Stage 7 · Master
CKAD — Certified Kubernetes Application Developer
Services & Networking (20%)
Services, Ingress, and NetworkPolicy for applications — connecting workloads.
Service Types
Services provide stable networking for Pods. On the CKAD, you need to create Services that expose applications correctly. Know the difference between ClusterIP, NodePort, and LoadBalancer.
# ClusterIP (default)
kubectl expose deployment my-app --port=80 --target-port=8080
# NodePort
kubectl expose deployment my-app --port=80 --type=NodePort
# LoadBalancer
kubectl expose deployment my-app --port=80 --type=LoadBalancer
# Check service endpoints
kubectl get endpoints my-app-svcThe --target-port flag specifies the port the container listens on. The --port flag is the Service port. If not specified, --target-port defaults to --port.
Ingress Configuration
Ingress routes external HTTP traffic to Services based on hostname and path rules. You need an Ingress controller installed in the cluster for Ingress resources to work.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
ingressClassName: nginx
rules:
- host: myapp.example.com
http:
paths:
- path: /api
pathType: Prefix
backend:
service:
name: api-service
port:
number: 80
- path: /
pathType: Prefix
backend:
service:
name: frontend-service
port:
number: 80pathType: Prefix means /api matches /api, /api/v1, /api/v2, etc. pathType: Exact means /api matches only /api exactly. pathType: ImplementationSpecific depends on the Ingress controller.
Network Policies
Network Policies control Pod-to-Pod traffic. On the CKAD, you will be asked to create Network Policies that allow or deny specific traffic patterns.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-frontend
namespace: backend
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
purpose: frontend
podSelector:
matchLabels:
app: web
ports:
- protocol: TCP
port: 8080This NetworkPolicy allows ingress to Pods labeled app=api in the backend namespace, but only from Pods labeled app=web in namespaces labeled purpose=frontend.
namespaceSelector and podSelector in the same rule are ANDed. Multiple items in the from array are ORed. This means: (namespaceSelector AND podSelector) OR (next rule).
DNS Debugging
DNS issues are common on the CKAD. If a Pod cannot reach a Service by name, check DNS resolution first. CoreDNS is the default DNS server in Kubernetes.
# Test DNS from inside a Pod
kubectl exec -it my-pod -- nslookup my-service
kubectl exec -it my-pod -- nslookup my-service.my-namespace.svc.cluster.local
# Check DNS configuration
kubectl exec -it my-pod -- cat /etc/resolv.conf
# Check CoreDNS pods
kubectl get pods -n kube-system -l k8s-app=kube-dns
# Restart CoreDNS if needed
kubectl rollout restart deployment coredns -n kube-systemDNS names follow the pattern: service-name.namespace.svc.cluster.local. Short names (like my-service) only work within the same namespace. Use FQDNs for cross-namespace access.
Key Commands
kubectl get svc -A
kubectl get ingress -A
kubectl get networkpolicies -A
kubectl describe svc my-service
kubectl get endpoints my-service
kubectl run test --image=busybox --rm -it -- nslookup my-service
kubectl run test --image=busybox --rm -it -- wget -qO- http://my-service:80
kubectl exec -it my-pod -- cat /etc/resolv.confThese commands are essential for networking troubleshooting on the CKAD. Practice them until they are automatic.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.