Kubernetes CKAD Course Notes

Build and shape the Pod/workload correctly before worrying about rollout. Be fast with image references and command/args, choose the controller that matches the workload lifecycle, use init/native-sidecar patterns appropriately, and select ephemeral versus persistent storage based on lifecycle and access requirements.

• Define, build and modify container images: do not confuse tag = mutable name; digest = immutable content identity.

• Use `kubectl describe pod <pod>` first for pull errors; Events usually name the exact failure.

Deploy changes safely and reversibly. Implement blue/green or basic canary patterns with labels/Services, control Deployment RollingUpdates, manage Helm releases and value behavior, and use Kustomize bases/overlays without duplicating manifests.

• Use Kubernetes primitives to implement common deployment strategies: do not confuse blue/green = separate environments plus explicit cutover; canary = partial exposure of a new version.

• For reversible blue/green, make the Service the single cutover object.

Observe first, then repair. Migrate removed APIs, design probes around the correct failure action, extract state and metrics quickly with kubectl, retrieve the right log stream—including previous container instances—and debug systematically using status, Events, logs, configuration, and ephemeral debug containers.

• Understand API deprecations: do not confuse deprecated = still served but scheduled for removal; removed = api endpoint no longer served.

• When you see 'no matches for kind', inspect `apiVersion` before rewriting unrelated fields.

This is the heaviest domain. Discover CRDs and unfamiliar API resources, distinguish authn/authz/admission, understand and define resources/quotas, handle ConfigMap and Secret update semantics, use ServiceAccounts as least-privilege workload identities, and harden containers with securityContext and capabilities.

• Discover and use resources that extend Kubernetes: do not confuse crd = defines api type; custom resource = instance of that type; operator = automation/controller pattern.

• Unknown kind? Run `kubectl api-resources | grep -i <term>` before guessing commands.

Trace traffic end to end. NetworkPolicies create additive allow-list isolation when enforced by the CNI; Services depend on selectors, readiness, EndpointSlices, and correct ports; Ingress adds HTTP/HTTPS host/path routing but still relies on a functioning controller and healthy Service backends.

• Demonstrate basic understanding of NetworkPolicies: do not confuse networkpolicy = pod-level allow-list policy, not node firewall rules.

• Start by identifying selected Pods and direction before reading individual rules.