CKA Cheat Sheet 2026

The 30 highest-yield CKA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. You are upgrading a node's kubelet. What must you do immediately after installing the new kubelet package? → Reload systemd daemon and restart kubelet (daemon-reload && systemctl restart kubelet)
2. What is a Pod in Kubernetes? → The smallest deployable unit that can contain one or more containers
3. You want to create a ConfigMap from a directory of config files. Which command accomplishes this? → kubectl create configmap myconfig --from-file=./config-dir/
4. Which etcd operation should be performed before upgrading the Kubernetes control plane? → etcd snapshot backup
5. Which Service type allows external access to a Kubernetes application through a specific port on each node in the cluster? → NodePort
6. An AppArmor profile is applied to a container using which mechanism in Kubernetes? → An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/`
7. Which ConfigMap in the kube-system namespace stores the kubeadm cluster configuration? → kubeadm-config
8. Which kubeadm command is run on a worker node during a cluster upgrade (after the control plane is already upgraded)? → kubeadm upgrade node
9. Which Kubernetes object defines the permissions granted by a ClusterRole to a set of users across all namespaces? → ClusterRoleBinding
10. Which NetworkPolicy `podSelector: {}` (empty) in the spec means? → All Pods in the namespace are selected
11. Which type of workload should you use for a Pod that must run on every node in a Kubernetes cluster? → DaemonSet
12. Which command displays only the last 50 lines of logs from pod 'api'? → kubectl logs api --tail=50
13. What is a ConfigMap? → An object storing non-confidential configuration data as key-value pairs
14. What is a Persistent Volume (PV)? → A storage resource in the cluster provisioned independently of Pod lifecycle
15. How do you restrict communication between Pods in a Kubernetes cluster? → By using Network Policies.
16. What does 'kubectl get pods' show? → A list of all Pods and their status in the current namespace
17. What is the correct order of operations when upgrading a multi-node Kubernetes cluster using kubeadm? → Upgrade control plane first, then drain and upgrade each worker
18. What is a Kubernetes Deployment? → A resource that manages ReplicaSets and provides declarative updates for Pods
19. What does the `ipBlock` field in a NetworkPolicy ingress rule define? → A CIDR range of IP addresses allowed or denied as traffic sources
20. A Pod needs to reach an external hostname 'db.example.com'. Which DNS resolution path does it use by default? → The cluster DNS (CoreDNS) which then forwards to upstream resolvers
21. Which of the following ensures that Pods run with restricted permissions in Kubernetes? → Security Context
22. Which Kubernetes resource is used to securely store sensitive data like API keys and passwords? → Secret
23. What happens when a Service's label selector matches no running pods? → The Endpoints object has no entries and traffic to the service is dropped
24. A `postStart` hook fails. What does Kubernetes do to the container? → Kills and restarts the container
25. You set a Deployment's strategy type to Recreate. What happens during an update? → Old pods are terminated before new pods are created
26. What is the primary purpose of an Ingress resource in Kubernetes? → To manage HTTP/HTTPS routing from outside the cluster to internal services
27. How is Secret data stored in etcd by default in a Kubernetes cluster? → Base64-encoded but not encrypted
28. What field in a projected volume allows you to combine a ConfigMap and a Secret into a single volume mount path? → projected.sources
29. Which object automatically tracks the IP addresses and ports of Pods backing a Service in large clusters (1000+ endpoints)? → EndpointSlices
30. What flag in kubeadm init allows you to specify the pod network CIDR? → --pod-network-cidr