Kubernetes :: Tag :: Kubernetes training

Introduction

Sat, 21 Sep 2024 14:15:26 +1000

Kubernetes Certifications The Cloud Native Computing Foundation offers three major certifications to validate your skills and expertise in managing Kubernetes clusters. These certifications are recognized worldwide and help validate your knowledge with recruiters and companies. CKA (Certified Kubernetes Administrator) The CKA is intended for system administrators who want to demonstrate their mastery of Kubernetes cluster administration. It covers essential aspects of managing and operating a Kubernetes cluster.

Essential kubectl Commands

Tue, 11 Jun 2024 14:15:26 +1000

Duration: 5 min read Official documentation for kubectl kubectl quick reference List a Resource from the API Server To retrieve details of a specific resource in Kubernetes, use the following command: kubectl get

[-o yaml/json] Describe a Resource from the API Server To get a detailed description of a specific resource, use:

The k8s-school Labs

Wed, 22 May 2024 14:15:26 +1000

Here you will find the labs for the Kubernetes training as well as other useful resources such as articles or demos. k8s-school Demos Prometheus Demo Helm Demo EFK Demo Ingress Demo Telepresence Demo ArgoCD Demo Istio Demo Online Resources K8s advanced Openshift advanced K8s courses and slides K8s toolbox Security NSA Kubernetes Hardening Guide kubescape rbac-tools Our Team We are expert trainers in Kubernetes. Contact us if you have suggestions or to set up a customized Kubernetes training program.

Alternatives for deprecated 'kubectl run' commands

Mon, 30 Sep 2019 00:00:00 +0000

Written by: Karim AMMOUS (LinkedIn). Date: Sept 30, 2019 · 5 min read kubectl run command is a convenient and useful way to quickly create kubernetes resources without dealing with yaml files. Since kubernetes v1.12, creation acknowledgment (“object created”) is preceded by a message noting that this creation command is deprecated and will no longer be available in future kubectl releases. Indeed, we can create some “runnable” resources like Pods and Deployments (the complete list) using kubectl run command by setting the --generator flag with the appropriate value. However, those generators have been deprecated since v1.12 except ‘run-pod/v1’ generator.

Kubernetes Controllers

Sun, 23 Mar 2025 14:15:26 +1000

Objective This lab will help you understand the role of Kubernetes controllers in managing the desired/actual state of cluster resources. Prerequisites A Kubernetes cluster (Minikube, Kind, or a cloud-based Kubernetes cluster) kubectl installed and configured Step 1: Understand Controllers Kubernetes controllers are control loops that monitor the state of the cluster and make or request changes where needed. The key controllers include:

Educational Material

Wed, 22 May 2024 14:15:26 +1000

Course Materials All slides are available here Exchange File During the training, we will communicate via this Framapad Reference Book Kubernetes: Up and Running

Multi-Container Pod Design Patterns

Mon, 24 Nov 2025 14:15:26 +1000

Auteur: Fabrice JAMMES (LinkedIn). Date: Nov 24, 2025 · 10 min read Quick Exercise: Fix the Bugs! 🐛 Objective Create a pod with an init container and a sidecar - There are 2 bugs to fix! Scenario Init container: generates an index.html with system info Main container: nginx 1.25.3 web server Sidecar: counts requests in access logs every 10 seconds Task Deploy the following pod and fix the errors:

Tips and Tricks

Sat, 22 Nov 2025 14:15:26 +1000

Before the Exam Important Instructions Agree to Global Candidate Agreement Get Candidate Handbook Read the Important Instructions System Compatibility Check All information is on this page of the Linux Foundation site, to be done a few days before the exam.

Pod Anti Affinity

Thu, 06 Jun 2024 14:15:26 +1000

Create a nginx deployment with 3 pods Solution apiVersion: apps/v1 kind: Deployment metadata: name: nginx spec: replicas: 3 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: nginx image: gcr.io/google_containers/nginx-slim:0.9 ports: - containerPort: 8080 Add a ‘podAntiAffinity’ section to the deployment The goal is to distribute all pod for this deployment across different nodes.

Access to Labs

Wed, 22 May 2024 14:15:26 +1000

SSH Access The password will be provided by the trainer: ssh k8s@ Kubernetes Access The kubeconfig file allows connection to the Kubernetes server. # Retrieve the k8s cluster authentication file mkdir -p ~/.kube cp /tmp/config $HOME/.kube/config chmod 600 $HOME/.kube/config # Alternate solution, kind specific kind export kubeconfig # Launch k8s-toolbox interactively ktbx desk # Check Kubernetes status kubectl cluster-info # Check node status kubectl get nodes # Create a namespace kubectl create namespace # Change the current context's active namespace kubens # Create a pod # use "kubectl run --help" to retrieve the correct command kubectl run ??? # Add a label to the pod kubectl label pod tutorial=true Openshift Access # inside the toolbox # Retrieve password in /tmp/oc-creds.txt oc login -u kubeadmin https://api.crc.testing:6443 # Watch the cluster kubectl get nodes # Check you context kubectx # Create a namespace oc new-project --help # Check you context again kubectx # Switch to other context/cluster # kubectx default/api-crc-testing:6443/kubeadmin Download the Labs Once in the toolbox, run one of the commands below to download the labs:

Infrastructure pod

Thu, 20 Feb 2025 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn) Task Follow the steps below to investigate the relationship between Kubernetes pods and containers: Connect to a Kind node Answer Run docker ps to find the Kind node name. Use docker exec -it bash to enter the container. docker exec -it bash Use crictl to list pods and containers: Answer crictl ps -a lists all containers. crictl pods shows running pods. crictl ps -a crictl pods Investigate the relationship between a pod and its container(s): Answer crictl inspect provides container details. ps auxf shows process hierarchy. crictl inspect crictl inspectp ps auxf What is the role of the “pause” process? Answer The “pause” container acts as the parent container for all other containers in a pod. It holds the network namespace and ensures pod lifecycle consistency. Explore the directories /var/log and /var/lib/kubelet. Answer /var/log: Contains logs from Kubernetes components and container runtime. /var/lib/kubelet/pods: Stores pod data, volume mounts, and container runtime state Conclusion This lab guides you through a better understanding of pod technical architecture.

Kustomize - Kubernetes Native Configuration Management

Sun, 21 Sep 2025 14:15:26 +1000

What is Kustomize? Native Kubernetes tool for customizing application configurations Template-free: Works with plain YAML manifests Declarative approach: Define variations as patches and overlays Built into kubectl since v1.14 (kubectl apply -k) Key Principles Base + Overlays: Keep common resources in base, environment-specific changes in overlays No templating: Pure YAML manipulation DRY (Don’t Repeat Yourself): Reuse base configurations across environments Core Concepts Directory Structure ├── base/ │ ├── kustomization.yaml │ ├── deployment.yaml │ └── service.yaml └── overlays/ ├── dev/ │ └── kustomization.yaml ├── staging/ │ └── kustomization.yaml └── production/ ├── kustomization.yaml └── patches/ └── resources-patch.yaml kustomization.yaml The main configuration file that defines:

CKS: Required Skills

Sat, 18 Jan 2025 14:15:26 +1000

The requirements are listed in the CKS Curriculum. Make sure to check the up-to-date version. Here is the content of version 1.34 of the Curriculum: CKS Program 10% - Cluster Setup Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi) Properly set up Ingress objects with security controls Protect node metadata and endpoints Minimize use of, and access to, GUI elements Verify platform binaries before deploying 15% - Cluster Hardening Restrict access to Kubernetes API Use Role Based Access Controls to minimize exposure Exercise caution in using service accounts, e.g. disable defaults, minimize permissions on newly created ones Update Kubernetes frequently 15% - System Hardening Minimize host OS footprint (reduce attack surface) Minimize IAM roles Minimize external access to the network Appropriately use kernel hardening tools such as AppArmor, seccomp 20% - Minimize Microservice Vulnerabilities Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts Manage Kubernetes secrets Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers) Implement pod to pod encryption by use of mTLS 20% - Supply Chain Security Minimize base image footprint Secure your supply chain: whitelist allowed registries, sign and validate images Use static analysis of user workloads (e.g. kubernetes resources, docker files) Scan images for known vulnerabilities 20% - Monitoring, Logging and Runtime Security Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities Detect threats within physical infrastructure, apps, networks, data, users and workloads Detect all phases of attack regardless of where it occurs and how it spreads Perform deep analytical investigation and identification of bad actors within environment Ensure immutability of containers at runtime Use Audit Logs to monitor access The training program is based on this curriculum.

Tips and tricks

Wed, 22 May 2024 14:15:26 +1000

Copy a file in Linux console cat > my-file.sh # paste the content and use Ctrl-D Enable ssh persistent session with Byobu ssh k8s@ byobu # F2: create new tab # F3/F4: switch to left/right tab If the session crashes, reconnect and launch byobu to recover it

Setting Up the Training Platform

Wed, 22 May 2024 14:15:26 +1000

During the training, it is recommended to use the provided platform. This section describes how to reproduce it after the training to replay the labs. Prerequisites Local Machine Configuration Fedora is recommended 8 cores, 16 GB of RAM, 30 GB for the partition hosting Docker entities (images, volumes, containers, etc). Use the df command as shown below to find its size. sudo df -sh /var/lib/docker # or /var/snap/docker/common/var-lib-docker/ Internet access without proxy sudo access Install the dependencies below: sudo dnf install curl docker git vim bash-completion # then add the current user to the docker group sudo usermod -a -G docker $USER # or restart the gnome session newgrp docker Then, you can create the Kubernetes cluster in two lines by following the ktbx documentation.

Kubernetes easy install with Kubeadm

Mon, 27 Jan 2020 14:15:26 +1000

Auteur: Fabrice JAMMES (LinkedIn). Date: Jan 27, 2020 · 10 min read This article explains how to install Kubernetes with kubeadm, the official Kubernetes installer. It is inspired by the official documentation, while declining it for Ubuntu and simplifying it. It has been successfully tested with Kubernetes 1.31.0 Pre-requisites: Infrastructure One or more machines running Ubuntu LTS, with administrator access ( sudo) 2 GB or more of RAM per machine 2 or more processors on the master node Full network connectivity between all machines in the cluster The ‘size-of-master-and-master-components’ documentation define some guidelines on how to size your masters nodes depending on the total number of your Kubernetes nodes.

Kubernetes Service Account Token Lab

Tue, 18 Nov 2025 14:15:26 +1000

Auteur: Fabrice JAMMES (LinkedIn). Date: Nov 18, 2025 · 10 min read A simple lab to explore Service Accounts and their tokens in Kubernetes. Prerequisites A Kubernetes cluster (kind, minikube, or any cluster) kubectl configured jq installed (for JSON parsing) Lab Overview Understanding default Service Accounts Creating custom Service Accounts Exploring Service Account tokens (JWT) Using tokens to authenticate Token mounting behavior Part 1: Default Service Account Every namespace automatically gets a default service account.

RBAC

Wed, 26 Feb 2025 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn). 1. Create Namespaces Create two namespaces: foo- bar- Answer kubectl create namespace foo- kubectl create namespace bar- 2. Deploy curl-custom-sa Pod Create a curl-custom-sa pod inside the foo- namespace, using the service account foo-:default (the default service account of foo-).

RBAC monitoring

Thu, 06 Jun 2024 14:15:26 +1000

Exercice: find RBAC security issue Connect to Kubernetes: ktbx desk kubectx kind-kind Then use: https://github.com/alcideio/rbac-tool https://github.com/kubescape/kubescape https://github.com/corneliusweig/rakkess To find the RBAC security issue in the cluster.

NetworkPolicy

Thu, 06 Jun 2024 14:15:26 +1000

Prerequisites # Launch the toolbox ktbx desk # Check your use kind-kind context kubectx #Launch initialization script /home/k8s0/openshift-advanced/labs/3_policies/ex4-network.sh # go to correct namespace kubens network-k8s Check that 3 pods have been created. Solution kubectl get pods --show-labels NAME READY STATUS RESTARTS AGE LABELS external 1/1 Running 0 2m app=external pgsql-postgresql-0 1/1 Running 0 2m ...,tier=database webserver 1/1 Running 0 2m tier=webserver Play with network policy Look at the official documentation and at the examples

Audit Logs & API Server

Thu, 06 Jun 2024 15:00:00 +1000

Objectives Configure audit policies to trace modifications on critical resources and secure the API Server in a Kubernetes cluster. Prerequisites Define your cluster name: $CLUSTER_NAME="my-cluster" Q1: How to modify the API Server configuration? Answer The API Server in Kubernetes runs as a static pod managed by the kubelet. Static pods are defined by YAML manifests in the /etc/kubernetes/manifests/ directory. When you modify a static pod manifest:

Openshift 2days

Wed, 22 May 2024 14:15:26 +1000

Fundamentals Openshift Openshift Advanced modules D_01_Ingress.pdf D_03_Helm.pdf D_03_Prometheus_monitoring.pdf

Slides

Wed, 22 May 2024 14:15:26 +1000

Slides CKAD CKAD.pdf CKS E_01_advanced-k8s-cluster-internals.pdf E_02_advanced-k8s_RBAC.pdf E_03_advanced-k8s_Security_node+network.pdf E_04_advanced-k8s_computational_resources.pdf E_04.1_finops.pdf CKS.pdf Advanced Kubernetes E_01_advanced-k8s-cluster-internals.pdf E_02_advanced-k8s_RBAC.pdf E_03_advanced-k8s_Security_node+network.pdf E_04_advanced-k8s_computational_resources.pdf E_04.1_finops.pdf E_05_advanced-k8s_advanced_scheduling.pdf E_06_advanced-k8s_operators.pdf Openshift Openshift Optional modules D_01_Ingress.pdf D_02_Istio_k8s_service-mesh.pdf D_03_Helm.pdf D_03_Prometheus_monitoring.pdf D_05_multicluster-monitoring.pdf D_06_develop_with_k8s.pdf D_07_openshift_airgapped D_08_openshift_ingress-gateway Misc Gartner_choose_k8s_install_method.pdf ssh-tunnel-and-port-forward.pdf

Hardening with CIS Benchmarks - Running kube-bench Jobs

Fri, 09 Jan 2026 10:00:00 +1000

Introduction to CIS Benchmarks The Center for Internet Security (CIS) provides best practices for securing Kubernetes. In this lab, we will use kube-bench, an open-source tool from Aqua Security, to check whether our cluster meets these security recommendations. Running kube-bench as a Job In a CKS exam or production environment, you often run kube-bench as a Kubernetes Job to scan nodes without SSH access.

Hardening with CIS Benchmarks - Security Remediations

Fri, 09 Jan 2026 10:00:00 +1000

Practical CKS Exercise Workflow As a CKS candidate, you should practice the complete security hardening workflow manually. This section guides you through the key exercises step by step to remediate security issues found by kube-bench. Remove the --profiling argument for the scheduler Look for the check 1.4.1: Ensure that the –profiling argument is set to false.

Hardening with CIS Benchmarks - Automation and Continuous Compliance

Fri, 09 Jan 2026 10:00:00 +1000

Automation and Continuous Compliance Why is running kube-bench manually not enough for a production environment? Answers Configuration Drift: A manual change or update could revert security settings. New Benchmarks: CIS updates its recommendations regularly. Visibility: Security teams need centralized reporting, not just CLI logs. Suggested improvement Integrate kube-bench into a CronJob to run every week and send results to a security dashboard like Falco or a SIEM.

Kustomize

Tue, 11 Nov 2025 14:15:26 +1000

Lab Overview In this quick lab, you will learn the essentials of Kustomize by creating a base configuration and two environment overlays (dev and production). Duration: 10-15 minutes Prerequisites: kubectl installed (with Kustomize support) Basic understanding of Kubernetes resources Exercise 1: Setup Base Configuration Objective Create a base configuration for a simple nginx application.

Monitoring with Prometheus

Thu, 20 Feb 2025 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn). Prerequisites # Launch the toolbox ktbx desk # Check your use kind-kind context kubectx #Launch initialization script /home/k8s0/openshift-advanced/labs/3_policies/ex4-network.sh # go to correct namespace kubens network-k8s Kubernetes Monitoring Lab with Helm Objective The goal of this lab is to deploy the Prometheus Stack using Helm while following best practices in shell scripting.

Understanding StatefulSets

Tue, 25 Feb 2025 14:15:26 +1000

Semi-Manual Installation Create a MongoDB StatefulSet. Apply the mongo-simple.yaml file to create the StatefulSet. Then apply the mongo-service.yaml file to create the headless service. Check that the pods start in order. Start a shell in an Ubuntu pod (kubectl run -i --rm --tty shell --image=ubuntu:24.04 -- bash), install nslookup or dig, and attempt a DNS resolution of: mongo mongo-1.mongo What do you observe?

Kubectl proxy and curl

Wed, 26 Feb 2025 14:15:26 +1000

Author: Fabrice JAMMES (LinkedIn). Objective Learn how to use kubectl proxy and curl to list services in a specified Kubernetes namespace. Prerequisites A running Kubernetes cluster kubectl installed and configured curl installed Steps Step 1: Start kubectl proxy Run the following command to start the kubectl proxy:

Kubelet and static pods

Sun, 30 Jun 2024 14:15:26 +1000

Exercice 1: retrieve static pod specifications in Kubernetes (kind-based) Switch to Kubernetes cluster using kubectx kind-kind and then access the control plane Node using docker exec -t -- sh and then access Kubelet configuration. Answer MASTER_NODE=$(kubectl get nodes '--selector=node-role.kubernetes.io/control-plane' -o jsonpath='{.items[0].metadata.name}') # Exit the ktbx-toolbox to run docker docker exec -t -- kind-control-plane sh -c 'ps -ef | grep "/usr/bin/kubelet"' docker exec -t -- kind-control-plane sh -c 'cat /var/lib/kubelet/config.yaml | grep -i staticPodPath' docker exec -t -- kind-control-plane sh -c 'ls /etc/kubernetes/manifests' Exercice 1: retrieve static pod specifications in Openshift Switch to Kubernetes cluster using kubectx and then access the control plane Node using oc debug node/ and then access Kubelet configuration.

etcd administration

Sun, 30 Jun 2024 14:15:26 +1000

Auteur: Fabrice JAMMES (LinkedIn). Exercice 1: display Kubernetes and Openshift resources Retrieve etcd pod name Answer # Wait for etcd pod to be u kubectl wait --timeout=240s --for=condition=Ready -n "openshift-etcd" pods -l "app=etcd,etcd=true,k8s-app=etcd" etcd_pod=$(kubectl get pods -n "openshift-etcd" -l "app=etcd,etcd=true,k8s-app=etcd" -o jsonpath='{.items[0].metadata.name}') Launch etcdctl --help inside etcd pod Answer # Display Kubernetes keys kubectl exec -t -n "openshift-etcd" "$etcd_pod" -- etcdctl --help