NetworkPolicy gotcha: all traffic allowed until first NetworkPolicy selects the Pod
kubectl explain:kubectl explain pod.spec.containers.resources — your built-in reference during the exam
1 / 5
An exam question says: "A Pod is in CrashLoopBackOff status." What does this mean?
CrashLoopBackOff is one of the most important Pod status messages in Kubernetes and appears frequently in the CKA exam.
It means the container keeps crashing immediately after start. Kubernetes restarts it automatically, but adds backoff delays: 10s, 20s, 40s, 80s... up to 5 minutes between restarts.
Common causes: • Application code error on startup • Missing environment variable or Secret • Incorrect command or entrypoint • Missing PVC or ConfigMap volume
Diagnosis command:kubectl logs <pod-name> --previous (shows logs from the crashed container)
Other important Pod statuses: • Pending — not yet scheduled; check node resources or taints • ImagePullBackOff — cannot pull container image; check registry credentials • OOMKilled — out of memory; increase memory limit • Evicted — node was under pressure, Pod removed
2 / 5
You need to allow a Pod to read Secrets in the payments namespace only. Which Kubernetes resources do you create?
Kubernetes RBAC uses four resources — and the CKA/CKAD exams test this distinction constantly:
Role — grants permissions within a single namespace ClusterRole — grants permissions cluster-wide or to non-namespaced resources (Nodes, PVs) RoleBinding — binds a Role (or ClusterRole) to a subject within a namespace ClusterRoleBinding — binds a ClusterRole to a subject cluster-wide
For namespace-scoped permissions → always Role + RoleBinding. For cluster-wide permissions → ClusterRole + ClusterRoleBinding.
The subject is the ServiceAccount, User, or Group receiving the permissions.
Quick check: A ClusterRole can be used in a RoleBinding to limit a cluster-wide role to a specific namespace. But a Role can never grant cluster-wide permissions.
3 / 5
Complete the Kubernetes concept: "To ensure a Pod always runs on every node in the cluster — useful for monitoring agents like Prometheus Node Exporter — you use a _____."
A DaemonSet ensures that one copy of a Pod runs on every node (or a subset defined by node selectors). When a new node joins the cluster, Kubernetes automatically schedules the DaemonSet Pod on it. When a node is removed, the Pod is garbage collected.
Deployment — runs N replicas, typically on different nodes, but not necessarily one per node StatefulSet — ordered, stable identity Pods for databases and stateful applications ReplicaSet — lower-level than Deployment; manages replicas but has no rolling update strategy
The CKA exam often asks: "how would you ensure a logging agent runs on all nodes?" → DaemonSet.
4 / 5
A question states: "The application writes to a PersistentVolumeClaim (PVC) with accessMode: ReadWriteOnce." What does ReadWriteOnce mean?
Kubernetes PersistentVolume access modes control how volumes can be mounted:
ReadWriteOnce (RWO) — can be mounted read-write by one node at a time. Multiple Pods on the same node can all use it. ReadOnlyMany (ROX) — can be mounted read-only by many nodes simultaneously ReadWriteMany (RWX) — can be mounted read-write by many nodes simultaneously (requires NFS, CephFS, etc.) ReadWriteOncePod (RWOP) — can be mounted read-write by a single Pod only (K8s 1.22+)
Exam trap: RWO allows one node, not one Pod. If you deploy 3 replicas on 3 different nodes and use RWO → two Pods will be Pending because the PVC can only attach to one node.
Supported modes depend on the storage class and underlying storage provider.
5 / 5
The exam asks you to ensure Pods from team A cannot send traffic to Pods from team B. The teams use different namespaces. You need to create a _____.
NetworkPolicy is the Kubernetes resource for pod-level network traffic rules. It's a critical CKA and CKS topic.
Key concepts: • NetworkPolicies are namespaced • By default, Pods are non-isolated — all traffic is allowed • Once any NetworkPolicy selects a Pod, that Pod becomes isolated. Only explicitly allowed traffic passes • NetworkPolicies require a CNI plugin that supports them (Calico, Cilium, Weave-net)
To block team A → team B: Create a NetworkPolicy in team B's namespace. The podSelector selects team B's Pods. The ingress rules do NOT include team A's namespace in the namespaceSelector. That drops all ingress from team A.
ResourceQuota — limits CPU/memory/Pod count within a namespace PodSecurityAdmission — controls Pod security standards (privileged, baseline, restricted) Headless Service (ClusterIP: None) — removes load balancing, doesn't affect network traffic rules