CKSKubernetes 1.35

Lessons

The closing checklist: what to do in the last ten minutes

updated 2026-10-22 by seed

Before you start

kubectl config get-contexts          # which cluster am I on?
kubectl get nodes                    # who is Ready, what version
kubectl get pods -A | grep -v Running
alias k=kubectl; export do='--dry-run=client -o yaml'

The exam tells you the host for each task. Read that line twice: half the
failures reported online are "I ran it on the wrong node".

The seven habits

  1. Read the whole task before typing. Half of them have a second sentence ("...and write the result to /root/x.txt") that is where the marks are.
  2. Make the smallest change. The marker checks the task, not your refactor.
  3. Verify with the exact wording. "Must not be able to" → prove the failure.
  4. Back up before editing a static pod. cp x.yaml /root/x.bak.
  5. Never reboot base. Never delete a control-plane manifest.
  6. If you get stuck, mark and move on. A 10-minute hole is 2 tasks lost.
  7. Finish with a sweep (below) rather than perfecting one answer.

The sweep, ten minutes

# 1. did anything I created land in the wrong namespace?
kubectl get all -A | grep -iE 'test|temp|oops'

# 2. is everything Running / Ready?
kubectl get pods -A | grep -vE 'Running|Completed'
kubectl get nodes

# 3. the node-side things that are easy to forget
sudo kube-bench run --targets master 2>/dev/null | grep -c FAIL
systemctl is-active kubelet containerd
ss -tulpn | grep -E '10255|:21 '

# 4. did the things that need a restart actually restart?
sudo crictl ps | grep -E 'kube-apiserver|etcd' | head
sudo tail -3 /var/log/kubernetes/audit.log 2>/dev/null | jq -r '.verb' | head

# 5. policies and labels exist where I said
kubectl get netpol -A
kubectl get ns --show-labels | grep pod-security
kubectl get constraint,constrainttemplate 2>/dev/null
kubectl get peerauthentication -A 2>/dev/null

The list of things people forget, in one place

  • policyTypes missing from a NetworkPolicy → only Ingress is enforced
  • DNS not re-opened after a default-deny egress
  • AppArmor profile not loaded on the node that runs the Pod
  • localhostProfile path relative to /var/lib/kubelet/seccomp
  • seccomp profile typo'd JSON → container will not start
  • runAsNonRoot on an image that runs as root → CrashLoop
  • readOnlyRootFilesystem without the emptyDirs the app needs
  • imagePullSecrets missing when the registry is private
  • Ingress secretName typo, or secret in the wrong namespace
  • PSA label on the namespace but the task said "warn" not "enforce"
  • audit policy mounted but not the log directory, or the reverse
  • RequestResponse rule placed after a broad Metadata rule
  • Falco falco_rules.yaml edited instead of falco_rules.local.yaml
  • secrets re-saved never (kubectl get secrets -A -o json | kubectl replace -f -)
  • a node left cordoned after an upgrade
  • deleting a Pod whose Deployment recreates it

If the cluster is broken and you do not know why

kubectl get nodes
kubectl -n kube-system get pods                 # control plane healthy?
sudo crictl ps -a | grep -E 'Exited|Created'    # static pods crashing
sudo journalctl -u kubelet -n 80 --no-pager     # the kubelet saw something
sudo crictl logs <id>                           # the container itself
sudo cat /var/log/pods/kube-system_kube-apiserver-*/kube-apiserver/0.log | tail

Order of suspicion: a manifest you edited → a flag you added → a file you did not
mount → something you deleted. It is almost never the cluster.

What is worth memorising, and what is not

Memorise: the restricted-Pod snippet, the default-deny NetworkPolicy, the audit
policy skeleton, the static-pod volume-mount pattern, the Falco override shape,
the EncryptionConfiguration skeleton.

Do not memorise: long Rego, full kube-bench output, every flag name. Those are in
the docs you are allowed to open, and reading them costs less than remembering
them wrong.