Linux Foundation Certified Kubernetes Application Developer (CKAD) Program CKAD Exam Dumps: Updated Questions & Answers (March 2026)

Solution:

Solution:

create deploy hello-deploy --image=nginx --dry-run=client -o yaml > hello-deploy.yaml

Update deployment image to nginx:1.17.4:                                       kubectl set image deploy/hello-deploy nginx=nginx:1.17.4

Solution:

ssh ckad00034c

You’re debugging an Ingress → Service → Deployment chain. The fastest way is:

reproduce the error with the right Host header

check Ingress rules (host/path/backend)

check Service (selector/port/targetPort)

check Endpoints (do we have ready pods?)

fix the manifest(s) under /home/candidate/content-marlin/

apply + re-test

Below are the exact commands + the most common fixes for this exact symptom.

1) Reproduce the failing request correctly

Even if DNS isn’t set up, you can test with a Host header:

curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlin

If your ingress controller is not on localhost, find the NodePort/LoadBalancer IP. In these labs it’s often localhost via a local proxy, but if needed:

kubectl get svc -A | egrep -i 'ingress|nginx'

kubectl get nodes -o wide

(But start with the localhost curl above.)

2) Inspect the provided manifests (this is what you must edit)

cd /home/candidate/content-marlin/

ls -l

sed -n '1,200p' *.yaml

Also view what’s currently live in the cluster:

kubectl -n content-marlin get deploy,svc,ingress

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get ingress content-marlin-ingress -o yaml

What to look for in the Ingress:

spec.rules.host should be content-marlin.local

spec.rules.http.paths[].path should match /content-marlin

Backend service name must be your service

Backend service port must match the service port (name or number)

pathType should be Prefix (usually safest)

3) Validate Service → Pod wiring (most common real cause)

3.1 Check service selector and ports

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin describe svc content-marlin-deployment 2>/dev/null || true

kubectl -n content-marlin describe svc

Identify the service that the Ingress points to (from describe ingress).

Check if the Service selector matches pod labels:

kubectl -n content-marlin get pods --show-labels

kubectl -n content-marlin get svc -o jsonpath='{.spec.selector}{"\n"}'

3.2 Check endpoints (this tells you instantly if traffic can reach pods)

kubectl -n content-marlin get endpoints

kubectl -n content-marlin get endpoints -o wide

If ENDPOINTS is empty → Service selector doesn’t match Pods OR Pods aren’t Ready.

3.3 If endpoints empty, check pod readiness and labels

kubectl -n content-marlin get pods -o wide

kubectl -n content-marlin describe pod

4) Apply the most likely fix patterns

Fix pattern A: Ingress path needs rewrite

If your app serves / but you route /content-marlin, you often need rewrite.

Edit content-marlin-ingress manifest (in /home/candidate/content-marlin/) to include:

path: /content-marlin

pathType: Prefix

annotation: rewrite to / (common for nginx ingress)

Example (typical nginx-ingress):

metadata:

annotations:

nginx.ingress.kubernetes.io/rewrite-target: /

spec:

rules:

- host: content-marlin.local

http:

paths:

- path: /content-marlin

pathType: Prefix

backend:

service:

name:

port:

number: 80

If your ingress controller is not nginx, rewrite annotation may differ. But in CKAD labs, it’s very often nginx.

Fix pattern B: Ingress points to wrong Service port

If the Ingress backend says port 80 but your Service exposes 8080 (or uses a named port), align them:

Either change Ingress backend port.number

Or change Service spec.ports[].port / targetPort

Fix pattern C: Service selector mismatch (endpoints empty)

If pods have label app=content-marlin but service selector is app=content-marlin-deployment (or vice versa), fix the Service selector to match pod labels.

Service should have:

spec:

selector:

app:

Fix pattern D: Service targetPort wrong

If container listens on 8080 but service targetPort is 80, fix it:

spec:

ports:

- port: 80

targetPort: 8080

5) Apply the corrected manifests

After editing the YAMLs under /home/candidate/content-marlin/:

kubectl apply -f /home/candidate/content-marlin/

Wait for readiness:

kubectl -n content-marlin rollout status deploy content-marlin-deployment

kubectl -n content-marlin get endpoints

kubectl -n content-marlin describe ingress content-marlin-ingress

6) Re-test the URL

curl -i -H "Host: content-marlin.local" http://127.0.0.1/content-marlin

If you still get errors, also check ingress controller logs/events quickly:

kubectl -n content-marlin get events --sort-by=.lastTimestamp | tail -n 30

kubectl get pods -A | egrep -i 'ingress|nginx'

The fastest way for you to finish in 1 shot

Run these and paste the output (I’ll tell you exactly which line to change and what to change it to):

kubectl -n content-marlin describe ingress content-marlin-ingress

kubectl -n content-marlin get svc -o wide

kubectl -n content-marlin get endpoints -o wide

kubectl -n content-marlin get pods --show-labels

sed -n '1,200p' /home/candidate/content-marlin/*.yaml

But even without pasting, if you follow steps 2–4 above, you’ll find the broken link (Ingress rule, Service port, selector, or rewrite) and fix it cleanly.

Solution:

0) SSH to the correct host

ssh ckad00044

(Optional sanity)

kubectl config current-context

kubectl get ns | grep rapid-goat

1) Inspect the Deployment and current container name

kubectl -n rapid-goat get deploy busybox

kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[*].name}{"\n"}'

kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[*].image}{"\n"}'

Note the current container name (likely something like busybox). We need to rename it to musl.

2) Edit the Deployment (best for renaming container)

Renaming a container is easiest with edit:

kubectl -n rapid-goat edit deploy busybox

In the editor, find:

spec:

template:

spec:

containers:

- name:

image:

Change it to:

- name: musl

image: busybox:musl

Save and exit.

3) Ensure the rollout happens and completes

kubectl -n rapid-goat rollout status deploy busybox

4) Verify the new Pod template is correct

Check the Deployment template:

kubectl -n rapid-goat get deploy busybox -o jsonpath='{.spec.template.spec.containers[0].name}{"\n"}{.spec.template.spec.containers[0].image}{"\n"}'

Check running Pods and the image actually used:

kubectl -n rapid-goat get pods -o wide

POD=$(kubectl -n rapid-goat get pods -l app=busybox -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)

If you don’t have that label selector, just pick a pod name from kubectl get pods and:

kubectl -n rapid-goat describe pod | sed -n '/Containers:/,/Conditions:/p'

ssh ckad00023

You need two outcomes in moose:

At most 10 Pods total (across both Deployments).

About 20% of chipmunk-service traffic goes to canary-chipmunk-deployment.

In Kubernetes Services, traffic distribution is (roughly) proportional to the number of ready endpoints behind the Service. So the standard canary trick is:

total endpoints = 10

canary endpoints = 2

current endpoints = 8That gives ~20% to canary.

1) Inspect what exists

kubectl -n moose get deploy

kubectl -n moose get svc chipmunk-service -o wide

kubectl -n moose describe svc chipmunk-service

Get the Service selector (important):

kubectl -n moose get svc chipmunk-service -o jsonpath='{.spec.selector}{"\n"}'

Check current replicas:

kubectl -n moose get deploy current-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}'

kubectl -n moose get deploy canary-chipmunk-deployment -o jsonpath='{.spec.replicas}{"\n"}'

List pods + labels (to confirm both Deployments’ pods match the Service selector):

kubectl -n moose get pods --show-labels

2) Ensure both Deployments are behind the Service

This is the key: the pods from BOTH deployments must match the Service selector.

If the Service selector is something like app=chipmunk, then both Deployments’ pod templates must include app: chipmunk.

If one Deployment doesn’t match, patch its pod template labels to match the selector.

2A) Example: selector is app=chipmunk

(Only do this if you see the Service selector contains app=chipmunk and one of the deployments is missing it.)

kubectl -n moose patch deploy current-chipmunk-deployment \

-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'

kubectl -n moose patch deploy canary-chipmunk-deployment \

-p '{"spec":{"template":{"metadata":{"labels":{"app":"chipmunk"}}}}}'

Wait for rollouts if patches triggered new ReplicaSets:

kubectl -n moose rollout status deploy current-chipmunk-deployment

kubectl -n moose rollout status deploy canary-chipmunk-deployment

Verify endpoints now include pods from both deployments:

kubectl -n moose get endpoints chipmunk-service -o wide

3) Set replicas to enforce “max 10 pods” and “20% canary”

Set:

current = 8

canary = 2Total = 10.

kubectl -n moose scale deploy current-chipmunk-deployment --replicas=8

kubectl -n moose scale deploy canary-chipmunk-deployment --replicas=2

Wait until ready:

kubectl -n moose rollout status deploy current-chipmunk-deployment

kubectl -n moose rollout status deploy canary-chipmunk-deployment

Confirm total pods is 10 (or less) and all are Running/Ready:

kubectl -n moose get pods

kubectl -n moose get pods | tail -n +2 | wc -l

Confirm endpoints count matches 10:

kubectl -n moose get endpoints chipmunk-service -o jsonpath='{.subsets[*].addresses[*].ip}' | wc -w

4) Test load balancing via NodePort 30000

Run several times:

for i in $(seq 1 30); do curl -s http://localhost:30000/; echo; done

You should see canary responses appear roughly ~20% of the time (not exact every run).

If you want a clearer signal, check which pods are endpoints and ensure 2 belong to canary and 8 to current:

kubectl -n moose get pods -l app=chipmunk -o wide

kubectl -n moose get endpoints chipmunk-service -o wide

ssh ckad00025

You need to expose the existing app “web-app” externally at:

Host: external.sterling-bengal.local

Path: / (and anything starting with /) → route to web-app

In CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.

1) Find where web-app Service lives (namespace + port)

kubectl get svc -A | grep -w web-app

You’ll get something like:

web-app ClusterIP ... /TCP

Set the namespace:

NS=

Check the service port(s):

kubectl -n $NS get svc web-app -o yaml

Note the service port number (commonly 80).

Also verify it has endpoints (so it actually routes to pods):

kubectl -n $NS get endpoints web-app -o wide

If endpoints are empty, the Service selector doesn’t match pods — tell me and I’ll give the exact fix. But usually it’s fine.

2) Create the Ingress to route / to web-app

Create a manifest (use the service port you saw; I’ll assume 80 below):

cat <<'EOF' > web-app-ingress.yaml

apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: web-app-ingress

spec:

rules:

- host: external.sterling-bengal.local

http:

paths:

- path: /

pathType: Prefix

backend:

service:

name: web-app

port:

number: 80

EOF

Apply it:

kubectl -n $NS apply -f web-app-ingress.yaml

Verify:

kubectl -n $NS get ingress web-app-ingress

kubectl -n $NS describe ingress web-app-ingress

If your Service port is not 80, change number: 80 to the correct value and re-apply.

3) Test external reachability (as instructed)

Run exactly:

curl -i http://external.sterling-bengal.local/

If curl still fails (quick checks)

A) Is there an ingress controller running?

kubectl get pods -A | egrep -i 'ingress|nginx'

kubectl get svc -A | egrep -i 'ingress|nginx'

B) Does Ingress show an address?

kubectl -n $NS get ingress web-app-ingress -o wide

C) Do we have endpoints?

kubectl -n $NS get endpoints web-app -o wide

ssh ckad00043

You have two deliverables here:

Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).

Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).

Below is the exact CKAD-style workflow.

1) Find the missing RBAC permissions (use logs + events)

1.1 Identify the pods for the Deployment

kubectl -n cute-panda get deploy scraper

kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods

Pick one pod name and check logs:

kubectl -n cute-panda logs deploy/scraper --tail=100

If the pod is crashlooping and logs are short:

POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')

kubectl -n cute-panda logs "$POD" --previous --tail=200

1.2 Look specifically for “Forbidden” lines

Most apps print errors like:

... is forbidden: User "system:serviceaccount:cute-panda:default" cannot list resource "pods" in API group "" in the namespace "cute-panda"

or cannot get resource "configmaps"...

or cannot watch ...

If you don’t see it in logs, check events:

kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 30

1.3 Extract verb/resource/apiGroup from the error

From a typical Kubernetes RBAC “forbidden” message, capture:

verb: get/list/watch/create/update/patch/delete

resource: pods, configmaps, secrets, deployments, etc.

apiGroup: "" (core), apps, batch, etc.

namespace: cute-panda (this is a namespaced permission if it’s a Role)

You may have multiple “cannot …” lines → you need to allow all of them.

2) Create the ServiceAccount scraper (required by the task)

kubectl -n cute-panda create serviceaccount scraper

kubectl -n cute-panda get sa scraper

3) Create the RBAC objects to grant the needed permissions

The task says “A Deployment needs specific RBAC permissions” — in CKAD, that usually means: Role + RoleBinding (namespaced) bound to your new ServiceAccount.

3.1 Create a Role (template you fill from the log output)

Create scraper-role.yaml:

cat <<'EOF' > scraper-role.yaml

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: scraper-role

namespace: cute-panda

rules:

# EXAMPLE ONLY: replace these rules with what your logs show

- apiGroups: [""]

resources: ["pods"]

verbs: ["get","list","watch"]

EOF

Apply it:

kubectl apply -f scraper-role.yaml

3.2 Bind the Role to the ServiceAccount

kubectl -n cute-panda create rolebinding scraper-rb \

--role=scraper-role \

--serviceaccount=cute-panda:scraper

Verify:

kubectl -n cute-panda get role scraper-role

kubectl -n cute-panda get rolebinding scraper-rb -o yaml

4) Update the Deployment to use the new ServiceAccount (so it actually works)

Check current SA (likely default):

kubectl -n cute-panda get deploy scraper -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'

Patch it to use scraper:

kubectl -n cute-panda patch deploy scraper -p '{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'

Rollout:

kubectl -n cute-panda rollout status deploy scraper

Re-check logs to confirm RBAC errors are gone:

kubectl -n cute-panda logs deploy/scraper --tail=100