Session setup

export do='--dry-run=client -o yaml'
export now='--grace-period=0 --force'

Kill sheet

Debug triggers

SymptomFirst checks
Pendingdescribe pod → Events
CrashLoopBackOfflogs → command / probes
Service no trafficendpoints / selector / labels
DNS failnslookup inside pod

Core commands

kubectl describe pod <p>
kubectl logs -f <p> [-c c]
kubectl exec -it <p> -- sh
kubectl get events --sort-by=.metadata.creationTimestamp
kubectl explain pod.spec.containers.resources   # in-exam API reference

YAML speed

kubectl create deployment d --image=nginx --dry-run=client -o yaml > d.yaml
# or with alias:
k create deployment d --image=nginx $do > d.yaml

Docker / image tasks (DB-01)

which docker podman nerdctl    # use whichever exists
docker build -t myapp:1.0 .
docker tag myapp:1.0 registry.local/myapp:1.0
docker save myapp:1.0 -o /tmp/myapp.tar    # OCI image tar: NOT docker export
docker load -i /tmp/myapp.tar
# deploy loaded image:
# image: myapp:1.0  +  imagePullPolicy: Never

Fast creation

kubectl create deployment d --image=nginx
kubectl expose deployment d --port=80 --target-port=80
kubectl run bb --image=busybox -it --rm -- sh
kubectl create job j --image=busybox -- echo hi
kubectl create cronjob cj --schedule="*/1 * * * *" --image=busybox -- echo hi

Common failures

SymptomCause
HPA no scaleNo CPU requests
Deployment no podsSelector mismatch (immutable)
Readiness wrongNo traffic
Liveness wrongCrashLoopBackOff
PVC PendingNo StorageClass / mismatch
CreateContainerConfigErrorMissing/wrong ConfigMap or Secret name
Forbidden: exceeded quotaResourceQuota admission: not RBAC
Forbidden: violates PodSecurityPod Security admission: fix securityContext

kubectl short names

ResourceShort
podspo
replicasetsrs
deploymentsdeploy
servicessvc
namespacesns
networkpoliciesnetpol
persistentvolumespv
persistentvolumeclaimspvc
serviceaccountssa
configmapscm
horizontalpodautoscalershpa
ingressesing
nodesno

Time management (2h, ~19 questions)

  • Any order: easy first
  • Mark for review after 2 failed attempts, move on
  • Imperative first: kubectl run, create, expose faster than YAML from scratch
  • --dry-run=client -o yaml: only when custom fields needed
  • Set namespace once: kubectl config set-context --current --namespace=<ns>
  • Fast delete: kubectl delete pod <n> --now (exam only)
  • Verify every answer: kubectl get / describe

vim

  • gg / G: top / bottom
  • dd: delete line; yy + p: copy/paste line
  • Shift + D: delete to end of line
  • :set paste: before pasting from clipboard
  • :set expandtab tabstop=2 shiftwidth=2: YAML-safe indent

kubectl explain

kubectl explain pod.spec.containers
kubectl explain pod.spec.containers.resources
kubectl explain pod.spec.securityContext
kubectl explain deployment.spec.strategy
kubectl explain networkpolicy.spec.ingress
kubectl explain pvc.spec.accessModes
kubectl explain cronjob.spec.jobTemplate

Misc gotchas

  • Check which namespace each question specifies
  • -- separates kubectl flags from in-container command
  • k logs -p for CrashLoopBackOff: previous container logs