S
Certified Kubernetes Administrator (CKA) ACTUAL
PERFORMANCE TASK SIMULATION 2026/2027 | Hands-
On kubectl Tasks | No Multiple Choice | Exam Environment
Simulation | Pass Guaranteed - A+ Graded
Cluster Architecture, Installation & Configuration (Tasks 1-4)
Task 1: Create a new ClusterRole named pod-reader that grants read-only access (get, list,
watch) to pods in all namespaces. Then bind this ClusterRole to the user jane in the development
namespace using a RoleBinding named jane-read-pods.
Correct Solution:
bash
Copy
kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods
kubectl create rolebinding jane-read-pods --clusterrole=pod-reader --user=jane -n development
Task 2: You have a kubeadm-managed cluster running v1.28.2. Upgrade the control plane node
to Kubernetes v1.29.0 with minimal downtime. The upgrade must be performed using kubeadm
and kubelet. Assume you are on the control plane node.
Correct Solution:
bash
Copy
# Drain the control plane node (if not already done)
kubectl drain control-plane-node --ignore-daemonsets
# Upgrade kubeadm
apt-mark unhold kubeadm && apt-get update && apt-get install -y kubeadm=1.29.0-00 && apt-
mark hold kubeadm
, S
# Verify upgrade plan and apply
kubeadm upgrade plan
kubeadm upgrade apply v1.29.0
# Upgrade kubelet and kubectl
apt-mark unhold kubelet kubectl && apt-get update && apt-get install -y kubelet=1.29.0-00
kubectl=1.29.0-00 && apt-mark hold kubelet kubectl
# Restart kubelet
systemctl daemon-reload
systemctl restart kubelet
# Uncordon the node
kubectl uncordon control-plane-node
Task 3: Create an etcd snapshot backup of the cluster's etcd data and save it to /var/lib/etcd-
backup/etcd-snapshot-$(date +%Y%m%d).db. The etcd endpoint is https://127.0.0.1:2379 and
the certificates are located at /etc/kubernetes/pki/etcd/.
Correct Solution:
bash
Copy
ETCDCTL_API=3 etcdctl snapshot save /var/lib/etcd-backup/etcd-snapshot-$(date
+%Y%m%d).db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key
Certified Kubernetes Administrator (CKA) ACTUAL
PERFORMANCE TASK SIMULATION 2026/2027 | Hands-
On kubectl Tasks | No Multiple Choice | Exam Environment
Simulation | Pass Guaranteed - A+ Graded
Cluster Architecture, Installation & Configuration (Tasks 1-4)
Task 1: Create a new ClusterRole named pod-reader that grants read-only access (get, list,
watch) to pods in all namespaces. Then bind this ClusterRole to the user jane in the development
namespace using a RoleBinding named jane-read-pods.
Correct Solution:
bash
Copy
kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods
kubectl create rolebinding jane-read-pods --clusterrole=pod-reader --user=jane -n development
Task 2: You have a kubeadm-managed cluster running v1.28.2. Upgrade the control plane node
to Kubernetes v1.29.0 with minimal downtime. The upgrade must be performed using kubeadm
and kubelet. Assume you are on the control plane node.
Correct Solution:
bash
Copy
# Drain the control plane node (if not already done)
kubectl drain control-plane-node --ignore-daemonsets
# Upgrade kubeadm
apt-mark unhold kubeadm && apt-get update && apt-get install -y kubeadm=1.29.0-00 && apt-
mark hold kubeadm
, S
# Verify upgrade plan and apply
kubeadm upgrade plan
kubeadm upgrade apply v1.29.0
# Upgrade kubelet and kubectl
apt-mark unhold kubelet kubectl && apt-get update && apt-get install -y kubelet=1.29.0-00
kubectl=1.29.0-00 && apt-mark hold kubelet kubectl
# Restart kubelet
systemctl daemon-reload
systemctl restart kubelet
# Uncordon the node
kubectl uncordon control-plane-node
Task 3: Create an etcd snapshot backup of the cluster's etcd data and save it to /var/lib/etcd-
backup/etcd-snapshot-$(date +%Y%m%d).db. The etcd endpoint is https://127.0.0.1:2379 and
the certificates are located at /etc/kubernetes/pki/etcd/.
Correct Solution:
bash
Copy
ETCDCTL_API=3 etcdctl snapshot save /var/lib/etcd-backup/etcd-snapshot-$(date
+%Y%m%d).db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key
