumes, privileges, and read-only file system options to prevent container compromise.

Learn how Kubernetes network policies create security rules to control traffic between pods, enabling micro-segmentation through labels, selectors, and ingress and egress rules, with default permissive behavior and CNI considerations.

Implement namespace-scoped Kubernetes network policies to isolate pod traffic by configuring ingress and egress rules with labels, selectors, and ports in a hands-on lab.