Certification955 problems· 24 reviewed

CKA

955 incident response problems that help with CKA prep.

All problems (955)

K8S-1621A ServiceMonitor is correct and one target still reads zeroOne ServiceMonitor still shows zero targets after a namespace label update.ReviewedKubernetesBeginner6 minFreeA node goes NotReady after a rebootAfter an OS security update and reboot, one node stays NotReady. SSH works, but kubelet keeps failing to start.ReviewedKubernetesIntermediate16 minFreePods get Evicted in bulkDozens of pods on two nodes show Evicted. The nodes report DiskPressure and one container is using 18Gi of ephemeral storage after debug logging was left on.ReviewedKubernetesIntermediate18 minFreeOOMKilled: a container keeps restarting after hitting its memory limitOOMKilled: a container keeps restarting (CrashLoop and Restarts) is a hands-on troubleshooting drill. Read OOMKilled and exit code 137, then fix memory limits and the workload that exceeds them. kubernetes-workload-reliability needs to be checked by narrowing scope, recent cha...ReviewedKubernetesBeginner15 minFreeK8S-012The init container finished, but the main container cannot see the config fileA situation where the initialization step succeeded but the volume mount location differs, so only the runtime container fails.KubernetesIntermediate20 minFreeK8S-016After changing the Deployment selector, the ReplicaSet cannot grab the new PodsAfter changing the Deployment selector, the ReplicaSet cannot grab the new... is a hands-on troubleshooting drill. An introductory problem for understanding selector immutability and label strategy in declarative resources. Kubernetes Config and Rollouts needs to be checked by...KubernetesBeginner15 minFreeK8S-019kubectl apply succeeds but the actual resource is created in a different namespacekubectl apply succeeds but the actual resource is created in a different... is a hands-on troubleshooting drill. A situation where the current context and the manifest namespace default differ, so it deploys to an unintended place. Kubernetes Config and Rollouts needs to be ch...KubernetesBeginner14 minFreeK8S-072ExternalDNS updates the wrong hosted zoneDNS automation is healthy, but one record lands in the wrong zone because two matching filters and ownership assumptions overlap in a way the operator did not expect.KubernetesIntermediate18 minFreeK8S-114NetworkPolicy allows the namespace selector but cluster DNS still failsThe app can reach peer services, yet name resolution breaks because the policy only modeled TCP while the resolver path still needs UDP.KubernetesIntermediate15 minFreeK8S-098Gateway route hostname matches but TLS mode passthrough prevents the expected path rewriteThe route is attached, yet behavior differs because the chosen TLS handling mode bypasses the HTTP features the operator expected to apply.KubernetesIntermediate16 minFreeCICD-074Helm values schema rejects a CI overrideThe chart and environment variable both look right in isolation, but the rendered upgrade fails because the pipeline injects a quoted string where the schema expects a boolean.CI/CDIntermediate16 minFreeK8S-089Probe succeeds on localhost but the service mesh policy blocks real pod-to-pod callsThe container reports healthy, yet callers still fail because the readiness command bypasses the same network policy and sidecar path used in production traffic.KubernetesIntermediate16 minFreeK8S-103ExternalDNS creates the new record but readiness still failsDNS updates succeed outside the pod, yet the app never heals because its resolver library keeps using stale answers through the rollout.KubernetesIntermediate17 minFreeK8S-082Ingress path works externally but internal probes failUser traffic succeeds through one route, yet health probes and some internal paths fail because the controller still speaks the wrong protocol to the service.KubernetesIntermediate17 minFreeK8S-075Service mesh sidecar intercept excludes the health port on one Deployment onlyThe mesh is healthy in the cluster overall, but one workload fails readiness because its sidecar capture rules skip the port the probe is supposed to reach.KubernetesIntermediate17 minFreeK8S-085Gateway API route is accepted but the ReferenceGrant does not cover the namespace of the backend serviceThe route object itself looks valid, yet traffic never forwards because the cross-namespace backend reference is not explicitly granted.KubernetesIntermediate18 minFreeK8S-055Gateway API route is Accepted but never serves trafficThe route object looks healthy in status output, but the parent listener does not actually match the requested hostname and path combination.KubernetesIntermediate22 minFreeK8S-038Private registry pull failsThe imagePullSecret is correct, but the runtime on each node still rejects the registry because the certificate authority was never trusted at the container runtime layer.KubernetesIntermediate23 minFreeK8S-106CronJob timezone is configured but the controller resumes a suspended object on the next stale schedule windowOperators unsuspend a job expecting the new timezone to apply cleanly, yet the controller immediately runs an old missed schedule slot.KubernetesIntermediate15 minFreeK8S-110Indexed Job completions succeed except one shardThe workload mostly finishes, but one index loops forever because the controller and configuration naming scheme disagree on shard-specific inputs.KubernetesIntermediate15 minFree