Skip to content

Latest commit

 

History

History
215 lines (185 loc) · 56.6 KB

labs.MD

File metadata and controls

215 lines (185 loc) · 56.6 KB

Lab descriptions are in English by default. Use the language links next to a translated lab: RU, ES, FR, DE, GE, TW or JP. Labs without language links are available in English only.

CKS labs

  • TASK=101 make run_cks_task - create CKS lab number 101
  • TASK=101 make delete_cks_task - delete CKS hands-on lab
  • TASK=101 make run_cks_task_clean - run cks_task with clean terragrunt cache for the CKS lab
  • make output_cks_task - show outputs from cks_task
Task Description Solution
101 NetworkPolicy: default-deny, isolation, and EC2 IMDS
RU · ES · FR · DE · GE · TW · JP
SOLUTION
102 CiliumNetworkPolicy: L3/L4/L7, DNS-aware egress, and Hubble
RU · ES · FR · DE · GE · TW · JP
SOLUTION
103 CIS/kube-bench, Secure Ingress TLS, and binary verification
RU · ES · FR · DE · GE · TW · JP
SOLUTION
104 Restricting access to the Kubernetes API: RBAC, ServiceAccount, and anonymous-auth
RU · ES · FR · DE · GE · TW · JP
SOLUTION
105 System Hardening of the OS and Docker daemon security
RU · ES · FR · DE · GE · TW · JP
SOLUTION
106 AppArmor and seccomp: node-local policy and verifiable denials
RU · ES · FR · DE · GE · TW · JP
SOLUTION
107 Pod Security Admission: restricted, audit/warn, and a read-only root filesystem
RU · ES · FR · DE · GE · TW · JP
SOLUTION
108 Admission policies with Kyverno
RU · ES · FR · DE · GE · TW · JP
SOLUTION
109 Encrypting Secrets in etcd and minimal access
RU · ES · FR · DE · GE · TW · JP
SOLUTION
110 gVisor RuntimeClass, Cilium WireGuard, and Istio mTLS
RU · ES · FR · DE · GE · TW · JP
SOLUTION
111 Image analysis, static fixes, and supply-chain evidence
RU · ES · FR · DE · GE · TW · JP
SOLUTION
112 Runtime: Falco, audit logs, and an immutable root filesystem
RU · ES · FR · DE · GE · TW · JP
SOLUTION
113 Upgrading a Kubernetes Cluster with kubeadm (minor upgrade)
RU · ES · FR · DE · GE · TW · JP
SOLUTION
114 Kubeconfig contexts, client certificates, and API exposure
RU · ES · FR · DE · GE · TW · JP
SOLUTION
115 Cilium bootstrap, kube-proxy replacement, and Mutual Authentication
RU · ES · FR · DE · GE · TW · JP
SOLUTION

CKA labs

  • TASK=01 make run_cka_task - create cka lab number 01
  • TASK=01 make delete_cka_task - delete cka hands-on labs
  • TASK=01 make run_cka_task_clean - run cka_task with clean terragrunt cache for cka_task
  • make output_cka_task - show outputs from cka_task
Task Description Solution
01 Fix problem with kube-api SOLUTION
VIDEO SOLUTION
02 Horizontal Pod Autoscaling .CPU SOLUTION
03 Nginx ingress. Routing by header SOLUTION
VIDEO SOLUTION
04 Nginx ingress. Routing 30% of requests to new version of app. SOLUTION
VIDEO SOLUTION
05 PriorityClass. SOLUTION
VIDEO SOLUTION
06 Create general resources (Namespace, Deployment, Service) SOLUTION
VIDEO SOLUTION
07 CPU throttle SOLUTION
08 Cilium NetworkPolicy L7 SOLUTION
VIDEO SOLUTION
09 Gateway API in Kubernetes SOLUTION
VIDEO SOLUTION
10 Kubernetes resource orchestration (kro) SOLUTION
101 Kubernetes Basics: Pods, Deployment, Namespaces, Labels, Service
RU · ES · FR · DE · GE · TW · JP
SOLUTION
102 Updates and Deployment Strategies: rolling update, rollback, canary, blue/green
RU · ES · FR · DE · GE · TW · JP
SOLUTION
103 One-off and Scheduled Tasks: Job, CronJob, DaemonSet
RU · ES · FR · DE · GE · TW · JP
SOLUTION
104 Scheduling: nodeSelector, taints, resources, static pod, PriorityClass, HPA
RU · ES · FR · DE · GE · TW · JP
SOLUTION
105 Configuration: ConfigMap, Secret, Environment Variables
RU · ES · FR · DE · GE · TW · JP
SOLUTION
106 Application Security: SecurityContext and Capabilities
RU · ES · FR · DE · GE · TW · JP
SOLUTION
107 Application Design: multi-container Pods, images, volumes
RU · ES · FR · DE · GE · TW · JP
SOLUTION
108 Storage: PersistentVolume, PersistentVolumeClaim and mounting a volume into a Pod
RU · ES · FR · DE · GE · TW · JP
SOLUTION
109 Observability and Maintenance: Probes, Logs, Debugging, Deprecations
RU · ES · FR · DE · GE · TW · JP
SOLUTION
110 Networking: Service/DNS, Ingress, NetworkPolicy
RU · ES · FR · DE · GE · TW · JP
SOLUTION
111 kubeadm: Cluster Upgrade (lifecycle)
RU · ES · FR · DE · GE · TW · JP
SOLUTION
112 etcd: Snapshots and Restore
RU · ES · FR · DE · GE · TW · JP
SOLUTION
113 RBAC and Certificates: Role, ClusterRole, ServiceAccount, CSR
RU · ES · FR · DE · GE · TW · JP
SOLUTION
114 Troubleshooting: Fixing Broken Resources
RU · ES · FR · DE · GE · TW · JP
SOLUTION
115 Extension and Packaging: CRD, Helm, Kustomize
RU · ES · FR · DE · GE · TW · JP
SOLUTION
116 kubeadm: Build a Cluster from Scratch (init + join)
RU · ES · FR · DE · GE · TW · JP
SOLUTION
117 Troubleshooting: control plane and nodes
RU · ES · FR · DE · GE · TW · JP
SOLUTION
118 Troubleshooting: Certificates, CoreDNS and Cluster Networking
RU · ES · FR · DE · GE · TW · JP
SOLUTION
119 Speed Drills and JSONPath
RU · ES · FR · DE · GE · TW · JP
SOLUTION
120 Drills: Services and Networking
RU · ES · FR · DE · GE · TW · JP
SOLUTION
121 Drills: RBAC
RU · ES · FR · DE · GE · TW · JP
SOLUTION
122 Drills: Pod Scheduling
RU · ES · FR · DE · GE · TW · JP
SOLUTION
123 Low-Level Networking: Installing a CNI from Scratch
RU · ES · FR · DE · GE · TW · JP
SOLUTION
124 HA control plane: building a cluster out of 3 control-plane nodes
RU · ES · FR · DE · GE · TW · JP
SOLUTION
125 DNS and CoreDNS in the Cluster
RU · ES · FR · DE · GE · TW · JP
SOLUTION

CKAD labs

  • TASK=01 make run_ckad_task - create ckad lab number 01
  • TASK=01 make delete_ckad_task - delete ckad hands-on labs
  • TASK=01 make run_ckad_task_clean - run cka_task with clean terragrunt cache for ckad_task
  • make output_ckad_task - show outputs from ckad_task
Task Description Solution
01 test SOLUTION

ICA labs (Istio Certified Associate)

  • TASK=01 make run_ica_task - create ica lab number 01
  • TASK=01 make delete_ica_task - delete ica hands-on lab
  • TASK=01 make run_ica_task_clean - run ica_task with clean terragrunt cache
  • make output_ica_task - show outputs from ica_task
Task Description
01 Installing Istio on a Kubernetes Cluster
RU · ES · FR · DE · GE · TW · JP
02 Dark Launch (Header-based routing)
RU · ES · FR · DE · GE · TW · JP
03 Fault Injection and Retry
RU · ES · FR · DE · GE · TW · JP
04 Zero Trust: mTLS and AuthorizationPolicy
RU · ES · FR · DE · GE · TW · JP
05 Controlled Egress: ServiceEntry, Egress Gateway and Sidecar scope
RU · ES · FR · DE · GE · TW · JP
06 Load Balancing and Traffic Mirroring
RU · ES · FR · DE · GE · TW · JP
07 Helm install and Canary upgrade with revisions
RU · ES · FR · DE · GE · TW · JP
08 Observability: Prometheus, Jaeger and Kiali
RU · ES · FR · DE · GE · TW · JP
09 Advanced: Ambient mode
RU · ES · FR · DE · GE · TW · JP
10 Resilience: Timeout and Circuit Breaker
RU · ES · FR · DE · GE · TW · JP
11 End-user authentication: RequestAuthentication and JWT
RU · ES · FR · DE · GE · TW · JP
12 Troubleshooting: istioctl analyze, proxy-status, proxy-config
RU · ES · FR · DE · GE · TW · JP
13 Securing Edge Traffic with TLS
RU · ES · FR · DE · GE · TW · JP
14 Locality-aware Failover
RU · ES · FR · DE · GE · TW · JP
15 Installation & Configuration: customizing the Istio install (IstioOperator + MeshConfig)
RU · ES · FR · DE · GE · TW · JP
16 Kubernetes Gateway API: ingress routing with Gateway and HTTPRoute
RU · ES · FR · DE · GE · TW · JP
17 Rate Limiting: local rate limit with EnvoyFilter
RU · ES · FR · DE · GE · TW · JP
18 Telemetry API: access logs and distributed tracing
RU · ES · FR · DE · GE · TW · JP
19 Custom CA: plug your own root and intermediate CA into istiod
RU · ES · FR · DE · GE · TW · JP
20 mTLS migration: PERMISSIVE to STRICT with zero downtime
RU · ES · FR · DE · GE · TW · JP
21 Sidecar scoping: limit the proxy configuration scope
RU · ES · FR · DE · GE · TW · JP
22 TLS origination: initiate TLS from the mesh
RU · ES · FR · DE · GE · TW · JP
23 WasmPlugin: extend the data plane with WebAssembly
RU · ES · FR · DE · GE · TW · JP
24 Ambient: waypoint proxy and L7 authorization
RU · ES · FR · DE · GE · TW · JP
25 Progressive delivery with Flagger
RU · ES · FR · DE · GE · TW · JP
26 Dynamic CA: cert-manager and istio-csr
RU · ES · FR · DE · GE · TW · JP
27 EnvoyFilter and Lua: custom logic with an inline script
RU · ES · FR · DE · GE · TW · JP
28 TCP routing: routing non-HTTP traffic
RU · ES · FR · DE · GE · TW · JP
29 Ingress TLS: MUTUAL and PASSTHROUGH modes
RU · ES · FR · DE · GE · TW · JP
30 StatefulSets and headless services in the mesh
RU · ES · FR · DE · GE · TW · JP
31 Zero-downtime production migration: ingress-nginx to Istio Gateway
RU · ES · FR · DE · GE · TW · JP
32 gRPC: per-request load balancing, port naming, retries and timeouts
RU · ES · FR · DE · GE · TW · JP
33 Control plane performance & operations: discovery selectors, Sidecar scope, istiod golden signals, OPA Gatekeeper
RU · ES · FR · DE · GE · TW · JP
34 Hardening & threat model: STRICT mTLS, default-deny, egress control, RBAC on Istio CRDs, OPA Gatekeeper, NetworkPolicy
RU · ES · FR · DE · GE · TW · JP
35 Multicluster mesh: multi-primary, multi-network, shared CA, east-west gateway, cross-cluster discovery
RU · ES · FR · DE · GE · TW · JP

EKS labs

  • TASK=01 make run_eks_task - create eks lab number 01
  • TASK=01 make delete_eks_task - delete eks hands-on labs
  • TASK=01 make run_eks_task_clean - run eks_task with clean terragrunt cache
  • make output_eks_task - show outputs from eks_task

Before deleting a lab, read the deletion section of that lab's README.MD. Labs that create AWS resources through in-cluster controllers (load balancers, Gateway API, VPC Lattice), through CSI drivers (EBS volumes, EFS access points), through AWS Backup (recovery points), or by hand via AWS CLI (IAM roles, security groups) need those removed first - terraform does not know about them, and destroy either hangs on Still destroying... or leaves resources that keep costing money.

If destroy fails halfway, re-running make delete_eks_task may abort with ... is a dependency of ... but detected no outputs: already destroyed modules have no outputs for the remaining configs to read. Finish the teardown module by module in reverse dependency order (recreate the env dir first, the Makefile removes it after a failed run):

mkdir -p terraform/environments/eks-labs
cp -r tasks/eks/labs/<NNN>/* terraform/environments/eks-labs/
export TF_VAR_STACK_TASK=<NNN> TF_VAR_STACK_NAME=eks-labs TF_VAR_USER_ID= TF_VAR_ENV_ID=
cd terraform/environments/eks-labs/eks_fargate_system && terragrunt destroy -auto-approve
cd ../eks_control_plane && terragrunt destroy -auto-approve
cd ../vpc && terragrunt destroy -auto-approve

TF_VAR_USER_ID and TF_VAR_ENV_ID must match the values used at creation time - they are part of the cluster name (eks<NNN>-<user>-<env>).

Task Description Solution
01 EKS lab 01 N/A
02 Karpenter Basics
ES · FR · DE · GE · TW · JP
N/A
03 Application Autoscaling with KEDA and Prometheus
ES · FR · DE · GE · TW · JP
N/A
04 Legacy EKS lab 04 (no README or solution file) N/A
101 Cluster as code: VPC, control plane, nodes, kubeconfig
RU · ES · FR · DE · GE · TW · JP
SOLUTION
102 Cluster access: IAM and RBAC, access entries and access policies
RU · ES · FR · DE · GE · TW · JP
SOLUTION
103 Address plan: ENI limits, prefix delegation, secondary CIDR
RU · ES · FR · DE · GE · TW · JP
SOLUTION
104 Workload identity: IRSA and Pod Identity for an application
RU · ES · FR · DE · GE · TW · JP
SOLUTION
105 Secrets: KMS envelope encryption and External Secrets Operator
RU · ES · FR · DE · GE · TW · JP
SOLUTION
106 EBS CSI: gp3, AZ binding, expansion, snapshot
RU · ES · FR · DE · GE · TW · JP
SOLUTION
107 EFS CSI: ReadWriteMany across availability zones
RU · ES · FR · DE · GE · TW · JP
SOLUTION
108 AWS Load Balancer Controller: NLB for a Service of type LoadBalancer
RU · ES · FR · DE · GE · TW · JP
SOLUTION
109 Ingress through ALB with an ACM certificate, external-dns and Route 53
RU · ES · FR · DE · GE · TW · JP
SOLUTION
110 NetworkPolicy in EKS: the built-in VPC CNI network policy
RU · ES · FR · DE · GE · TW · JP
SOLUTION
111 Spot nodes: diversification, interruption handling, graceful drain
RU · ES · FR · DE · GE · TW · JP
SOLUTION
112 Fargate profiles: what works, what breaks, cost comparison
RU · ES · FR · DE · GE · TW · JP
SOLUTION
113 Cluster upgrade and rollback: control plane, add-ons, deprecated APIs
RU · ES · FR · DE · GE · TW · JP
SOLUTION
114 Observability: Container Insights and Managed Prometheus with Grafana
RU · ES · FR · DE · GE · TW · JP
SOLUTION
115 Logging: Fluent Bit to CloudWatch Logs, filtering and retention
RU · ES · FR · DE · GE · TW · JP
SOLUTION
116 Hardening: IMDSv2 and hop limit, Pod Security Admission, private endpoint
RU · ES · FR · DE · GE · TW · JP
SOLUTION
117 Traffic and cost: per-AZ NAT vs. a single NAT, VPC endpoints, cross-AZ
RU · ES · FR · DE · GE · TW · JP
SOLUTION
118 GitOps: Argo CD, drift and self-heal, sync waves, prune
RU · ES · FR · DE · GE · TW · JP
SOLUTION
119 Troubleshooting: node not reaching Ready (IAM, SG, user data, kubelet)
RU · ES · FR · DE · GE · TW · JP
SOLUTION
120 Troubleshooting: broken networking and unhealthy load balancer targets
RU · ES · FR · DE · GE · TW · JP
SOLUTION
121 Troubleshooting: access denied (access entries, IRSA, RBAC)
RU · ES · FR · DE · GE · TW · JP
SOLUTION
122 AWS Backup for EKS: composite recovery point, namespace restore
RU · ES · FR · DE · GE · TW · JP
SOLUTION
123 Karpenter: NodePool, consolidation, drift and safe StatefulSet eviction
RU · ES · FR · DE · GE · TW · JP
SOLUTION
124 Application autoscaling: HPA, KEDA and a Prometheus trigger
RU · ES · FR · DE · GE · TW · JP
SOLUTION
125 EKS Auto Mode versus your own stack: built-in node pools, no node access
RU · ES · FR · DE · GE · TW · JP
SOLUTION
126 Security groups for pods: branch ENI, pod Running but never Ready
RU · ES · FR · DE · GE · TW · JP
SOLUTION
127 Policies without an extra controller: ValidatingAdmissionPolicy on CEL
RU · ES · FR · DE · GE · TW · JP
SOLUTION
128 Gateway API in AWS: ALB Gateway API and VPC Lattice, ReferenceGrant
RU · ES · FR · DE · GE · TW · JP
SOLUTION
129 Mountpoint for S3: where file semantics break and why there is no snapshot
RU · ES · FR · DE · GE · TW · JP
SOLUTION
130 ECR and supply chain: immutable tags, scan on push, pull through cache
RU · ES · FR · DE · GE · TW · JP
SOLUTION
131 Reliability: PDB blocks drain, topology spread, unhealthyPodEvictionPolicy
RU · ES · FR · DE · GE · TW · JP
SOLUTION
132 Alternative CNI: Cilium in CNI chaining over VPC CNI, L7 and FQDN policy, Hubble
RU · ES · FR · DE · GE · TW · JP
SOLUTION

AWS mock exams

Task Description Solution
01 AWS Certified AI Practitioner mock exam