CKA Lernplan: In 8 Wochen zur Zertifizierung

# Lokalen Cluster mit kind aufsetzen
cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
  - role: worker
EOF

# etcd-Backup erstellen
ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# etcd Restore
ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-backup.db \
  --data-dir=/var/lib/etcd-restored

# kubeadm-Upgrade-Prozess (Control Plane)
kubeadm upgrade plan
kubeadm upgrade apply v1.30.0

# Worker Node upgraden
kubectl cordon worker-1
kubectl drain worker-1 --ignore-daemonsets --delete-emptydir-data
# Auf dem Worker: kubeadm upgrade node, kubelet neu starten
kubectl uncordon worker-1

# Deployment erstellen und skalieren
kubectl create deployment nginx --image=nginx:1.27 --replicas=3
kubectl scale deployment nginx --replicas=5

# Rolling Update und Rollback
kubectl set image deployment/nginx nginx=nginx:1.28
kubectl rollout status deployment/nginx
kubectl rollout undo deployment/nginx

# Job und CronJob
kubectl create job backup --image=busybox -- /bin/sh -c "echo done"
kubectl create cronjob daily-backup --image=busybox \
  --schedule="0 2 * * *" -- /bin/sh -c "echo backup"

# Node Labels und Taints
kubectl label nodes worker-1 disktype=ssd
kubectl taint nodes worker-1 dedicated=gpu:NoSchedule
kubectl taint nodes worker-1 dedicated=gpu:NoSchedule-  # entfernen

# Pod mit Node Affinity und Toleration
apiVersion: v1
kind: Pod
metadata:
  name: scheduled-pod
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: disktype
                operator: In
                values:
                  - ssd
  tolerations:
    - key: "dedicated"
      operator: "Equal"
      value: "gpu"
      effect: "NoSchedule"
  containers:
    - name: app
      image: nginx:1.27
      resources:
        requests:
          cpu: "500m"
          memory: "256Mi"
        limits:
          cpu: "1"
          memory: "512Mi"

# Services erstellen
kubectl expose deployment webapp --port=80 --type=ClusterIP
kubectl expose deployment webapp --port=80 --type=NodePort

# DNS testen
kubectl run dns-test --image=busybox:1.36 --rm -it --restart=Never \
  -- nslookup webapp.default.svc.cluster.local

# Ingress-Ressource
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: webapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webapp
                port:
                  number: 80
---
# NetworkPolicy: Default Deny und selektive Freigabe
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

# PersistentVolume und PVC
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-storage
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual
  hostPath:
    path: /mnt/data
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-app
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: manual
  resources:
    requests:
      storage: 5Gi
---
# Pod mit PVC
apiVersion: v1
kind: Pod
metadata:
  name: app-with-storage
spec:
  containers:
    - name: app
      image: nginx:1.27
      volumeMounts:
        - name: data
          mountPath: /usr/share/nginx/html
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: pvc-app

# Systematischer Troubleshooting-Workflow

# 1. Cluster-Status
kubectl get nodes
kubectl cluster-info

# 2. Node-Probleme
kubectl describe node worker-1
systemctl status kubelet
journalctl -u kubelet -f

# 3. Pod-Probleme
kubectl get pods -A -o wide
kubectl describe pod problem-pod
kubectl logs problem-pod
kubectl logs problem-pod --previous

# 4. Netzwerk-Debugging
kubectl run debug --image=busybox:1.36 --rm -it --restart=Never \
  -- wget -qO- http://service-name:80

# Haeufige Fehler:
# CrashLoopBackOff -> Logs pruefen, Command/Entrypoint
# ImagePullBackOff -> Image-Name, Registry, Pull-Secret
# Pending -> Resources, Taints, NodeSelector
# ContainerCreating -> Volumes, Secrets, ConfigMaps

# Pruefungsumgebung vorbereiten (am Pruefungstag als Erstes)
alias k=kubectl
export do="--dry-run=client -o yaml"
export now="--force --grace-period=0"
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

cat << 'EOF' > ~/.vimrc
set tabstop=2
set shiftwidth=2
set expandtab
set number
set autoindent
EOF