KCNA

Diagram the relationship between a Kubernetes control plane, worker nodes, and workloads.

Trace a Kubernetes API request through authentication, validation, persistence, and reconciliation.

Explain the role of etcd as Kubernetes cluster state storage.

Distinguish the responsibilities of the scheduler and controller manager.

Explain how the kubelet, container runtime, and kube-proxy support workloads on a node.

Interpret the apiVersion, kind, metadata, spec, and status fields of a Kubernetes object.

Discover and inspect cluster resources with kubectl get, describe, explain, and api-resources.

Organize and select Kubernetes objects using namespaces, labels, selectors, and annotations.

Write and apply a Pod manifest for a containerized application.

Inspect Pod phases, conditions, events, logs, and container processes to explain a Pod's current state.

Distinguish init containers and sidecar containers by lifecycle and purpose.

Create a Deployment and trace its ownership of ReplicaSets and Pods.

Scale a Deployment and verify that the controller reconciles the requested replica count.

Update a Deployment image and inspect or reverse its rollout.

Select among Deployments, DaemonSets, and StatefulSets for a workload scenario.

Select between Jobs and CronJobs for finite and scheduled tasks.

Create a ConfigMap and consume its values as environment variables or mounted files.

Create a Secret, consume it from a Pod, and explain why base64 encoding is not encryption.

Distinguish container-local ephemeral storage from Kubernetes persistent storage.

Explain how PersistentVolumes, PersistentVolumeClaims, and StorageClasses participate in dynamic provisioning.

Mount a PersistentVolumeClaim in a Pod and verify that data survives Pod replacement.

Predict Pod scheduling from resource requests and available node capacity.

Constrain Pod placement with node selectors and node affinity.

Control Pod placement with node taints and tolerations.

Explain the Kubernetes pod networking model and the role of Container Network Interface plugins.

Trace in-cluster service discovery from DNS lookup through a Service and EndpointSlice to a Pod.

Expose a Deployment with a ClusterIP Service and verify connectivity from another Pod.

Select among ClusterIP, NodePort, LoadBalancer, and ExternalName Services for a stated requirement.

Explain how Ingress and the Gateway API route external HTTP traffic to Services.

Apply a NetworkPolicy that permits an intended traffic flow while denying other traffic.

Diagnose basic Kubernetes connectivity failures using kubectl and DNS or HTTP test tools.

Explain how reconciliation and controller loops provide self-healing behavior.

Configure startup, readiness, and liveness probes for a containerized application.

Set container resource requests and limits and predict CPU throttling or out-of-memory termination.

Explain how a HorizontalPodAutoscaler changes replica counts from observed metrics.

Apply namespace ResourceQuotas and LimitRanges to constrain resource consumption.

Trace a Kubernetes request through authentication, authorization, and admission control.

Determine and test permissions granted through ServiceAccounts, Roles, and RoleBindings.

Apply a Pod security context that follows least-privilege principles.

Map source control, build, test, image publication, and deployment to stages of a cloud-native CI/CD pipeline.

Explain how immutable infrastructure and externalized configuration improve repeatability.

Install, inspect, upgrade, and roll back an application release with Helm.

Explain how GitOps controllers reconcile cluster state from a version-controlled source of truth.

Distinguish CustomResourceDefinitions and operators from built-in Kubernetes resources and controllers.

Select rolling, blue-green, or canary delivery for a stated release risk.

Select image scanning, signing, or software-bill-of-materials controls for a stated supply-chain risk.

Distinguish metrics, logs, and traces by the operational questions each signal answers.

Explain the Prometheus pull model, targets, exporters, and time-series labels.

Interpret a basic Prometheus metric and use it to assess workload health.

Trace container logs from standard output through a collector such as Fluent Bit or Fluentd to a backend.

Explain how OpenTelemetry context connects spans into a distributed trace.

Define a service-level indicator, objective, agreement, and error budget for a simple service.

Explain the data-plane and control-plane roles of a service mesh and the purpose of Envoy.

Classify major CNCF projects by function and maturity, including Kubernetes, containerd, CoreDNS, Prometheus, Envoy, and Fluentd.

Deploy a configured application behind a Kubernetes Service and verify internal reachability.

Add persistent storage to an application and verify data survival after Pod replacement.

Add probes and resource constraints to a workload and observe its behavior during a controlled failure.

Diagnose and repair a workload exhibiting Pending, ImagePullBackOff, or CrashLoopBackOff symptoms.

Choose appropriate workload, networking, configuration, and storage resources for a KCNA-style scenario.

Map cloud-native requirements to the relevant categories and projects in the CNCF landscape.

Apply time budgeting and option-elimination techniques to a timed KCNA practice set.

Analyze errors from a practice set and produce a targeted final-review checklist.