Latest Articles - Page 33

Install gVisor runsc on a Kubernetes worker, register a containerd runtime handler, create a RuntimeClass with scheduling constraints, and compare sandboxed Pods against default runc workloads.

Configure Kubernetes Pod Security Admission with namespace labels for enforce, audit, and warn modes, remediate noncompliant workloads, pin policy versions, and migrate from removed PodSecurityPolicy.

Apply Kubernetes appArmorProfile types RuntimeDefault, Localhost, and Unconfined on Pods and containers, load a custom AppArmor profile on worker nodes, and diagnose allowed and denied file access from kubelet events and …

Download official Kubernetes release artifacts, verify SHA256 checksums and Cosign signatures on kubectl binaries and SPDX SBOMs, validate signed control-plane images, and record digests before install or deployment.

Audit kubelet authentication and authorization, test nodes/proxy and direct kubelet access, restrict cloud metadata exposure from Pods, and validate monitoring paths on a kubeadm cluster.

Audit a kubeadm cluster with kube-bench, interpret CIS PASS, WARN, and FAIL results, map findings to files, remediate one check, and verify the fix.

Map Kubernetes security architecture across the API server, nodes, workloads, networks, and supply chain, with attack paths and controls for CKS study.

Route HTTP and HTTPS traffic with Kubernetes Gateway API using GatewayClass, Gateway, and HTTPRoute for path matching, hostnames, weighted backends, TLS, and ReferenceGrant.

Troubleshoot Kubernetes PVC Pending, WaitForFirstConsumer delays, FailedAttachVolume, Multi-Attach, and FailedMount by following the volume lifecycle and reading Events.

Create a kubelet static Pod from a local manifest, inspect it with crictl, watch the API mirror Pod, and relate the same pattern to kubeadm control-plane components.

Protect replicated workloads with a PodDisruptionBudget, compare minAvailable and maxUnavailable, inspect disruptions allowed, and test voluntary eviction behavior with kubectl drain.

Upgrade a kubeadm cluster one minor version at a time: back up etcd, switch pkgs.k8s.io repositories, upgrade the control plane, then run kubeadm upgrade node, drain, and upgrade kubelet on each worker.

Control Pod placement with nodeSelector, required and preferred node affinity, IgnoredDuringExecution behavior, and pod affinity or anti-affinity using topologyKey on a kubeadm lab.

Configure Kubernetes HPA with Metrics Server, scale a Deployment by CPU and memory, and observe scale-up, scale-down, and autoscaling/v2 behavior.

Add, drain, remove, reset and rejoin kubeadm worker nodes with fresh tokens, version-skew checks, CSR verification and Ready-state testing.

Back up kubeadm-managed etcd with etcdctl, verify and restore the snapshot with etcdutl, and confirm Kubernetes API objects return.

Inspect kubeadm PKI under /etc/kubernetes/pki, create a client identity with a CertificateSigningRequest, build a kubeconfig, and renew control-plane certificates with kubeadm certs renew.

Compare Kubernetes CNI, CSI, and CRI extension interfaces, see how kubelet delegates networking, storage, and container execution, and run kubectl and node commands to discover what your cluster actually uses.

Fix Kubernetes Node NotReady and Unknown status by inspecting Node conditions, Lease heartbeats, kubelet and containerd, resource pressure, certificates, and kubectl debug node.

Troubleshoot a kubeadm control plane by branching on API reachability, then repairing static Pod manifests, kube-apiserver, etcd, scheduler, and controller-manager.

Troubleshoot FailedCreatePodSandBox and CNI errors by reading Events, scoping the failure, checking CNI agents and node config, and verifying sandbox networking with crictl.

Explain the Kubernetes networking model across same-Pod, Pod-to-Pod, and Pod-to-Service paths, including CNI, Pod and Service CIDRs, kube-proxy modes, and EndpointSlices.

Define a StorageClass, watch a PVC trigger dynamic PV creation with WaitForFirstConsumer, set a default class, compare reclaim policies, and verify mounts with the Rancher local-path provisioner.

Install a multi-node Kubernetes cluster with kubeadm, containerd, and Calico on Linux, with commands for RHEL-family, Ubuntu, and Debian systems.

Scan-first CKAD command reference for kubectl dry-run YAML generation, apply and patch, JSONPath, rollouts, Helm, Kustomize, probes, and troubleshooting with links to course lessons.

Practice CKAD skills with 25 hands-on Kubernetes scenarios grouped by exam domain, each with verification steps, hints, and worked solutions.

Learn Kubernetes taints and tolerations with practical examples. Test NoSchedule, PreferNoSchedule, NoExecute, nodeSelector, and kubectl taint.

Learn why Kubernetes needs a container registry, set up public and private registries, pull images directly or with imagePullSecrets, and choose between docker-registry Secrets, auth files, and tokens.

kubectl applies declarative YAML, generates manifests with dry-run, patches live objects, and filters output with JSONPath and custom columns on any Kubernetes cluster.

Learn what Kubernetes namespaces are, how namespaced resources differ from cluster-scoped objects, and how to create namespaces, switch with -n, and set a default namespace on your kubectl context.