Kubernetes
Where Kubernetes Gets Slow — API Server, etcd, Scheduler
Diagnosing the situation where workloads are fine but kubectl crawls and rollouts lag — a slow control plane. Excessive LIST/WATCH traffic hammering the API server, etcd fsync latency and database bloat, scheduler delays, and the metrics and fixes for each.
How to Choose requests and limits — Rules That Hold Up in Operations
Not what requests and limits mean, but what numbers to write: measurement-based request sizing, the CPU limit throttling debate, why memory limits are the default, QoS classes and eviction order, using VPA in recommendation mode, and the two failure modes — over-reservation and unlimited memory.
When HPA Doesn't Behave — 6 Common Configuration Mistakes
Why a Kubernetes HPA fails to scale, scales too late, or oscillates all day: missing requests and what the target percentage really means, scale-up reaction time and stabilization windows, flapping, GitOps fighting over replicas, and the limits of scaling on CPU alone.
When a Pod Is Stuck in Pending — 7 Causes and the Order to Check Them
The causes of Kubernetes Pods stuck in Pending, ordered by real-world frequency: reading the Events in describe, insufficient resources, oversized requests, nodeSelector and affinity mismatches, taints, PVC binding waits, ResourceQuota, and the cases where Cluster Autoscaler refuses to scale up.
Certified Kubernetes Administrator (CKA) #27 Full-Length Practice Exam — 17 Tasks with Solutions
The final post of the Certified Kubernetes Administrator (CKA) series. Work through 17 task scenarios that integrate every domain in the same flow as the real exam, then unfold each task's solution commands, YAML, and explanation to grade yourself. Sum the points against the 66% pass line and lay out a review path for your weak domains.
Certified Kubernetes Security Specialist (CKS) #20 Full-Length Practice Exam — 16 Tasks with Solutions
The final post of the Certified Kubernetes Security Specialist (CKS) series. Work through 16 task scenarios that integrate all six domains in the same flow as the real exam, then unfold each task's solution commands, YAML, and traps to grade yourself. Sum the points against the 67% pass line and lay out a review path for your weak domains.
Certified Kubernetes Administrator (CKA) #26: Exam Tips, Time Management, and Patterns People Miss
A condensed cheat sheet to read one more time right before you sit the CKA hands-on exam. We pull together time management for running roughly 15–20 tasks in 2 hours, the priority order driven by points and troubleshooting, a refreshed kubectl speed setup, context switching across multiple clusters, using the official docs, the recurring patterns where operators bleed points and how to avoid them, easily confused concept pairs, and a pre-exam checklist for each of the five domains. Next up in #27 is a full-scale hands-on mock exam.
Certified Kubernetes Application Developer (CKAD) #21 Full-Length Practice Exam — 18 Tasks with Solutions
The final post of the Certified Kubernetes Application Developer (CKAD) series. Work through 18 task scenarios that integrate every domain in the same flow as the real exam, then unfold each task's solution commands, YAML, and explanation to grade yourself. Check your weak domains against the 66% pass line and lay out a review path.
Certified Kubernetes Security Specialist (CKS) #19: Exam tips, time management, and patterns people get wrong
A condensed read to go through one more time right before you sit the CKS hands-on exam. We cover the time management of running roughly 15–20 tasks in 2 hours, prioritizing tasks by tool, re-running the setup right after the exam starts, switching context across multiple clusters, making use of kubernetes.io/docs and the Falco, Trivy, AppArmor, and gVisor official docs, the recurring patterns that leak points on a security hands-on exam and how to avoid them, easily confused concept pairs, and a per-domain pre-exam checklist across all six domains. Next up, #20 is a full-scale hands-on mock exam.
Certified Kubernetes Administrator (CKA) #25 Troubleshooting 4: Networking, DNS, RBAC, Certificate Expiry
The 25th post in the Certified Kubernetes Administrator (CKA) series. We lay out the diagnostic order to walk when service communication fails — from Endpoints all the way to NetworkPolicy — how to narrow down name-resolution failures with CoreDNS and nslookup, how to read RBAC Forbidden errors with auth can-i, and how to find and fix expired certificates with kubeadm certs check-expiration.
Certified Kubernetes Application Developer (CKAD) #20: Exam Tips, Time Management, and the Patterns People Miss
A compressed read-through to take with you right before the CKAD hands-on exam. We cover the time management for running roughly 15–20 tasks in 2 hours, a refresher on the kubectl speed setup, using imperative generators and the official docs, eight recurring patterns that leak points on the practical and how to avoid them, confusing concept pairs, and a per-domain pre-exam checklist. The next post, #21, is a full-scale hands-on mock exam.
Certified Kubernetes Security Specialist (CKS) #18: Container immutability, forensics
The eighteenth post in the Certified Kubernetes Security Specialist (CKS) series. We cover the final pieces of runtime security — container immutability and incident response. We work through YAML examples for the pattern of hardening the filesystem to read-only with readOnlyRootFilesystem and opening only the paths that need writes via emptyDir, the immutable operating model that forbids in-place changes and only swaps via redeploy, and the forensics procedure of isolating a compromised Pod with a NetworkPolicy and a node cordon, preserving evidence, and then investigating with kubectl debug.