Cka hands-on labs

[MyrinNew]

📘

Topic Coverage:

• Startup / Readiness / Liveness Probes
• ConfigMaps
• Secrets
• Configuration mistakes & fixes

Environment:

• Minikube
• kubectl
• Local machine (Mac / Linux / Windows)

LAB 0 — Environment Check (MANDATORY)





minikube start
kubectl get nodes







Expected:






STATUS: Ready










🧪 LAB 1 — STARTUP PROBE (CrashLoopBackOff ISSUE)

🎯 Goal

Understand why slow apps restart endlessly and how startup probe fixes it.





Step 1 — Deploy a slow application (BROKEN)





# lab1-broken.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: slow-app
spec:
replicas: 1
selector:
matchLabels:
app: slow
template:
metadata:
labels:
app: slow
spec:
containers:
- name: app
image: busybox
command: ["sh", "-c"]
args:
- sleep 30; echo STARTED; sleep 3600
livenessProbe:
exec:
command: ["sh", "-c", "echo ok"]
initialDelaySeconds: 5
periodSeconds: 5







Apply:






kubectl apply -f lab1-broken.yaml
kubectl get pods










❌ What breaks

• Pod enters CrashLoopBackOff
• Liveness probe runs before app finishes startup

Check:






kubectl describe pod










Step 2 — FIX using startup probe





# lab1-fixed.yaml
startupProbe:
exec:
command: ["sh", "-c", "echo ok"]
failureThreshold: 40
periodSeconds: 1







Add this under the container spec.


Apply:






kubectl apply -f lab1-fixed.yaml
kubectl get pods










✅ Expected Result

• Pod starts successfully
• No restarts

💡 CKA LESSON

• Startup probe blocks liveness
• Mandatory for slow apps (Java, DB, migrations)

🧪 LAB 2 — READINESS PROBE (TRAFFIC ISSUE)

🎯 Goal

Stop traffic to unhealthy pods without restarting them





Step 1 — Deploy app WITHOUT readiness





# lab2-broken.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: ready-app
spec:
replicas: 1
selector:
matchLabels:
app: ready
template:
metadata:
labels:
app: ready
spec:
containers:
- name: app
image: hashicorp/http-echo:0.2.3
args:
- "-listen=:8080"
- "-text=HELLO"
ports:
- containerPort: 8080







Service:






apiVersion: v1
kind: Service
metadata:
name: ready-svc
spec:
selector:
app: ready
ports:
- port: 80
targetPort: 8080







Apply:






kubectl apply -f lab2-broken.yaml
kubectl apply -f service.yaml










❌ What breaks

• Pod always receives traffic
• No way to stop traffic during issues

Check:






kubectl get endpoints ready-svc










Step 2 — FIX using readiness probe





readinessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 5
periodSeconds: 3







Apply fix.





✅ Expected Result

• When readiness fails → pod removed from endpoints
• Pod still Running

💡 CKA LESSON

• Readiness controls traffic
• Required for zero downtime

🧪 LAB 3 — LIVENESS PROBE (HUNG APP)

🎯 Goal

Restart stuck containers automatically





Step 1 — Deploy app WITHOUT liveness





# lab3-broken.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: hang-app
spec:
replicas: 1
selector:
matchLabels:
app: hang
template:
metadata:
labels:
app: hang
spec:
containers:
- name: app
image: nginx







Apply:






kubectl apply -f lab3-broken.yaml










❌ Simulate hang





kubectl exec -it pod-name -- kill 1
kubectl get pods







Result:

• Pod stays Running
• App is dead

Step 2 — FIX using liveness probe





livenessProbe:
httpGet:
path: /
port: 80
initialDelaySeconds: 10
periodSeconds: 5







Apply fix.





✅ Expected Result

• Pod restarts automatically

💡 CKA LESSON

• Liveness = self-healing
• Without it, Kubernetes does nothing

🧪 LAB 4 — CONFIGMAP (CONFIG NOT APPLIED ISSUE)

🎯 Goal

Understand why config changes don’t apply automatically





Step 1 — Create ConfigMap





kubectl create configmap app-config \
--from-literal=APP_COLOR=blue










Step 2 — Inject via env (BROKEN EXPECTATION)





env:
- name: APP_COLOR
valueFrom:
configMapKeyRef:
name: app-config
key: APP_COLOR







Apply deployment.





❌ What breaks





kubectl edit configmap app-config







Change value → app does NOT change.





Step 3 — FIX





kubectl rollout restart deployment app










💡 CKA LESSON

• Env vars are immutable
• Restart required

🧪 LAB 5 — CONFIGMAP AS FILE (RELOAD CONFUSION)

🎯 Goal

Understand mounted config behavior





Step 1 — Mount ConfigMap





volumes:
- name: config
configMap:
name: app-config

volumeMounts:
- name: config
mountPath: /etc/config










Step 2 — Update ConfigMap





kubectl edit configmap app-config










❌ Observation

• File updates
• App behavior does NOT change

💡 CKA LESSON

• Kubernetes updates file
• App must reload manually

🧪 LAB 6 — SECRETS (SECURITY TRAP)

🎯 Goal

Handle secrets correctly





Step 1 — Create Secret





kubectl create secret generic db-secret \
--from-literal=DB_PASS=secret123










Step 2 — Inject as env





env:
- name: DB_PASS
valueFrom:
secretKeyRef:
name: db-secret
key: DB_PASS










❌ Common mistake





kubectl describe pod







Secrets visible in plain text.





💡 CKA LESSON

• Secrets are base64
• RBAC is mandatory
• Never commit secrets

✅ FINAL CHECKLIST

✔ Startup vs readiness vs liveness

✔ ConfigMap injection methods

✔ Why config updates fail

✔ Secret handling risks

✔ Rollout restarts

✔ Debug using describe, logs, exec




More...