Stage 7 · Master
CKA — Certified Kubernetes Administrator
Cluster Architecture & Installation (25%)
kubeadm, RBAC, upgrades, and etcd backup and restore — the CKA's most hands-on domain.
kubeadm Cluster Setup
kubeadm is the official tool for bootstrapping Kubernetes clusters. On the CKA exam, you need to know the initialization steps and what each command does. The process follows a well-defined sequence.
- kubeadm init — Initializes the control plane on the first node.
- kubeadm join — Joins worker nodes (and additional control plane nodes) to the cluster.
- kubeadm upgrade — Upgrades the cluster to a new Kubernetes version.
- kubeadm reset — Removes all kubeadm state from a node.
kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.1.10
# Set up kubeconfig for the admin user
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/configThe --pod-network-cidr flag specifies the CIDR for Pod networking. The --apiserver-advertise-address flag specifies the IP address the API server advertises to nodes.
Use imperative commands (kubectl create) instead of writing YAML manifests when speed matters. The CKA exam is timed, and imperative commands are faster for simple resources.
RBAC Deep Dive
RBAC is a core CKA topic. You will be asked to create Roles, ClusterRoles, and Bindings. Understand the difference between RoleBinding (namespace scope) and ClusterRoleBinding (cluster scope).
# Create a Role that allows reading pods
kubectl create role pod-reader --verb=get,list,watch --resource=pods --namespace=development
# Bind the Role to a user
kubectl create rolebinding my-binding --role=pod-reader --user=developer --namespace=development
# Create a ClusterRole for node access
kubectl create clusterrole node-viewer --verb=get,list,watch --resource=nodes
# Bind cluster-wide
kubectl create clusterrolebinding my-cluster-binding --clusterrole=node-viewer --user=ops-teamOn the CKA exam, use imperative commands to create RBAC resources quickly. Verify with kubectl auth can-i afterwards.
Cluster Upgrades
Kubernetes upgrades must be performed one minor version at a time (e.g., 1.28 to 1.29, not 1.28 to 1.30). The process involves upgrading the control plane first, then the worker nodes.
# Upgrade kubeadm
apt-get update && apt-get install -y kubeadm=1.29.0-1.1
kubeadm upgrade plan
kubeadm upgrade apply v1.29.0
# Upgrade kubelet and kubectl
apt-get install -y kubelet=1.29.0-1.1 kubectl=1.29.0-1.1
systemctl daemon-reload
systemctl restart kubeletOn the CKA exam, you may be asked to upgrade from one version to another. The key steps are: upgrade kubeadm, apply the upgrade, then upgrade kubelet and kubectl.
Always upgrade control plane before worker nodes. Upgrade one node at a time. Never skip versions. After upgrading each node, verify it is Ready before moving to the next one.
etcd Backup and Restore
etcd backup and restore is a guaranteed CKA task. You must know the exact commands to save a snapshot and restore from it. This is your disaster recovery safety net.
# Backup etcd
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key
# Verify the snapshot
ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-snapshot.db --write-out=table
# Restore etcd
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db \
--data-dir=/var/lib/etcd-restored \
--initial-cluster=master=https://127.0.0.1:2380 \
--initial-cluster-token=etcd-cluster \
--name=masterAlways include --cacert, --cert, and --key for TLS. The snapshot file contains all cluster state. After restoring, update the etcd data-dir in the static Pod manifest.
CKA Lab Environment
The CKA exam uses a browser-based terminal (PSI). You have a pre-configured cluster with kubectl access. The environment includes a text editor and a split-pane terminal. Practice in a similar environment before exam day.
- Browser-based terminal — Chrome or Chromium browser required.
- Split pane — Open multiple terminal tabs for parallel work.
- kubectl pre-configured — kubeconfig is already set up.
- Text editor — vi/vim is available.
- No internet — You cannot access external documentation during the exam.
The CKA exam allows you to access the official Kubernetes documentation at kubernetes.io. Bookmark the pages you need and practice navigating them quickly. The search function is your best friend.
Imperative Commands
Imperative commands let you create resources without writing YAML. They are faster for the exam and produce valid manifests. Use --dry-run=client -o yaml to generate YAML for review.
kubectl create namespace my-ns
kubectl run nginx --image=nginx:1.25 --port=80
kubectl expose pod nginx --port=80 --type=ClusterIP
kubectl create configmap my-config --from-literal=key1=value1
kubectl create secret generic my-secret --from-literal=password=abc123
kubectl create deployment web --image=nginx --replicas=3These imperative commands create the resources directly. Use them when speed matters. For complex configurations, fall back to YAML manifests.
Key Commands
kubectl get nodes -o wide
kubectl describe node <name>
kubectl get componentstatuses # Deprecated, use /healthz
kubectl get --raw /healthz?verbose
kubectl get pods -n kube-system
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data
kubectl uncordon <node>
kubectl cordon <node>The drain command evicts Pods and marks the node as unschedulable. Use it before maintenance. The uncordon command makes the node schedulable again.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.