Certified Kubernetes Application Developer (CKAD) #21 実技模擬試験: 18 のタスク + 解説

k -n web create deploy front --image=nginx --replicas=3
k -n web expose deploy front --name=front-svc --port=80 --target-port=80

k -n web run cache-loader --image=redis $do > cache.yaml

apiVersion: v1
kind: Pod
metadata:
  name: cache-loader
  namespace: web
spec:
  initContainers:
    - name: wait-dns
      image: busybox
      command: ["sh", "-c", "until nslookup front-svc.web.svc.cluster.local; do sleep 2; done"]
  containers:
    - name: cache-loader
      image: redis

k apply -f cache.yaml

k -n web run printer --image=busybox --command -- sh -c "echo CKAD-2026 && sleep 3600"

spec:
  containers:
    - name: printer
      image: busybox
      command: ["sh", "-c", "echo CKAD-2026 && sleep 3600"]

k -n build run web-static --image=httpd:2.4 --labels="tier=frontend,env=staging"
k -n build get pods -l env=staging

k -n deploy create deploy api --image=nginx:1.25 --replicas=4
k -n deploy set image deploy/api nginx=nginx:1.26
k -n deploy rollout status deploy/api
k -n deploy rollout undo deploy/api
k -n deploy rollout status deploy/api
k -n deploy get deploy api -o jsonpath='{.spec.template.spec.containers[0].image}'

k -n batch create job pi-calc --image=perl $do \
  -- perl -Mbignum=bpi -wle "print bpi(200)" > pi.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: pi-calc
  namespace: batch
spec:
  completions: 4
  parallelism: 2
  backoffLimit: 3
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: pi-calc
          image: perl
          command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(200)"]

k apply -f pi.yaml

k -n batch create cronjob cleanup --image=busybox \
  --schedule="*/5 * * * *" $do -- sh -c "date; echo cleanup done" > cj.yaml

apiVersion: batch/v1
kind: CronJob
metadata:
  name: cleanup
  namespace: batch
spec:
  schedule: "*/5 * * * *"
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: cleanup
              image: busybox
              command: ["sh", "-c", "date; echo cleanup done"]

k apply -f cj.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: site
spec:
  replicas: 1
  selector:
    matchLabels:
      app: site
  template:
    metadata:
      labels:
        app: site
    spec:
      containers:
        - name: nginx
          image: nginx

resources:
  - deployment.yaml

resources:
  - ../base
labels:
  - pairs:
      app: site
    includeSelectors: false
images:
  - name: nginx
    newTag: "1.27"

k -n deploy apply -k overlay

k -n probe run health --image=nginx $do > health.yaml

spec:
  containers:
    - name: health
      image: nginx
      ports:
        - containerPort: 80
      livenessProbe:
        httpGet:
          path: /
          port: 80
        periodSeconds: 5
      readinessProbe:
        httpGet:
          path: /
          port: 80
        initialDelaySeconds: 5
        periodSeconds: 3

k apply -f health.yaml

k -n probe describe pod broken
k -n probe logs broken --previous > /tmp/broken.log

k top pod -A --sort-by=cpu

k -n cfg create configmap app-cfg \
  --from-literal=APP_MODE=production --from-literal=LOG_LEVEL=info
k -n cfg run reader --image=busybox $do --command -- sleep 3600 > reader.yaml

spec:
  containers:
    - name: reader
      image: busybox
      command: ["sleep", "3600"]
      env:
        - name: APP_MODE
          valueFrom:
            configMapKeyRef:
              name: app-cfg
              key: APP_MODE
      volumeMounts:
        - name: cfg-vol
          mountPath: /etc/config
  volumes:
    - name: cfg-vol
      configMap:
        name: app-cfg

k apply -f reader.yaml

k -n sec create secret generic db-cred \
  --from-literal=username=admin --from-literal=password=s3cr3t
k -n sec run db-client --image=busybox $do --command -- sleep 3600 > db.yaml

spec:
  containers:
    - name: db-client
      image: busybox
      command: ["sleep", "3600"]
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-cred
              key: password

k apply -f db.yaml

k -n sec run hardened --image=nginx $do > hardened.yaml

spec:
  containers:
    - name: hardened
      image: nginx
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true

k apply -f hardened.yaml

k -n data run sized --image=nginx $do > sized.yaml

spec:
  containers:
    - name: sized
      image: nginx
      resources:
        requests:
          cpu: "100m"
          memory: "128Mi"
        limits:
          cpu: "200m"
          memory: "256Mi"

k apply -f sized.yaml
k -n data get pod sized -o jsonpath='{.status.qosClass}'

k -n net create deploy shop --image=nginx --replicas=2
k -n net expose deploy shop --name=shop-np --type=NodePort --port=80 --target-port=80

k -n net patch svc shop-np --type='json' \
  -p='[{"op":"replace","path":"/spec/ports/0/nodePort","value":30080}]'

k -n net create ingress shop-ing \
  --rule="shop.example.com/*=shop-np:80" $do > ing.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop-ing
  namespace: net
spec:
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: shop-np
                port:
                  number: 80

k apply -f ing.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-allow
  namespace: net
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: api
      ports:
        - protocol: TCP
          port: 5432

k apply -f db-allow.yaml