Certified Kubernetes Application Developer (CKAD) Program
629 Reviews
Exam Code
CKAD
Exam Name
Certified Kubernetes Application Developer (CKAD) Program
Questions
48 Questions Answers With Explanation
Update Date
August 03, 2026
Price
Was :
$81
Today :
$45
Was :
$99
Today :
$55
Was :
$117
Today :
$65
What Is the CKAD Certification Exam?
The CKAD certification exam is a standardized assessment designed to measure a candidate's knowledge, competencies, and practical understanding within a defined professional field. It serves as the primary requirement for earning the Kubernetes Application Developer, a credential that represents a recognized level of proficiency in its respective industry. Depending on the field, this may involve theoretical knowledge, applied problem-solving, regulatory understanding, or hands-on procedural competence.
The exam is typically developed and maintained by an accrediting body or professional organization that sets the standards for the Kubernetes Application Developer. This ensures that anyone who earns the credential has met a consistent benchmark, regardless of where they studied or gained their experience. For many professionals, the CKAD Certification Exam represents a formal checkpoint in their career, one that confirms readiness to take on greater responsibility within their chosen field.
Why the Kubernetes Application Developer Certification Matters?
Certifications like the Kubernetes Application Developer exist because industries need a reliable way to verify competence beyond a resume or a job title. Earning this credential signals to employers, clients, and colleagues that a professional has invested time in building a structured foundation of knowledge and has been evaluated against an established standard.
Beyond individual recognition, the Kubernetes Application Developer certification often supports broader professional development. It can influence hiring decisions, contribute to internal advancement, or serve as a prerequisite for more specialized roles within the field. In many industries, certifications also help standardize expectations across organizations, making it easier for professionals to move between employers or sectors while carrying a credential that is widely understood and respected.
Who Should Take the CKAD Exam?
The CKAD exam is generally relevant to individuals who are either entering a field or looking to formalize skills they have already developed through experience. This can include early-career professionals seeking a credential to support their first steps into the industry, as well as experienced practitioners who want official recognition of knowledge gained on the job.
Students preparing to enter the workforce may also pursue the CKAD exam as a way to strengthen their qualifications before graduating or applying for their first roles. In some fields, employers actively encourage or require staff to pursue this certification as part of ongoing professional development, particularly in industries where standards, safety, or compliance play a significant role in daily responsibilities.
Knowledge and Skills Evaluated in the Certified Kubernetes Application Developer (CKAD) Program
The Certified Kubernetes Application Developer (CKAD) Program is built to evaluate both foundational knowledge and the practical judgment needed to apply that knowledge in real situations. Candidates are generally expected to understand core principles and terminology relevant to their field, along with the reasoning behind established procedures, standards, or best practices.
Depending on the industry, this may include understanding regulatory requirements, following established protocols, applying analytical or technical methods, or exercising sound judgment in situations that require careful decision-making. Rather than testing isolated facts in a vacuum, the Certified Kubernetes Application Developer (CKAD) Program tends to reward candidates who can connect concepts to realistic scenarios, reflecting the kind of thinking expected in day-to-day professional practice.
CKAD Exam Preparation Resources
Preparing for the CKAD certification exam becomes more effective when using high-quality and up-to-date study materials. MyCertsHub provides resources designed to help candidates build knowledge, practice consistently, and become familiar with the actual exam format.
Effective preparation for the CKAD certification exam usually begins with a clear understanding of the exam's objectives and structure. Reviewing official guidelines or documentation published by the certifying body provides the most accurate picture of what will be covered and how heavily different areas are weighted.
From there, many candidates benefit from building a structured study plan that breaks preparation into manageable sections over a set period of time. A well-organized CKAD Study Guide can help sequence this material logically, especially for those approaching a topic for the first time. Consistent review, paired with realistic practice, tends to produce better retention than concentrated last-minute studying.
Practical experience, where applicable to the field, also plays an important role in preparation. Working through CKAD Practice Questions and a CKAD practice test can help candidates identify gaps in their understanding and become familiar with the format and pacing of the actual exam. In fields where hands-on skill is assessed, supplementing study with real-world practice or supervised experience often makes the difference between recognizing correct information and genuinely understanding it.
Benefits of Earning the Kubernetes Application Developer Certification
Successfully earning the Kubernetes Application Developer certification offers benefits that extend well beyond passing a single exam. It provides documented proof of competence that can be referenced on a resume, professional profile, or internal performance review, offering a clear, third-party validation of skill and knowledge.
The credential can also strengthen professional credibility when working with clients, patients, stakeholders, or colleagues who may not be positioned to evaluate technical or specialized knowledge directly. Over time, this recognition often contributes to expanded career opportunities, whether through new responsibilities, higher-level roles, or eligibility for additional certifications that build on this foundational credential.
Prepare for the CKAD Exam with MyCertsHub
Preparing for the CKAD exam is a process that benefits from organized, consistent effort rather than rushed, last-minute review. MyCertsHub is designed to support that process by offering study resources, practice materials, and educational content that help candidates understand what the Certified Kubernetes Application Developer (CKAD) Program covers and how to approach their preparation thoughtfully.
Whether someone is just beginning to explore the Kubernetes Application Developer or is in the final stages of reviewing material before their exam date, MyCertsHub aims to serve as a dependable resource throughout that journey. Every candidate's path to certification looks a little different, and the goal remains the same: to provide clear, genuinely useful information that supports real understanding of the subject matter.
Linux-Foundation CKAD Sample Question Answers
Question # 1
Context
You are asked to deploy an application developed for an older version of Kubernetes on a
cluster running a recent version of Kubernetes .
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00026 Task
Fix any API -deprecation issues in the manitest file
/home/candidate/credible-mite/web.yaml
so that the application can be deployed on cluster ckad00026.
The application was developed for Kubernetes v1.15.
The cluster ckad00026 runs Kubernetes 1.29+.
Deploy the application specified in the updated manifest file
/home/candidate/credible-mite/web.yaml in namespace garfish .
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00026
Your job is to edit /home/candidate/credible-mite/web.yaml so it uses APIs supported on
Kubernetes 1.29+, then deploy it into namespace garfish.
Because I can’t see your file from here, the most reliable exam approach is:
run a server-side dry-run to reveal the exact deprecated/removed APIs and
schema errors
edit the manifest to the modern API versions/fields
re-run dry-run until it passes
apply for real and verify rollout
1) Go to the manifest and run a server-side dry-run
cd /home/candidate/credible-mite
ls -l
sed -n '1,200p' web.yaml
Make sure the namespace exists:
kubectl get ns garfish || kubectl create ns garfish
Now run a server-side dry-run (this catches removed APIs on the cluster):
kubectl -n garfish get ingress 2>/dev/null || true
If there is a Deployment, verify rollout:
kubectl -n garfish get deploy
kubectl -n garfish rollout status deploy --all
Check pods/events if something fails:
kubectl -n garfish get pods -o wide
kubectl -n garfish describe pod <pod-name>
kubectl -n garfish get events --sort-by=.lastTimestamp | tail -n 30
Question # 2
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00029
Task
Modify the existing Deployment named store-deployment, running in namespace
grubworm, so that its containers
run with user ID 10000 and
have the NET_BIND_SERVICE capability added
The store-deployment 's manifest file Click to copy
/home/candidate/daring-moccasin/store-deplovment.vaml
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00029
You must modify the existing Deployment store-deployment in namespace grubworm so
that its containers:
run as user ID 10000
have Linux capability NET_BIND_SERVICE added
And you’re told to use the manifest file at:
/home/candidate/daring-moccasin/store-deplovment.vaml (note: the filename looks
misspelled; follow it exactly on the host)
1) Inspect the current Deployment and locate the manifest file
kubectl -n grubworm get deploy store-deployment
ls -l /home/candidate/daring-moccasin/
Open the manifest:
sed -n '1,200p' "/home/candidate/daring-moccasin/store-deplovment.vaml"
2) Edit the manifest to add SecurityContext
Edit the file:
vi "/home/candidate/daring-moccasin/store-deplovment.vaml"
2.1 Set Pod-level runAsUser = 10000
Under:
spec.template.spec add:
securityContext:
runAsUser: 10000
2.2 Add NET_BIND_SERVICE capability at container-level
Under the container spec (for each container in containers:), add:
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
A complete example of what it should look like (mind indentation):
apiVersion: apps/v1
kind: Deployment
metadata:
name: store-deployment
namespace: grubworm
spec:
template:
spec:
securityContext:
runAsUser: 10000
containers:
- name: store
image: someimage
securityContext:
capabilities:
add: ["NET_BIND_SERVICE"]
Important notes:
runAsUser can be set at Pod level (applies to all containers) or per-container. Podlevel is cleanest if all containers should run as 10000.
Capabilities must be set per-container (that’s where Kubernetes supports it).
kubectl -n grubworm describe pod <pod-name> | sed -n '/Security Context:/,/Containers:/p'
kubectl -n grubworm describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'
If there are multiple containers
Repeat the container-level securityContext.capabilities.add block for each container under
spec.template.spec.containers.
Question # 3
Context
An existing web application must be exposed externally.
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00025
An application externally using the URL external.sterling-bengal.local . Any requests
starting with / must be routed to the application web-app.
To test the web application's external reachability, run
[candidate@ckad00025] $ curl http://external.sterling-bengal.local/ or open this URL in the remote desktop's browser.
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00025
You need to expose the existing app “web-app” externally at:
Host: external.sterling-bengal.local
Path: / (and anything starting with /) route to web-app
In CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.
1) Find where web-app Service lives (namespace + port)
kubectl get svc -A | grep -w web-app
You’ll get something like:
<NAMESPACE> web-app ClusterIP ... <PORT>/TCP
Set the namespace:
NS=<NAMESPACE>
Check the service port(s):
kubectl -n $NS get svc web-app -o yaml
Note the service port number (commonly 80).
Also verify it has endpoints (so it actually routes to pods):
kubectl -n $NS get endpoints web-app -o wide
If endpoints are empty, the Service selector doesn’t match pods — tell me and I’ll give the
exact fix. But usually it’s fine.
2) Create the Ingress to route / to web-app
Create a manifest (use the service port you saw; I’ll assume 80 below):
cat <<'EOF' > web-app-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web-app-ingress
spec:
rules:
- host: external.sterling-bengal.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web-app
port:
number: 80
EOF
Apply it:
kubectl -n $NS apply -f web-app-ingress.yaml
Verify:
kubectl -n $NS get ingress web-app-ingress
kubectl -n $NS describe ingress web-app-ingress
If your Service port is not 80, change number: 80 to the correct value and re-apply.
kubectl -n $NS get ingress web-app-ingress -o wide
C) Do we have endpoints?
kubectl -n $NS get endpoints web-app -o wide
Question # 4
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00044
Task:
Update the existing Deployment busybox running in the namespace rapid-goat .
First, change the container name to musl.
Next, change the container image to busybox:musl .
Finally, ensure that the changes to the busybox Deployment, running in the
namespace rapid-goat, are rolled out.
Answer: See the Explanation below for complete solution.
Explanation:
0) SSH to the correct host
ssh ckad00044
(Optional sanity)
kubectl config current-context
kubectl get ns | grep rapid-goat
1) Inspect the Deployment and current container name
If you don’t have that label selector, just pick a pod name from kubectl get pods and:
kubectl -n rapid-goat describe pod <pod-name> | sed -n '/Containers:/,/Conditions:/p'
Question # 5
Context
You are asked to allow a Pod to communicate with two other Pods but nothing else.
You must connect to the correct host . Failure to do so may result
in a zero score.
! [candidate@base] $ ssh ckad000
18
charming-macaw namespace to use a NetworkPolicy allowing the Pod to send and receive
traffic only to and from the Pods front and db.
All required NetworkPolicies have already been created.
You must not create, modify or delete any NetworkPolicy while working on this task. You
may only use existing NetworkPolicies .
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00018
You cannot create/modify/delete any NetworkPolicy.
So the only way to make the existing policies “take effect” is to ensure the right Pods have
the labels/selectors those policies expect.
The task: in namespace charming-macaw, configure things so the target Pod can send +
receive traffic ONLY to/from Pods front and db.
1) Inspect what NetworkPolicies already exist (don’t change them)
kubectl -n charming-macaw get netpol
kubectl -n charming-macaw get netpol -o wide
Dump them to see the selectors they use:
kubectl -n charming-macaw get netpol -o yaml
You are looking for policies that:
select the restricted pod via spec.podSelector
and allow ingress/egress only with selectors that match front and db
often there’s also a “default deny” policy.
2) Identify the Pods and their current labels
kubectl -n charming-macaw get pods -o wide
kubectl -n charming-macaw get pods --show-labels
Specifically inspect labels for front and db:
kubectl -n charming-macaw get pod front --show-labels
kubectl -n charming-macaw get pod db --show-labels
(If they’re Deployments instead of single Pods, do:)
kubectl -n charming-macaw get deploy --show-labels
kubectl -n charming-macaw get pods -l app=front --show-labels
kubectl -n charming-macaw get pods -l app=db --show-labels
3) Figure out which pod is “the Pod” to restrict
Usually there’s a third pod (e.g., backend, api, app) besides front and db.
List pods again and identify the “other” one:
kubectl -n charming-macaw get pods
Let’s assume the pod to restrict is called app (replace as needed):
TARGET=<pod-to-restrict>
4) Match the existing NetworkPolicy selectors by labeling pods (allowed)
Because you can’t edit NetworkPolicies, you must make labels on Pods (or their
controllers) match the policies’ selectors.
4.1 Determine the label required on the TARGET pod
From the YAML, find the policy that selects the restricted pod, e.g.:
spec:
podSelector:
matchLabels:
role: restricted
Extract podSelector from each policy quickly:
kubectl -n charming-macaw get netpol -o jsonpath='{range .items[*]}{.metadata.name}{" =>
"}{.spec.podSelector}{"\n"}{end}'
Pick the selector that is meant for the restricted pod, then apply it to the TARGET pod
(example: role=restricted):
kubectl -n charming-macaw label pod $TARGET role=restricted --overwrite
Best practice (if the pod is managed by a Deployment): label the Deployment template
instead, so it persists.
Find the owner:
kubectl -n charming-macaw get pod $TARGET -o
jsonpath='{.metadata.ownerReferences[0].kind}{"
"}{.metadata.ownerReferences[0].name}{"\n"}'
If it’s a ReplicaSet, find its Deployment:
RS=$(kubectl -n charming-macaw get pod $TARGET -o
jsonpath='{.metadata.ownerReferences[0].name}')
kubectl -n charming-macaw get rs $RS -o jsonpath='{.metadata.ownerReferences[0].kind}{"
Also test inbound (from front to target, and from db to target) if the target listens on a port;
otherwise inbound testing may be limited.
What you’re doing conceptually
Existing NetPols are already correct.
Your job is to make pod labels match the NetPol selectors so:
Question # 6
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00021
Task
Create a Cronjob named grep that executes a Pod running the following single container:
name: busybox
image: busybox:stable
command: ["grep", "-i", "nameserv
er", "/etc/resolv.conf"] Configure the CronJob to:
execute Once every 30 minutes
keep 96 completed Job
keep 192 failed Job
never restart podsterminate pods after 8 seconds
Manually create and execute once job
named grep-test from the grep Cronjob
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00021
Below is the clean, CKAD-friendly way (YAML + apply + verify + manual job).
2) Manually create and execute the one-off Job grep-test from the CronJob
Create the Job from the CronJob:
kubectl create job --from=cronjob/grep grep-test
Watch it:
kubectl get jobs grep-test
kubectl get pods -l job-name=grep-test
Get logs (most important proof):
POD=$(kubectl get pods -l job-name=grep-test -o jsonpath='{.items[0].metadata.name}')
kubectl logs "$POD"
You should see one or more nameserver ... lines from /etc/resolv.conf.
Question # 7
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00033
Task
A Dockerfile has been prepared at /home/candidate/build/Dockerfile.
Using the prepared Dockerfile, build a container image with the name macaque and tag
1.2. You may install and use the tool of your choice.
Multiple image builders and tools have been pre-installed in the base system,
including: docker, skopeo, buildah, img , and podman.
Please do not push the built image to a registry, run a container, or otherwise consume it.
Using the tool of your choice, export the built container image in OCI or Docker image
format and store it at /home/candidate/macaque-1.2.tar.
Answer: See the Explanation below for complete solution.
Explanation:
Understood — I’ll redo Question 13 without using any (or similar) icons.
ssh ckad00033
This task is only about building and exporting a container image.
You must not push it, run it, or consume it in any way.
You may use any image builder. Below are clean, correct solutions. Use one of them.
Option A: Using Docker
1) Go to the Dockerfile location
cd /home/candidate/build
ls -l Dockerfile
2) Build the image
Image name: macaque
Tag: 1.2
docker build -t macaque:1.2 .
Verify:
docker images | grep macaque
3) Export the image to a tar file
Docker image format is acceptable.
docker save macaque:1.2 -o /home/candidate/macaque-1.2.tar
Verify the file exists:
ls -lh /home/candidate/macaque-1.2.tar
Do not load or run the image.
Option B: Using Podman (rootless alternative)
1) Build the image
cd /home/candidate/build
podman build -t macaque:1.2 .
Verify:
podman images | grep macaque
2) Export the image
podman save macaque:1.2 -o /home/candidate/macaque-1.2.tar
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00027
Task
A Deployment named app-deployment in namespace prod runs a web application port
0001 A Deployment named app-deployment in namespace prod runs a web application
on port 8081.
The Deployment 's manifest files can be found at
/home/candidate/spicy-pikachu/app-deployment.yaml
Modify the Deployment specifying a readiness probe using path /healthz .
Set initialDelaySeconds to 6 and periodSeconds to 3.
Answer: See the Explanation below for complete solution.
Explanation:
Do this on ckad00027 and edit the given manifest file (that’s what the task expects).
0) Connect to correct host
ssh ckad00027
1) Open the manifest and identify the container + port
cd /home/candidate/spicy-pikachu
ls -l
sed -n '1,200p' app-deployment.yaml
Confirm the container port is 8081 in the YAML (usually under ports:).
2) Edit the YAML to add a readinessProbe
Edit the file:
vi app-deployment.yaml
Inside the Deployment, locate:
spec:
template:
spec:
containers:
- name: ...
image: ...
Add this under the container (same indentation level as image, ports, etc.):
readinessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 6
periodSeconds: 3
Notes:
Use port: 8081 (because the app runs on 8081).
Ensure indentation is correct (2 spaces per level commonly).
kubectl -n prod describe pod <pod-name> | sed -n '/Readiness:/,/Conditions:/p'
That completes the task: readiness probe on /healthz, initialDelaySeconds: 6,
periodSeconds: 3.
Question # 9
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00032
The Pod for the Deployment named nosql in the haddock namespace fails to start because
its Container runs out of resources.
Update the nosql Deployment so that the Container :
requests 128Mi of memory
limits the memory to half the maximum memory constraint set for the haddock
namespace
Answer: See the Explanation below for complete solution.
Explanation:
Goal: fix nosql Deployment in haddock so the container stops OOM’ing by setting:
memory request = 128Mi
? memory limit = half of the namespace’s maximum memory constraint
You must do this on the correct host.
0) Connect to the correct host
ssh ckad00032
1) Confirm the failing Deployment / Pods
kubectl -n haddock get deploy nosql
kubectl -n haddock get pods -l app=nosql 2>/dev/null || kubectl -n haddock get pods
If pods are crashing, check why (you’ll likely see OOMKilled):
kubectl -n haddock describe pod <pod-name>
2) Find the maximum memory constraint set for the haddock namespace
In CKAD labs, this is commonly enforced by a LimitRange (max memory per container).
Sometimes it can also be a ResourceQuota.
2A) Check LimitRange (most likely)
kubectl -n haddock get limitrange
kubectl -n haddock get limitrange -o yaml
Extract the max memory value quickly:
MAX_MEM=$(kubectl -n haddock get limitrange -o
jsonpath='{.items[0].spec.limits[0].max.memory}')
echo "Namespace max memory constraint: $MAX_MEM"
2B) If no LimitRange exists, check ResourceQuota
kubectl -n haddock get resourcequota
kubectl -n haddock describe resourcequota
If quota is used, you’re looking for something like limits.memory (but the question wording
“maximum memory constraint” usually points to LimitRange max.memory).
3) Compute “half of the max memory constraint”
Run this small snippet to compute HALF in Mi (handles Mi and Gi):
HALF_MEM=$(python3 - <<'PY'
import os, re
q = os.environ.get("MAX_MEM","").strip()
m = re.fullmatch(r"(\d+)(Mi|Gi)", q)
if not m:
raise SystemExit(f"Cannot parse MAX_MEM='{q}'. Expected like 512Mi or 1Gi.")
val = int(m.group(1))
unit = m.group(2)
# convert to Mi
mi = val if unit == "Mi" else val * 1024
half_mi = mi // 2
print(f"{half_mi}Mi")
PY
)
echo "Half of max: $HALF_MEM"
Example: if MAX_MEM=512Mi HALF_MEM=256Mi
Example: if MAX_MEM=1Gi HALF_MEM=512Mi
4) Update the nosql Deployment (DO NOT delete it)
First, get the container name (Deployment may have a custom container name):
kubectl -n haddock describe pod <new-pod-name> | sed -n '/Requests:/,/Limits:/p'
You should see:
Requests: memory 128Mi
Limits: memory <HALF_MEM>
If rollout fails (common cause)
If you accidentally set a limit above the namespace max, pods won’t start. Check events:
kubectl -n haddock describe deploy nosql
kubectl -n haddock get events --sort-by=.lastTimestamp | tail -n 20
Question # 10
Context
You are asked to set resource requests and limits for a running workload to ensure fair
resource management.
“Do not delete the existing Deployment . Failure to do so will result in a reduced score.”
Next, ensure that the total amount of resources in the namespace matches the maximum
resources the Pods from the nginx-resources Deployment can request.
Failure to do so will result in the updated Deployment failing to roll out successfully.
Answer: See the Explanation below for complete solution.
Explanation:
Below are the exact steps/commands you can run.
1) Locate the Deployment and its namespace
kubectl get deploy -A | grep nginx-resources
You should see output like:
<namespace> nginx-resources ...
Set a variable (replace <NS> with what you see):
NS=<NS>
Confirm replicas:
kubectl -n $NS get deploy nginx-resources -o jsonpath='{.spec.replicas}{"\n"}'
2) Check if there is a ResourceQuota in that namespace
kubectl -n $NS get resourcequota
kubectl -n $NS describe resourcequota
If there is a quota, note these fields (common ones):
requests.cpu
requests.memory
limits.cpu
limits.memory
3) Decide requests/limits for the Deployment (example values)
If the question (in your environment) provides specific values, use those.
If it doesn’t, a typical safe pair is:
requests: cpu: 100m, memory: 128Mi
limits: cpu: 200m, memory: 256Mi
I’ll proceed with these example values. If your lab specifies different numbers, just swap them in.
4) Update the existing Deployment (DO NOT DELETE)
Option A (fastest): kubectl set resources
Assuming the container name is the first container (we’ll detect it):
Context
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00043
A Deployment needs specific RBAC permissions.
Task
First, find the RBAC permissions needed by the scraper Deployment running in the
cute-panda namespace .
it kubectl logs may help you to find the permissions it needs.
Next, create a new ServiceAccount named scraper in the namespace cute-panda.
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00043
You have two deliverables here:
Figure out what RBAC permissions the scraper Deployment needs (the logs will
usually show “Forbidden” with the missing verb/resource).
Create a ServiceAccount named scraper in namespace cute-panda (and in
practice, you then bind the needed permissions to it and use it in the Deployment
so it actually works).
Below is the exact CKAD-style workflow.
1) Find the missing RBAC permissions (use logs + events)
1.1 Identify the pods for the Deployment
kubectl -n cute-panda get deploy scraper
kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods
Context
You must connect to the correct host . Failure to do so may result in a zero score.
!
[candidate@base] $ ssh ckad00028
Task
A Pod within the Deployment named honeybee-deployment and in namespace gorilla is logging errors.
Look at the logs to identify error messages.
Look at the logs to identify error messages.
Find errors, including User
"system:serviceaccount:gorilla:default" cannot list resource "pods" [ ... ] in the
namespace "gorilla"
Update the Deployment
honeybee-deployment to resolve the errors in the logs of the Pod.
The honeybee-deployment 's manifest file can be found at
/home/candidate/prompt-escargot/honey bee-deployment.yaml
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00028
You’re seeing RBAC errors like:
User "system:serviceaccount:gorilla:default" cannot list resource "pods" … in namespace
"gorilla"
That means the Pod is running as the default ServiceAccount and needs permission to
list pods (and possibly also get/watch).
You must fix it by updating the Deployment (via its manifest file) and giving it the proper
Also confirm the pods now run with the right ServiceAccount:
kubectl -n gorilla get pods -o jsonpath='{range .items[*]}{.metadata.name}{"
sa="}{.spec.serviceAccountName}{"\n"}{end}'
You should no longer see the RBAC “cannot list pods” errors.
Question # 13
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00034c
Task
A Deployment named content-marlin-deployment , running in namespace content-marlin is
exposed via Ingress content-marlin-ingress .
The manifest files for the Deployment, Service and Ingress can be found at
/home/candidate/content-marlin/.
The Deployment is supposed to be reachable at
http://content-marlin.local/content-marlin , but requesting this URL is currently returning an
error.
Answer: See the Explanation below for complete solution.
Explanation:
ssh ckad00034c
You’re debugging an Ingress Service Deployment chain. The fastest way is:
reproduce the error with the right Host header
check Ingress rules (host/path/backend)
check Service (selector/port/targetPort)
check Endpoints (do we have ready pods?)
fix the manifest(s) under /home/candidate/content-marlin/
apply + re-test
Below are the exact commands + the most common fixes for this exact symptom.
1) Reproduce the failing request correctly
Even if DNS isn’t set up, you can test with a Host header:
Identify the service that the Ingress points to (from describe ingress).
Check if the Service selector matches pod labels:
kubectl -n content-marlin get pods --show-labels
kubectl -n content-marlin get svc <SERVICE_NAME> -o jsonpath='{.spec.selector}{"\n"}'
3.2 Check endpoints (this tells you instantly if traffic can reach pods)
kubectl -n content-marlin get endpoints
kubectl -n content-marlin get endpoints <SERVICE_NAME> -o wide
?
?
?
?
?
?
If ENDPOINTS is empty Service selector doesn’t match Pods OR Pods aren’t
Ready.
3.3 If endpoints empty, check pod readiness and labels
kubectl -n content-marlin get pods -o wide
kubectl -n content-marlin describe pod <pod-name>
4) Apply the most likely fix patterns
Fix pattern A: Ingress path needs rewrite
If your app serves / but you route /content-marlin, you often need rewrite.
Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:
path: /content-marlin
pathType: Prefix
annotation: rewrite to / (common for nginx ingress)
Example (typical nginx-ingress):
metadata:
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: content-marlin.local
http:
paths:
- path: /content-marlin
pathType: Prefix
backend:
service:
name: <SERVICE_NAME>
port:
number: 80
If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it’s
very often nginx.
Fix pattern B: Ingress points to wrong Service port
If the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port),
align them:
Either change Ingress backend port.number
Or change Service spec.ports[].port / targetPort
Fix pattern C: Service selector mismatch (endpoints empty)
If pods have label app=content-marlin but service selector is app=content-marlindeployment (or vice versa), fix the Service selector to match pod labels.
Service should have:
spec:
selector:
app: <label-that-actually-exists-on-pods>
Fix pattern D: Service targetPort wrong
If container listens on 8080 but service targetPort is 80, fix it:
spec:
ports:
- port: 80
targetPort: 8080
5) Apply the corrected manifests
After editing the YAMLs under /home/candidate/content-marlin/:
kubectl apply -f /home/candidate/content-marlin/
Wait for readiness:
kubectl -n content-marlin rollout status deploy content-marlin-deployment
sed -n '1,200p' /home/candidate/content-marlin/*.yaml
But even without pasting, if you follow steps 2–4 above, you’ll find the broken link (Ingress
rule, Service port, selector, or rewrite) and fix it cleanly.
Feedback That Matters: Reviews of Our Linux-Foundation CKAD Dumps
Christian DavisAug 15, 2026
Today I passed the CKAD! The practice materials on Mycertshub were just what I needed. I was able to increase my speed with Kubernetes terminals thanks to their labs-style questions. Zero time wasted!
Audrey CampbellAug 14, 2026
The CKAD PDF I utilized featured only exam-focused content – no unnecessary theory. Quick revision before the exam and I cleared it effortlessly. Strongly advised for final preparation.
Gaurav SantAug 14, 2026
The Practice Test Engine for CKAD trained me excellently for solving assignments under time pressure. Practiced every day and went to the exam feeling confident. It works!
Christian Davis
Audrey Campbell
Gaurav Sant