Examples

Original CKA practice scenarios — not official exam items. Full task text is below. Interactive Start Exam (terminal + grader) is not public yet.

• cka-mvp-01 · Deploy and expose nginxDeployment + Service · 15 min
• cka-mvp-02 · Config via ConfigMapConfigMap + envFrom
• cka-mvp-03 · Secret mountSecret volume mode 0400
• cka-mvp-04 · NetworkPolicydefault-deny + allow
• cka-mvp-05 · RBAC least privilegeSA + Role + RoleBinding

cka-mvp-01 · Deploy and expose nginx

Create a Deployment and Service in the current namespace so clients can reach nginx over ClusterIP.

Requirements

1. Deployment named web
   • replicas: 2
   • container image: nginx:1.27.1 (exact tag)
   • both replicas Ready
2. Service named web-svc
   • type: ClusterIP
   • port 80 → targetPort 80
   • selects the web pods

Notes

• Work only in your exam namespace / vCluster.
• Soft time limit: 15 minutes.

cka-mvp-02 · Config via ConfigMap

Wire application configuration through a ConfigMap.

Requirements

1. ConfigMap named app-config with key APP_ENV=prod
2. Pod named app that loads env from that ConfigMap via envFrom.configMapRef
3. Pod phase Running

cka-mvp-03 · Secret mount

Mount database credentials as files for a client Pod.

Requirements

1. Secret named db-cred with keys user and password
2. Pod named db-client mounts that Secret at /etc/db
3. Volume defaultMode 0400 (decimal 256)

cka-mvp-04 · NetworkPolicy default-deny + allow

Secure namespace shop with default-deny and a narrow allow rule.

Requirements

1. NetworkPolicy default-deny in namespace shop that selects all pods and denies Ingress (and preferably Egress)
2. NetworkPolicy allow-frontend in namespace shop allowing traffic from Pod label app=frontend to pods with app=backend on TCP 8080

Namespace shop may already exist; create it if missing.

cka-mvp-05 · RBAC least privilege

Give a ServiceAccount read-only access to Pods and nothing more for Deployments.

Requirements

1. ServiceAccount reader
2. Role that allows get and list on pods
3. RoleBinding that binds that Role to SA reader
4. As SA reader: auth can-i get pods → yes; auth can-i create deployments → no