🚢Kubernetes Certifications

Labs

Exercices pratiques gradés par l'état réel du simulateur — pas par QCM.

PlaygroundSimulateur libre : explore, casse, recommence.Mock exam CKA (v1.35)10 tâches · 120 min · cluster partagéMock exam CKAD (v1.35)10 tâches · 120 min · cluster partagéMock exam CKS (v1.35)8 tâches · 120 min · cluster partagé

Foundations

Create and inspect a PodA diagnostic container is needed in namespace cert-lab. Create it declaratively and prove it is running.Starter12′Repair a Service selectorThe storefront Pods are healthy but the Service has no endpoints. Find and correct the selector mismatch.Starter15′

Configuration and Security

Inject configuration and a SecretConfigure api deployment in namespace app using MODE=production and a database password without baking either value into the image.Starter18′Add resources and health probesThe web deployment is schedulable but unreliable. Add realistic requests/limits and make traffic wait for the health endpoint.Intermediate22′

Services & Networking

Expose and resolve an applicationClients in namespace frontend must reach Deployment api in namespace backend through port 80, while the Pods listen on 8080.Starter18′Create default-deny and exact allowsIsolate namespace backend. API Pods may receive TCP 8080 only from frontend Pods labeled role=client. They may reach kube-system DNS on UDP/TCP 53.Advanced28′Publish an HTTP routeRoute requests for app.example.test/api to Service api port 80 in namespace app using either Ingress or Gateway API.Intermediate24′

Workloads & Scheduling

Perform and recover a rolloutUpdate web from nginx:1.26 to nginx:1.27, scale to four replicas, then practice rolling back one revision.Intermediate22′Dedicate a node with taints and affinityReserve worker-2 for analytics and place the report Pod there without allowing unrelated workloads.Intermediate25′

Cluster Architecture

Build least-privilege RBACServiceAccount auditor in namespace finance may get, list and watch Pods and read pod logs, but may not modify workloads.Intermediate24′Plan a safe node upgradePrepare worker-2 for a one-minor kubelet upgrade without disrupting DaemonSets, then return it to service.Advanced25′

Storage

Provision and mount persistent storageCreate a 2Gi ReadWriteOnce claim named data using StorageClass fast, then mount it at /var/lib/app in Deployment database.Intermediate24′

Troubleshooting

Recover a NotReady nodeworker-1 is NotReady because its kubelet service is stopped. Diagnose from cluster evidence, restart it and verify workloads recover.Advanced30′

Application Design and Build

Build an init + sidecar PodCreate Pod web-composite: an init container writes initial HTML to a shared volume, nginx serves it, and a sidecar appends timestamps to a shared log.Advanced28′Create resilient batch workloadsCreate Job checksum with three completions and two-way parallelism, then CronJob cleanup every 15 minutes with concurrency forbidden.Intermediate22′

Microservice Security

Meet the Restricted security profileHarden Deployment payments so it runs as non-root, cannot escalate, drops all capabilities, uses RuntimeDefault seccomp and has a read-only root filesystem.Advanced28′

Supply Chain Security

Verify a deployment artifactBefore deploying registry.example.test/payments@sha256:abc123, scan it for critical findings and verify its signing identity.Advanced25′

Runtime Security

Investigate and contain a runtime alertFalco reports a shell launched in Pod checkout-7d9f. Preserve evidence, inspect the workload, isolate it with a deny policy and remove its API credentials.Expert32′