CKAD Cheat Sheet: kubectl Commands and YAML Shortcuts

Tested on	Rocky Linux 10.2 (Red Quartz) workstation
Package	`kubectl 1.36.3`
Applies to	Ubuntu, Debian, Kali Linux, Linux Mint, Pop!_OS, Raspberry Pi OS, elementary OS, Zorin OS, Parrot OS, MX Linux, RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, Fedora Kubernetes cluster
Cert prep	CKAD
Lab environment	Any Kubernetes cluster — install Kubernetes with kubeadm
Privilege	Normal user on the workstation (cluster RBAC may limit verbs)
Man page	kubectl command reference
Scope	CKAD-focused kubectl shortcuts for manifest generation, apply, inspection, rollouts, configuration, RBAC, networking, Helm, and Kustomize. Not a complete kubectl encyclopedia or cluster-administration guide.
Related guides	kubectl commands and YAML examples CKAD practice labs Install kubectl and kubeconfig Kubernetes API resources Deployments and rollbacks

Use this page while you work through the CKAD practice labs. Memorize command patterns, not example resource names. Service and Ingress verification snippets use the curl command for in-cluster and --resolve HTTPS tests. Always read generated YAML before you apply it. Commands assume Bash unless noted — replace placeholder values before you run them.

How to Use This Cheat Sheet

Keep it open beside the practice labs — look up flags, then return to the task.
Pair imperative shortcuts with kubectl explain when a field name is unclear.
Verify runtime behaviour after every apply; object creation alone is not enough.
For full kubectl coverage, see kubectl commands and YAML examples.

CKAD — quick reference

Shell and context

When to use	Command
Short alias	`alias k=kubectl`
Reusable dry-run flags	`export do='--dry-run=client -o yaml'`
Bash completion	`source <(kubectl completion bash)` and `complete -F __start_kubectl k`
Default editor for `kubectl edit`	`export KUBE_EDITOR=vim`
Pin namespace on current context	`kubectl config set-context --current --namespace=NAMESPACE`
Switch context	`kubectl config use-context CONTEXT`

Lessons: install kubectl · namespaces

Generate YAML (`--dry-run=client -o yaml`)

Resource	Command
Pod	`kubectl run NAME --image=IMAGE --restart=Never $do > pod.yaml`
Deployment	`kubectl create deployment NAME --image=IMAGE --replicas=N $do > deploy.yaml`
Service	`kubectl expose deployment NAME --port=80 --target-port=8080 $do > svc.yaml`
Job	`kubectl create job NAME --image=busybox $do -- sh -c 'echo done' > job.yaml`
CronJob	`kubectl create cronjob NAME --image=busybox --schedule='/5 * * *' $do -- date > cj.yaml`
ConfigMap	`kubectl create configmap NAME --from-literal=KEY=VALUE $do > cm.yaml`
Secret	`kubectl create secret generic NAME --from-literal=KEY=VALUE $do > secret.yaml`

Apply, validate, and patch

When to use	Command
Declarative create/update	`kubectl apply -f FILE` or `kubectl apply -f DIR/`
Client preview only	`kubectl apply --dry-run=client -f FILE -o yaml`
API server validation	`kubectl apply --dry-run=server --validate=strict -f FILE`
Preview diff	`kubectl diff -f FILE`
Merge patch replicas	`kubectl patch deploy NAME --type=merge -p '{"spec":{"replicas":3}}'`
Live edit	`kubectl edit deployment NAME`

Lesson: apply, patch, and replace

Inspect and filter

When to use	Command
Wide list	`kubectl get pods -o wide`
Label filter	`kubectl get pods -l app=web`
Watch	`kubectl get pods --watch`
Events sorted	`kubectl get events --sort-by=.metadata.creationTimestamp`
Object events	`kubectl events --for pod/POD`
Custom columns	`kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase`

Lessons: logs, events, describe · labels and selectors

Rollouts and scale

When to use	Command
Scale	`kubectl scale deployment NAME --replicas=N`
Change image	`kubectl set image deployment/NAME CONTAINER=IMAGE:TAG`
Wait for rollout	`kubectl rollout status deployment/NAME`
History	`kubectl rollout history deployment/NAME`
Undo	`kubectl rollout undo deployment/NAME`
Undo to revision	`kubectl rollout undo deployment/NAME --to-revision=N`

Lesson: rolling updates and rollbacks

RBAC checks

When to use	Command
Current user	`kubectl auth can-i VERB RESOURCE -n NAMESPACE`
List all	`kubectl auth can-i --list -n NAMESPACE`
ServiceAccount	`kubectl auth can-i list pods --as=system:serviceaccount:NS:SA -n NAMESPACE`

Lessons: ServiceAccounts · RBAC

Metrics and logs

When to use	Command
Pod CPU/memory	`kubectl top pod --sort-by=memory`
Per container	`kubectl top pod --containers`
Current logs	`kubectl logs POD -c CONTAINER`
Previous crash	`kubectl logs POD -c CONTAINER --previous`
Follow	`kubectl logs -f POD --tail=100`

Lessons: kubectl top · troubleshooting workflow

kubectl top requires the Metrics API, normally provided by Metrics Server. If it is unavailable, kubectl reports Metrics API not available. kubectl top does not work merely because kubectl and a Kubernetes cluster exist; the Metrics API must also be available.

Helm and Kustomize

When to use	Command
Install / upgrade	`helm upgrade --install RELEASE CHART -n NS --set key=value`
History / rollback	`helm history RELEASE` · `helm rollback RELEASE REV`
Build overlay	`kubectl kustomize DIR/`
Apply overlay	`kubectl apply -k DIR/`

Lessons: Helm · Kustomize

Shell and kubectl Shortcuts

bash
alias k=kubectl
export do='--dry-run=client -o yaml'
source <(kubectl completion bash)
complete -o default -F __start_kubectl k
export KUBE_EDITOR=vim
kubectl config set-context --current --namespace=<namespace>
kubectl config current-context
kubectl config get-contexts
kubectl config use-context <context>

Discover Resource Syntax

bash
kubectl api-resources
kubectl api-versions
kubectl explain pod
kubectl explain pod.spec.containers
kubectl explain deployment.spec.strategy
kubectl explain pod.spec --recursive

Lesson: Kubernetes API resources and kubectl explain

Generate YAML Quickly

Pod:

bash
kubectl run web --image=nginx --dry-run=client -o yaml > pod.yaml

Deployment:

bash
kubectl create deployment web --image=nginx --replicas=3 --dry-run=client -o yaml > deployment.yaml

Service:

bash
kubectl expose deployment web --port=80 --target-port=8080 --dry-run=client -o yaml > service.yaml

Job:

bash
kubectl create job report --image=busybox --dry-run=client -o yaml -- sh -c 'echo complete' > job.yaml

CronJob:

bash
kubectl create cronjob report --image=busybox --schedule='*/5 * * * *' --dry-run=client -o yaml -- sh -c 'date' > cronjob.yaml

ConfigMap and Secret:

bash
kubectl create configmap app-config --from-literal=MODE=production --dry-run=client -o yaml > configmap.yaml
kubectl create secret generic app-secret --from-literal=password=demo --dry-run=client -o yaml > secret.yaml

Lessons: Pods · Deployments · Jobs · CronJobs · ConfigMaps · Secrets

Apply, Validate and Compare YAML

bash
kubectl apply -f resource.yaml
kubectl apply -f directory/
kubectl delete -f resource.yaml
kubectl apply --dry-run=client -f resource.yaml -o yaml
kubectl apply --dry-run=server --validate=strict -f resource.yaml
kubectl diff -f resource.yaml
kubectl replace -f resource.yaml
kubectl edit deployment web
kubectl patch deployment web --type=merge -p '{"spec":{"replicas":3}}'

Lesson: kubectl apply, patch, and replace

Inspect Resources

bash
kubectl get pods
kubectl get pods -o wide
kubectl get pods --show-labels
kubectl get all
kubectl get all -A
kubectl get pod <pod> -o yaml
kubectl describe pod <pod>
kubectl get events --sort-by=.metadata.creationTimestamp
kubectl events --for pod/<pod>
kubectl get pods --watch
kubectl get pods -l app=web

JSONPath and Custom Output

Pod image:

bash
kubectl get pod <pod> -o jsonpath='{.spec.containers[*].image}{"\n"}'

Container names:

bash
kubectl get pod <pod> -o jsonpath='{.spec.containers[*].name}{"\n"}'

Node name:

bash
kubectl get pod <pod> -o jsonpath='{.spec.nodeName}{"\n"}'

QoS class:

bash
kubectl get pod <pod> -o jsonpath='{.status.qosClass}{"\n"}'

Exit reason and code:

bash
kubectl get pod <pod> -o jsonpath='{range .status.containerStatuses[*]}{.name}{"\t"}{.lastState.terminated.reason}{"\t"}{.lastState.terminated.exitCode}{"\n"}{end}'

Custom columns:

bash
kubectl get pods -o custom-columns='NAME:.metadata.name,STATUS:.status.phase,NODE:.spec.nodeName'

Pods and Multi-Container Workloads

bash
kubectl run test --image=busybox --restart=Never -- sleep 3600
kubectl run client --image=busybox --restart=Never -it --rm -- sh
kubectl exec <pod> -- <command>
kubectl exec -it <pod> -- sh
kubectl exec -it <pod> -c <container> -- sh
kubectl get pod <pod> -o jsonpath='{.spec.containers[*].name}'
kubectl delete pod <pod> --grace-period=0 --force

Lessons: Pods · init containers · sidecars · kubectl debug · stuck terminating

Deployments and Rollouts

bash
kubectl scale deployment web --replicas=4
kubectl set image deployment/web web=nginx:1.29
kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout pause deployment/web
kubectl rollout resume deployment/web
kubectl rollout undo deployment/web
kubectl rollout undo deployment/web --to-revision=2
kubectl rollout restart deployment/web

Lesson: Deployments and rolling updates

Jobs and CronJobs

bash
kubectl get jobs
kubectl get cronjobs
kubectl describe job <job>
kubectl logs job/<job>
kubectl create job manual-run --from=cronjob/<cronjob>
kubectl patch cronjob <name> --type=merge -p '{"spec":{"suspend":true}}'
kubectl patch cronjob <name> --type=merge -p '{"spec":{"suspend":false}}'

Lessons: Jobs · CronJobs

ConfigMaps and Secrets

bash
kubectl create configmap app-config --from-literal=MODE=production
kubectl create configmap app-files --from-file=application.properties
kubectl create configmap app-env --from-env-file=app.env
kubectl create secret generic credentials --from-literal=username=demo --from-literal=password=demo
kubectl create secret tls web-tls --cert=tls.crt --key=tls.key
kubectl create secret docker-registry registry-auth --docker-server=<registry> --docker-username=<user> --docker-password=<pass>
kubectl get secret credentials -o jsonpath='{.data.username}' | base64 --decode
kubectl rollout restart deployment/<name>

Lessons: ConfigMaps · Secrets · config reload behaviour · commands and Downward API

Resource Requirements and Quotas

bash
kubectl describe pod <pod>
kubectl get pod <pod> -o jsonpath='{.status.qosClass}{"\n"}'
kubectl get resourcequota,limitrange
kubectl describe resourcequota
kubectl describe limitrange
kubectl top pod
kubectl top pod --containers
kubectl top node
kubectl top pod --sort-by=cpu
kubectl top pod --sort-by=memory

Lessons: requests, limits, QoS · ResourceQuota · kubectl top · OOMKilled

kubectl top requires the Metrics API, normally provided by Metrics Server. If it is unavailable, kubectl reports Metrics API not available.

ServiceAccounts and RBAC

bash
NS=<namespace>

kubectl create serviceaccount app-reader -n "$NS"

kubectl create role pod-reader --verb=get,list,watch --resource=pods -n "$NS" --dry-run=client -o yaml > role.yaml

kubectl apply -f role.yaml

kubectl create rolebinding read-pods --role=pod-reader --serviceaccount="${NS}:app-reader" -n "$NS"

kubectl auth can-i list pods --as="system:serviceaccount:${NS}:app-reader" -n "$NS"

kubectl create token app-reader -n "$NS"

Commands using --as require the current kubeconfig identity to have impersonation permission. They test authorization as the named identity, not ServiceAccount token authentication.

A RoleBinding's --serviceaccount value includes the ServiceAccount namespace, and kubectl auth can-i --as requires impersonation permission.

Lessons: ServiceAccounts · RBAC · authentication and authorization

SecurityContext and Capabilities

Pod and container fields to place in YAML:

yaml
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    runAsNonRoot: true
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE

Lessons: SecurityContext examples · capabilities

Logs, Events and Troubleshooting

bash
kubectl logs <pod>
kubectl logs <pod> -c <container>
kubectl logs <pod> --all-containers=true
kubectl logs <pod> -c <container> --previous
kubectl logs -f <pod>
kubectl logs <pod> --tail=100 --since=1h --timestamps
kubectl get pod <pod> -o wide
kubectl describe pod <pod>
kubectl events --for pod/<pod>
kubectl debug -it <pod> --image=busybox --target=<container>
kubectl debug <pod> --copy-to=<debug-pod> --container=<container> -- sh

Lessons: Pod troubleshooting · CrashLoopBackOff · ImagePullBackOff · Pending / ContainerCreating

Services and EndpointSlices

bash
kubectl expose deployment web --port=80 --target-port=8080 --type=ClusterIP --dry-run=client -o yaml > service.yaml
kubectl get service
kubectl describe service <service>
kubectl get endpointslice -l kubernetes.io/service-name=<service>
kubectl get endpointslice \
  -l kubernetes.io/service-name=<service> \
  -o jsonpath='{range .items[*].endpoints[*]}{.addresses[0]}{" ready="}{.conditions.ready}{"\n"}{end}'
kubectl run client --image=curlimages/curl:8.12.1 --restart=Never -it --rm --command -- curl -sS http://<service>:<port>
kubectl port-forward service/<service> 8080:80
kubectl port-forward deployment/<deployment> 8080:80
kubectl port-forward pod/<pod> 8080:80

Lessons: Services · Service troubleshooting · port-forward

DNS Commands

Run inside a DNS client Pod:

bash
nslookup <service>
nslookup <service>.<namespace>
nslookup <service>.<namespace>.svc.<cluster-domain>
dig <service>.<namespace>.svc.<cluster-domain>
getent hosts <service>
cat /etc/resolv.conf

Run from the kubectl workstation:

bash
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl get service kube-dns -n kube-system

Use <cluster-domain> instead of hard-coding cluster.local; Service FQDNs follow <service>.<namespace>.svc.<cluster-domain>, although cluster.local is the common default.

Lesson: Service DNS troubleshooting

Ingress

bash
kubectl get ingressclass
kubectl get ingress
kubectl describe ingress <name>
curl -H 'Host: app.example.test' http://<ingress-address>/
curl --resolve app.example.test:443:<ingress-address> https://app.example.test/

Lesson: Ingress host, path, and TLS

NetworkPolicy

bash
kubectl get networkpolicy
kubectl describe networkpolicy <name>
kubectl get pods --show-labels
kubectl get namespaces --show-labels

Default-deny ingress:

yaml
spec:
  podSelector: {}
  policyTypes: [Ingress]

Allow one client namespace on TCP 80:

yaml
spec:
  podSelector:
    matchLabels:
      app: server
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: client-ns
    ports:
    - protocol: TCP
      port: 80

DNS egress to kube-system:

yaml
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

Test with allowed and blocked client Pods — YAML alone does not prove enforcement.

Lesson: NetworkPolicy

Helm

bash
helm repo add <name> <repository>
helm repo update
helm search repo <term>
helm show values <chart>
helm install <release> <chart>
helm install <release> <chart> -f values.yaml
helm install <release> <chart> --set key=value
helm upgrade <release> <chart>
helm upgrade --install <release> <chart>
helm history <release>
helm rollback <release> <revision>
helm uninstall <release>

Lesson: Helm charts

Kustomize

bash
kubectl kustomize <directory>
kubectl diff -k <directory>
kubectl apply -k <directory>
kubectl delete -k <directory>

Lesson: Kustomize overlays

CRDs and Operators

bash
kubectl get crd
kubectl describe crd <name>
kubectl api-resources --api-group=<group>
kubectl explain <custom-resource>
kubectl get <custom-resource>

Lessons: CRDs explained · Operators

Final One-Minute Verification Patterns

After a Pod:

bash
kubectl get pod <pod>
kubectl describe pod <pod>
kubectl logs <pod>

After a Deployment:

bash

kubectl rollout status deployment/<name>
kubectl get deployment,replicaset,pods

After a Service:

bash
kubectl get service <name>
kubectl get endpointslice -l kubernetes.io/service-name=<name>
kubectl get endpointslice \
  -l kubernetes.io/service-name=<name> \
  -o jsonpath='{range .items[*].endpoints[*]}{.addresses[0]}{" ready="}{.conditions.ready}{"\n"}{end}'

After RBAC:

bash

kubectl auth can-i <verb> <resource> --as=<subject> -n <namespace>

After a NetworkPolicy:

bash

kubectl describe networkpolicy <name>

Then test one allowed and one blocked connection.

CKAD — command examples

Examples are grouped common, then essential, then advanced. The advanced section covers less frequent timed-task patterns.

Common Read QoS class with JSONPath

QoS class lives on Pod status — useful when a task asks you to verify Guaranteed or Burstable settings.

Apply a Pod with matching requests and limits:

bash
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: Pod
metadata:
  name: qos-demo
spec:
  restartPolicy: Never
  containers:
  - name: app
    image: busybox:1.36
    command: ["sleep", "3600"]
    resources:
      requests:
        cpu: 100m
        memory: 64Mi
      limits:
        cpu: 100m
        memory: 64Mi
EOF

Read the QoS class:

bash
kubectl wait pod/qos-demo --for=condition=Ready --timeout=60s
kubectl get pod qos-demo -o jsonpath='{.status.qosClass}{"\n"}'

Sample output:

output

Guaranteed

Delete the demo Pod when you are done: kubectl delete pod qos-demo --ignore-not-found.

Common Test ServiceAccount permissions

RBAC tasks often end with kubectl auth can-i as the verification step.

Run the command:

bash
NS=default

kubectl create serviceaccount demo-reader -n "$NS"

kubectl create role demo-reader --verb=get,list,watch --resource=pods -n "$NS"

kubectl create rolebinding demo-reader --role=demo-reader --serviceaccount="${NS}:demo-reader" -n "$NS"

bash
kubectl auth can-i list pods --as="system:serviceaccount:${NS}:demo-reader" -n "$NS"

Sample output:

output

yes

Clean up: kubectl delete rolebinding demo-reader role demo-reader serviceaccount demo-reader --ignore-not-found.

Common Install or upgrade a Helm release

Helm CKAD tasks commonly use upgrade --install so a repeat run does not fail.

Run the command:

bash
helm repo add bitnami https://charts.bitnami.com/bitnami
helm upgrade --install web bitnami/nginx --set service.type=ClusterIP,replicaCount=1

bash

helm list

Sample output (trimmed):

output

NAME	NAMESPACE	REVISION	STATUS	CHART
web	default 	1       	deployed	nginx-...

Bump replicas with helm upgrade web bitnami/nginx --set replicaCount=2 when the task requires an upgrade.

Common Preview and apply a Kustomize directory

Build locally first when you need to sanity-check patches before they hit the cluster.

Run the command:

bash
kubectl kustomize https://github.com/kubernetes-sigs/kustomize/examples/helloWorld?ref=kustomize/v5.4.3 | head -20

bash

kubectl apply -k https://github.com/kubernetes-sigs/kustomize/examples/helloWorld?ref=kustomize/v5.4.3

kubectl kustomize prints merged YAML; apply -k sends it to the API server. Use a local overlay directory in exam tasks that forbid remote URLs.

Essential Generate a Deployment manifest

Client dry-run is the fastest CKAD pattern for starter YAML — generate, edit probes or resources, then apply.

Run the command:

bash
kubectl create deployment web --image=nginx:1.27 --replicas=2 --dry-run=client -o yaml

Sample output:

output

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: web
  name: web
spec:
  replicas: 2

Strip status: {} if present before you save the file. Add namespace: under metadata when the task names a namespace.

Essential Validate YAML with server dry-run

Server dry-run runs API validation and admission without persisting the object.

Run the command:

bash
kubectl apply -f - --dry-run=server --validate=strict <<'EOF'
apiVersion: v1
kind: ConfigMap
metadata:
  name: ckad-cm
  namespace: default
data:
  mode: exam
EOF

Sample output:

output

configmap/ckad-cm created (server dry run)

The (server dry run) suffix confirms nothing was stored in etcd.

Essential Roll back a Deployment

Rollout tasks usually require status, history, and undo — not only set image.

Run the command:

bash
kubectl create deployment web --image=nginx:1.26-alpine
kubectl set image deployment/web nginx=nginx:1.27-alpine
kubectl rollout status deployment/web --timeout=60s
kubectl rollout undo deployment/web

bash
kubectl get deploy web -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'

Sample output:

output

nginx:1.26-alpine

The image tag returns to the previous revision after rollout undo.

Essential Read previous container logs

Crash-loop tasks expect you to read --previous logs and the terminated exit code from describe or JSONPath.

Run the command:

bash
kubectl run crash --image=busybox:1.36 --restart=OnFailure -- sh -c 'echo start; exit 1'

Wait until at least one restart occurs:

bash
until [ "$(kubectl get pod crash -o jsonpath='{.status.containerStatuses[0].restartCount}')" -ge 1 ]; do
  sleep 1
done

bash

kubectl logs crash --previous

Sample output:

output

start

--previous reads logs from the preceding container instance only when such an instance exists.

If the Pod was already garbage-collected, create it again and read logs before deletion.

Advanced Attach an ephemeral debug container

When exec fails because the app image has no shell, ephemeral debug containers attach a toolbox to a running Pod.

Run the command:

bash
kubectl run netexec --image=registry.k8s.io/e2e-test-images/agnhost:2.39 --restart=Never -- /agnhost netexec --http-port=8080
kubectl wait --for=condition=Ready pod/netexec --timeout=60s
kubectl debug -it netexec --image=busybox:1.36 --target=netexec -- wget -qO- http://127.0.0.1:8080/

--target must name the existing container whose process namespace the ephemeral container should target.

Sample output:

output

NOW: 2026-07-27 ...

Delete the lab Pod afterward: kubectl delete pod netexec --ignore-not-found.

Interview corner

When do you use client dry-run versus server dry-run on CKAD?

Client dry-run builds YAML locally without contacting the API server — ideal for kubectl create … -o yaml manifest generation.

Server dry-run sends the object through API validation and admission controllers but does not persist it — use it to confirm a finished manifest is accepted.

A strong answer is:

"I generate with client dry-run, edit the YAML, then validate with server dry-run before the real apply."

What resource settings produce Guaranteed QoS?

For container-level resources, every application and init container must have non-zero CPU and memory requests and limits, with each request equal to its corresponding limit. On clusters using Pod-level resources, equal Pod-level CPU and memory requests and limits can also qualify the Pod as Guaranteed. Every container must satisfy both CPU and memory requirements for container-level Guaranteed QoS. The rules also apply to init containers. Verify with kubectl get pod NAME -o jsonpath='{.status.qosClass}'.

A strong answer is:

"Set equal non-zero CPU and memory requests and limits on every application and init container — then status.qosClass should read Guaranteed."

How do you undo a bad Deployment image change under time pressure?

kubectl rollout undo deployment/NAME reverts to the previous ReplicaSet. Use kubectl rollout history to pick a revision, then kubectl rollout undo deployment/NAME --to-revision=N when the task names a specific revision.

A strong answer is:

"I watch rollout status after the change, then undo — faster than rewriting YAML from scratch."

How do you prove a Service has ready backends?

kubectl get endpoints still works on many clusters, but EndpointSlices are the modern backing object. The default table lists addresses but does not clearly show each endpoint's conditions.ready value. Use:

bash
kubectl get endpointslice \
  -l kubernetes.io/service-name=<service> \
  -o jsonpath='{range .items[*].endpoints[*]}{.addresses[0]}{" ready="}{.conditions.ready}{"\n"}{end}'

Sample output:

output

192.168.5.20 ready=true
192.168.5.21 ready=true

Then test the Service from a client Pod. EndpointSlice readiness is represented by endpoint conditions, separately from the address itself.

A strong answer is:

"I inspect EndpointSlice addresses and their ready conditions, then test the Service from a client Pod."

Why do default-deny NetworkPolicies often need a DNS egress rule?

Pods resolve Service names through CoreDNS in kube-system. A default-deny egress policy blocks DNS traffic unless UDP and TCP port 53 are allowed to the cluster DNS endpoints.

A strong answer is:

"Without DNS egress, allowed ingress rules still fail because the client cannot resolve the Service hostname."

Which Pod changes require a new Pod instead of patch?

Most Pod spec fields are immutable. Fields such as volumes, container commands and arguments, environment variables, and serviceAccountName normally require Pod replacement. Container and init-container image fields are limited exceptions that Kubernetes permits updating in place. Workload controllers usually update their Pod template and create replacement Pods. Kubernetes explicitly permits updates to container and init-container image fields along with a small set of other Pod fields.

A strong answer is:

"For a standalone Pod, immutable changes require delete and recreate. For a Deployment, I update the Pod template and let the controller roll out replacements."

References

kubectl command reference — upstream subcommands and flags
kubectl cheat sheet — official quick reference
CKAD certification — current exam curriculum and policies
JSONPath in kubectl — template syntax for -o jsonpath

How to Use This Cheat Sheet

CKAD — quick reference

Shell and context

Generate YAML (--dry-run=client -o yaml)

Apply, validate, and patch

Inspect and filter

Rollouts and scale

RBAC checks

Metrics and logs

Helm and Kustomize

Shell and kubectl Shortcuts

Discover Resource Syntax

Generate YAML Quickly

Apply, Validate and Compare YAML

Inspect Resources

JSONPath and Custom Output

Pods and Multi-Container Workloads

Deployments and Rollouts

Jobs and CronJobs

ConfigMaps and Secrets

Resource Requirements and Quotas

ServiceAccounts and RBAC

SecurityContext and Capabilities

Logs, Events and Troubleshooting

Services and EndpointSlices

DNS Commands

Ingress

NetworkPolicy

Helm

Kustomize

CRDs and Operators

Final One-Minute Verification Patterns

CKAD — command examples

Interview corner

References

Related Articles

CKAD Practice Tasks by Exam Domain

CKAD Tutorial: Certified Kubernetes Application Developer Course

Debug Kubernetes Pods with kubectl exec and kubectl debug

Search GoLinuxCloud

Generate YAML (`--dry-run=client -o yaml`)