# Core resource types you must master
kubectl api-resources --namespaced=true | grep -E "(pods|deployments|services|configmaps|secrets|ingress)"

# Understanding resource hierarchy
kubectl explain pod.spec.containers.resources
kubectl explain deployment.spec.template.spec
kubectl explain service.spec

# Self-Assessment Checklist
Core Skills:
  ✓ Create pods, deployments, services without referring to documentation
  ✓ Understand YAML structure and common fields
  ✓ Navigate kubectl help and Kubernetes docs efficiently
  ✓ Debug basic pod and service connectivity issues
  ✓ Modify running resources using imperative commands

Time Management:
  ✓ Complete basic pod creation in under 2 minutes
  ✓ Set up service exposure in under 3 minutes
  ✓ Troubleshoot failed pods in under 5 minutes

# Multi-container pod with shared volumes
kubectl run multi-container --image=nginx --dry-run=client -o yaml > multi.yaml

# Example multi-container pod configuration
cat << EOF > multi-container-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: multi-container
spec:
  containers:
  - name: nginx
    image: nginx:1.20
    volumeMounts:
    - name: shared-data
      mountPath: /usr/share/nginx/html
  - name: content-provider
    image: busybox
    command: ['sh', '-c', 'while true; do echo "Hello from sidecar at $(date)" > /shared/index.html; sleep 30; done']
    volumeMounts:
    - name: shared-data
      mountPath: /shared
  volumes:
  - name: shared-data
    emptyDir: {}
EOF

# ConfigMap creation and usage patterns
kubectl create configmap app-config \
  --from-literal=database_url=postgres://db:5432/app \
  --from-literal=debug_mode=true \
  --from-file=config.properties

# Secret creation with different data types
kubectl create secret generic app-secrets \
  --from-literal=api_key=super-secret-key \
  --from-literal=database_password=db-password

# Environment variable injection patterns
kubectl run app --image=nginx --dry-run=client -o yaml | \
kubectl patch --local -o yaml -p '
spec:
  containers:
  - name: nginx
    envFrom:
    - configMapRef:
        name: app-config
    - secretRef:
        name: app-secrets
' -f - > app-with-config.yaml

# Essential aliases and functions
cat << 'EOF' >> ~/.bashrc
# CKAD exam optimizations
alias k=kubectl
alias kg='kubectl get'
alias kd='kubectl describe'
alias kdel='kubectl delete'
alias kaf='kubectl apply -f'

# Dry-run shortcuts
export do="--dry-run=client -o yaml"
export now="--grace-period=0 --force"

# Quick namespace switching
function kns() {
    kubectl config set-context --current --namespace=$1
}

# Fast pod inspection
function kpod() {
    kubectl get pod $1 -o yaml | less
}

# Quick service exposure
function ksvc() {
    kubectl expose pod $1 --port=$2 --target-port=$3 --name=$1-service
}
EOF

source ~/.bashrc

" ~/.vimrc - Optimized for CKAD exam
set tabstop=2
set shiftwidth=2
set expandtab
set autoindent
set number
syntax on

" YAML-specific settings
autocmd FileType yaml setlocal ts=2 sts=2 sw=2 expandtab

" Quick YAML templates
nnoremap <leader>p :read !kubectl run temp --image=nginx $do<CR>
nnoremap <leader>d :read !kubectl create deployment temp --image=nginx $do<CR>
nnoremap <leader>s :read !kubectl create service clusterip temp --tcp=80:80 $do<CR>

# Basic pod with resource limits
kubectl run web --image=nginx:1.20 --requests=cpu=100m,memory=128Mi --limits=cpu=200m,memory=256Mi

# Pod with environment variables
kubectl run app --image=busybox --env="ENV=production" --env="DEBUG=false" -- sleep 3600

# Pod with volume mounts
kubectl run data-pod --image=nginx $do > pod.yaml
# Then edit to add volumes

# Pod with specific restart policy
kubectl run batch-job --image=busybox --restart=OnFailure -- /bin/sh -c "echo 'Job completed'"

# Expose pod with specific port
kubectl expose pod web --port=80 --target-port=8080 --name=web-service

# Create NodePort service
kubectl expose deployment api --type=NodePort --port=80 --target-port=3000

# Create LoadBalancer service
kubectl expose deployment app --type=LoadBalancer --port=80

# ConfigMap from literals
kubectl create configmap app-config \
  --from-literal=database_host=postgres \
  --from-literal=database_port=5432 \
  --from-literal=app_name=myapp

# ConfigMap from files
kubectl create configmap nginx-config --from-file=nginx.conf

# Secret creation
kubectl create secret generic db-secret \
  --from-literal=username=admin \
  --from-literal=password=secretpassword

# TLS secret creation
kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key

# 1. Generate base YAML
kubectl run webapp --image=nginx:1.20 $do > webapp.yaml

# 2. Quick inline modifications using yq or manual editing
yq eval '.spec.containers[0].resources = {"requests": {"cpu": "100m", "memory": "128Mi"}, "limits": {"cpu": "200m", "memory": "256Mi"}}' -i webapp.yaml

# 3. Apply and verify
kubectl apply -f webapp.yaml
kubectl get pod webapp -o wide

# Add security context to existing pod
yq eval '.spec.securityContext = {"runAsNonRoot": true, "runAsUser": 1000}' -i pod.yaml

# Add volume and volumeMount
yq eval '
  .spec.volumes += [{"name": "data", "emptyDir": {}}] |
  .spec.containers[0].volumeMounts += [{"name": "data", "mountPath": "/data"}]
' -i pod.yaml

# Add environment variables from ConfigMap
yq eval '.spec.containers[0].envFrom += [{"configMapRef": {"name": "app-config"}}]' -i pod.yaml

# Sidecar pattern - logging collector
apiVersion: v1
kind: Pod
metadata:
  name: sidecar-logging
spec:
  containers:
  - name: app
    image: nginx:1.20
    volumeMounts:
    - name: logs
      mountPath: /var/log/nginx
  - name: log-collector
    image: fluent/fluent-bit:1.8
    volumeMounts:
    - name: logs
      mountPath: /var/log/nginx
      readOnly: true
    - name: fluent-config
      mountPath: /fluent-bit/etc
  volumes:
  - name: logs
    emptyDir: {}
  - name: fluent-config
    configMap:
      name: fluent-config

# Create Job with completion and parallelism
kubectl create job data-processor --image=busybox -- /bin/sh -c "echo 'Processing data'; sleep 30"

# Convert to CronJob
kubectl create cronjob backup-job --image=busybox --schedule="0 2 * * *" -- /bin/sh -c "echo 'Backup completed'"

# Job with multiple completions
kubectl create job parallel-job --image=busybox $do | \
yq eval '.spec.completions = 5 | .spec.parallelism = 2' > parallel-job.yaml

# Create deployment with replica scaling
kubectl create deployment web-app --image=nginx:1.20 --replicas=3

# Rolling update strategies
kubectl patch deployment web-app -p '{"spec":{"strategy":{"type":"RollingUpdate","rollingUpdate":{"maxUnavailable":"25%","maxSurge":"25%"}}}}'

# Update deployment image
kubectl set image deployment/web-app nginx=nginx:1.21

# Rollback deployment
kubectl rollout undo deployment/web-app

# Scale deployment
kubectl scale deployment web-app --replicas=5

# Add Helm repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Install package
helm install my-nginx bitnami/nginx

# Upgrade package
helm upgrade my-nginx bitnami/nginx --set replicaCount=3

# List installations
helm list

# Uninstall
helm uninstall my-nginx

# Comprehensive probe configuration
apiVersion: v1
kind: Pod
metadata:
  name: probe-example
spec:
  containers:
  - name: app
    image: nginx:1.20
    ports:
    - containerPort: 80
    livenessProbe:
      httpGet:
        path: /health
        port: 80
      initialDelaySeconds: 30
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      httpGet:
        path: /ready
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 5
      timeoutSeconds: 3
      failureThreshold: 3
    startupProbe:
      httpGet:
        path: /startup
        port: 80
      initialDelaySeconds: 10
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 30

# Pod debugging commands
kubectl logs pod-name -c container-name --previous
kubectl exec -it pod-name -c container-name -- /bin/bash
kubectl describe pod pod-name

# Resource monitoring
kubectl top pods
kubectl top nodes

# Event monitoring
kubectl get events --sort-by=.metadata.creationTimestamp

# Resource inspection
kubectl get pod pod-name -o yaml
kubectl get pod pod-name -o jsonpath='{.status.phase}'

# Pod-level and container-level security contexts
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  containers:
  - name: app
    image: nginx:1.20
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: var-cache
      mountPath: /var/cache/nginx
    - name: var-run
      mountPath: /var/run
  volumes:
  - name: tmp
    emptyDir: {}
  - name: var-cache
    emptyDir: {}
  - name: var-run
    emptyDir: {}

# Comprehensive NetworkPolicy example
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-app-netpol
spec:
  podSelector:
    matchLabels:
      app: web-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    - namespaceSelector:
        matchLabels:
          name: production
    ports:
    - protocol: TCP
      port: 80
  egress:
  - to:
    - podSelector:
        matchLabels:
          role: database
    ports:
    - protocol: TCP
      port: 5432
  - to: []
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

# ClusterIP service (default)
kubectl expose deployment web-app --port=80 --target-port=8080

# NodePort service
kubectl expose deployment web-app --type=NodePort --port=80 --target-port=8080

# LoadBalancer service
kubectl expose deployment web-app --type=LoadBalancer --port=80 --target-port=8080

# ExternalName service
kubectl create service externalname my-service --external-name=example.com

# Advanced Ingress with multiple backends
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-service-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      - path: /
        pathType: Prefix
        backend:
          service:
            name: default-service
            port:
              number: 80

# Typical exam question pattern
apiVersion: v1
kind: Pod
metadata:
  name: shared-storage-pod
  namespace: exam-namespace
spec:
  containers:
  - name: producer
    image: busybox
    command: ['sh', '-c', 'while true; do echo "$(date): Producer data" >> /shared/data.log; sleep 5; done']
    volumeMounts:
    - name: shared-volume
      mountPath: /shared
  - name: consumer
    image: busybox
    command: ['sh', '-c', 'while true; do tail -f /shared/data.log; sleep 1; done']
    volumeMounts:
    - name: shared-volume
      mountPath: /shared
  volumes:
  - name: shared-volume
    emptyDir: {}

# Fast solution pattern
kubectl create configmap app-config \
  --from-literal=database_host=postgres \
  --from-literal=cache_host=redis \
  -n exam-namespace

kubectl create secret generic app-secrets \
  --from-literal=database_password=secretpass \
  --from-literal=api_key=abc123 \
  -n exam-namespace

kubectl run app --image=nginx $do -n exam-namespace | \
yq eval '
  .spec.containers[0].envFrom = [
    {"configMapRef": {"name": "app-config"}},
    {"secretRef": {"name": "app-secrets"}}
  ]
' > app-with-config.yaml

kubectl apply -f app-with-config.yaml

# Complete service and ingress setup
kubectl create deployment web-app --image=nginx:1.20 --replicas=3 -n exam-namespace
kubectl expose deployment web-app --port=80 --target-port=80 -n exam-namespace

cat << EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-app-ingress
  namespace: exam-namespace
spec:
  rules:
  - host: web-app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-app
            port:
              number: 80
EOF

# 1. Check pod status and events
kubectl get pods -n namespace
kubectl describe pod problem-pod -n namespace

# 2. Check logs
kubectl logs problem-pod -n namespace
kubectl logs problem-pod -c container-name -n namespace --previous

# 3. Check resource constraints
kubectl top pod problem-pod -n namespace
kubectl describe node node-name

# 4. Check security and networking
kubectl get networkpolicies -n namespace
kubectl describe networkpolicy policy-name -n namespace

# 5. Interactive debugging
kubectl exec -it problem-pod -n namespace -- /bin/bash
kubectl debug problem-pod -it --image=busybox

# Resource utilization analysis
kubectl top pods --all-namespaces --sort-by=cpu
kubectl top pods --all-namespaces --sort-by=memory

# Event analysis for resource issues
kubectl get events --field-selector reason=FailedScheduling --all-namespaces

# Node capacity analysis
kubectl describe nodes | grep -A 5 "Allocated resources"

# Service connectivity testing
kubectl run debug-pod --image=busybox -it --rm -- /bin/sh
# Inside pod:
nslookup service-name.namespace.svc.cluster.local
wget -qO- http://service-name.namespace:port

# NetworkPolicy testing
kubectl exec -it test-pod -- nc -v target-pod-ip 80
kubectl auth can-i create networkpolicies --as=system:serviceaccount:namespace:serviceaccount

# Environment-specific configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config-production
data:
  DATABASE_URL: "postgres://prod-db:5432/app"
  REDIS_URL: "redis://prod-cache:6379"
  LOG_LEVEL: "info"
  FEATURE_FLAGS: "analytics:true,beta:false"
---
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets-production
type: Opaque
data:
  DATABASE_PASSWORD: cHJvZC1wYXNzd29yZA==  # base64 encoded
  API_KEY: YWJjMTIzZGVmNDU2  # base64 encoded
  JWT_SECRET: c3VwZXItc2VjcmV0LWp3dA==  # base64 encoded

apiVersion: apps/v1
kind: Deployment
metadata:
  name: twelve-factor-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: twelve-factor-app
  template:
    metadata:
      labels:
        app: twelve-factor-app
    spec:
      containers:
      - name: app
        image: twelve-factor-app:v1.2.3
        ports:
        - containerPort: 8080
        env:
        - name: PORT
          value: "8080"
        envFrom:
        - configMapRef:
            name: app-config-production
        - secretRef:
            name: app-secrets-production
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 512Mi
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        startupProbe:
          httpGet:
            path: /startup
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
          failureThreshold: 30

# Service with Istio sidecar injection
apiVersion: v1
kind: Service
metadata:
  name: user-service
  labels:
    app: user-service
spec:
  ports:
  - port: 80
    targetPort: 8080
    name: http
  selector:
    app: user-service
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: user-service
        image: user-service:v1.0.0
        ports:
        - containerPort: 8080

# Istio DestinationRule with circuit breaker
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: user-service
spec:
  host: user-service
  trafficPolicy:
    circuitBreaker:
      consecutiveErrors: 3
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
    connectionPool:
      tcp:
        maxConnections: 10
      http:
        http1MaxPendingRequests: 10
        maxRequestsPerConnection: 2

# Skills to develop
- Operator development (Kubebuilder, Operator SDK)
- Custom Resource Definitions (CRDs)
- Admission controllers and webhooks
- GitOps workflows (ArgoCD, Flux)
- Infrastructure as Code (Terraform, Pulumi)

# Security-focused skills
- Pod Security Standards and policies
- Network segmentation and policies
- Supply chain security
- Runtime security monitoring
- Compliance frameworks (SOC2, PCI DSS)

# Cluster administration skills
- Cluster setup and bootstrapping
- etcd backup and restore
- Certificate management
- Node management and troubleshooting
- High availability configurations

# Ways to contribute to Kubernetes ecosystem
git clone https://github.com/kubernetes/kubernetes
cd kubernetes
# Focus areas for new contributors:
# - Documentation improvements
# - Test coverage expansion
# - Bug fixes in kubectl
# - Community tools and utilities

# Example: Multi-tier application showcase
Project Structure:
├── frontend/                 # React/Vue.js frontend
│   ├── Dockerfile
│   └── k8s/
│       ├── deployment.yaml
│       ├── service.yaml
│       └── ingress.yaml
├── backend/                  # Node.js/Python API
│   ├── Dockerfile
│   └── k8s/
│       ├── deployment.yaml
│       ├── service.yaml
│       ├── configmap.yaml
│       └── secret.yaml
├── database/                 # PostgreSQL/MongoDB
│   └── k8s/
│       ├── statefulset.yaml
│       ├── service.yaml
│       └── pvc.yaml
└── monitoring/               # Prometheus/Grafana
    └── k8s/
        └── monitoring-stack.yaml

# Bookmark these essential pages
https://kubernetes.io/docs/reference/kubectl/cheatsheet/
https://kubernetes.io/docs/concepts/
https://kubernetes.io/docs/tasks/
https://helm.sh/docs/

# Option 1: Minikube (easiest for beginners)
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube
minikube start --driver=docker --memory=4096 --cpus=2

# Option 2: Kind (Kubernetes in Docker)
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
kind create cluster --config=multi-node-config.yaml

# Option 3: K3s (lightweight Kubernetes)
curl -sfL https://get.k3s.io | sh -
sudo k3s kubectl get nodes

# kind-config.yaml for multi-node setup
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        node-labels: "ingress-ready=true"
  extraPortMappings:
  - containerPort: 80
    hostPort: 80
    protocol: TCP
  - containerPort: 443
    hostPort: 443
    protocol: TCP
- role: worker
- role: worker

# System requirements checklist
Computer Requirements:
✓ Desktop or laptop (no mobile devices)
✓ Stable internet connection (minimum 1 Mbps)
✓ Chrome browser (latest version)
✓ Webcam and microphone
✓ Government-issued photo ID

Environment Requirements:
✓ Quiet, private room
✓ Clean desk (no papers or materials)
✓ Adequate lighting
✓ No additional monitors (disconnect if present)

# Frontend service
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: ecommerce
spec:
  replicas: 3
  selector:
    matchLabels:
      app: frontend
  template:
    metadata:
      labels:
        app: frontend
    spec:
      containers:
      - name: frontend
        image: nginx:1.20
        ports:
        - containerPort: 80
        envFrom:
        - configMapRef:
            name: frontend-config
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        livenessProbe:
          httpGet:
            path: /health
            port: 80
          initialDelaySeconds: 30
        readinessProbe:
          httpGet:
            path: /ready
            port: 80
          initialDelaySeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: frontend-service
  namespace: ecommerce
spec:
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP

# Jenkins build agent with Kubernetes integration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins-agent
  namespace: ci-cd
spec:
  replicas: 2
  selector:
    matchLabels:
      app: jenkins-agent
  template:
    metadata:
      labels:
        app: jenkins-agent
    spec:
      serviceAccountName: jenkins-agent
      containers:
      - name: jenkins-agent
        image: jenkins/inbound-agent:latest
        env:
        - name: JENKINS_URL
          valueFrom:
            configMapKeyRef:
              name: jenkins-config
              key: jenkins-url
        - name: JENKINS_SECRET
          valueFrom:
            secretKeyRef:
              name: jenkins-secrets
              key: agent-secret
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 1000m
            memory: 2Gi
        volumeMounts:
        - name: docker-sock
          mountPath: /var/run/docker.sock
      volumes:
      - name: docker-sock
        hostPath:
          path: /var/run/docker.sock