Exam-style tasks for the performance-based certifications, run on a real kubeadm cluster on your own Mac with the GoldenKube CLI and graded locally. Each card shows the task's domain, the cluster topology it needs, the recommended time and its points; the detail page has the full task text.
37 published scenarios
Grant a ServiceAccount read access to pods in one namespace using a Role and a RoleBinding.
Single node · ~6 min · 6 points
goldenkube start cka-arc-001
Grant a namespaced ServiceAccount cluster-wide read access to nodes using a ClusterRole and ClusterRoleBinding.
Single node · ~6 min · 6 points
goldenkube start cka-arc-002
Take a snapshot of the cluster's etcd datastore and store it as a file on the control plane node.
Single node · ~8 min · 6 points
goldenkube start cka-arc-003
Create a ServiceAccount and a controller-populated long-lived token Secret bound to it.
Single node · ~6 min · 5 points
goldenkube start cka-arc-004
Run a Pod directly through the kubelet by placing a manifest in the static pod directory.
Single node · ~7 min · 6 points
goldenkube start cka-arc-005
Safely take a worker node out of service by cordoning it and evicting its workload pods without deleting the node.
Two nodes · ~7 min · 7 points
goldenkube start cka-arc-006
Add a chart repository and install a chart as a named release into a namespace using Helm.
Single node · ~10 min · 7 points
goldenkube start cka-arc-007
Create a non-default PriorityClass and run a Pod that uses it.
Single node · ~6 min · 5 points
goldenkube start cka-arc-008
Expose an existing Deployment inside the cluster with a ClusterIP Service that selects all its pods.
Two nodes · ~6 min · 5 points
goldenkube start cka-net-001
Expose a Deployment outside the cluster with a NodePort Service on a specific node port.
Two nodes · ~6 min · 5 points
goldenkube start cka-net-002
Restrict ingress to database pods so only client pods may reach them on a single TCP port.
Two nodes · ~9 min · 7 points
goldenkube start cka-net-003
Create an Ingress that routes a hostname and path prefix to an existing Service through the nginx IngressClass.
Two nodes · ~8 min · 7 points · Ingress
goldenkube start cka-net-004
Attach an HTTPRoute to an existing Gateway so a path prefix is routed to a Service.
Two nodes · ~9 min · 7 points · Gateway API
goldenkube start cka-net-005
Create a headless Service (clusterIP None) that selects an existing Deployment's pods.
Two nodes · ~6 min · 5 points
goldenkube start cka-net-006
Expose a Deployment on a Service port that differs from the container port.
Two nodes · ~6 min · 5 points
goldenkube start cka-net-007
Taint a worker node and run a Pod that tolerates the taint and is placed on that node.
Two nodes · ~7 min · 6 points
goldenkube start cka-sch-001
Create a Deployment whose replicas are guaranteed to land on different nodes.
Three nodes · ~8 min · 6 points
goldenkube start cka-sch-002
Create a PersistentVolumeClaim on a named StorageClass and mount it in a Pod.
Single node · ~7 min · 6 points · Storage
goldenkube start cka-sto-001
Create a hostPath PersistentVolume and a PersistentVolumeClaim that binds to it.
Single node · ~7 min · 6 points
goldenkube start cka-sto-002
Make an existing StorageClass the cluster default and provision a PVC without naming a class.
Single node · ~8 min · 6 points · Storage
goldenkube start cka-sto-003
Create a headless Service and a StatefulSet whose pod gets its own dynamically provisioned PVC.
Two nodes · ~10 min · 7 points · Storage
goldenkube start cka-sto-004
A worker node reports NotReady; diagnose and restore it without recreating the node.
Two nodes · ~7 min · 7 points
goldenkube start cka-trb-001
The kubelet on a worker refuses to start; find the misconfiguration and fix it on the node.
Two nodes · ~8 min · 7 points
goldenkube start cka-trb-002
kubectl cannot reach the cluster; repair the API server from the control plane node.
Single node · ~8 min · 8 points
goldenkube start cka-trb-003
A worker is NotReady although its kubelet runs; find the underlying runtime problem and fix it.
Two nodes · ~6 min · 6 points
goldenkube start cka-trb-004
Service name resolution has stopped working; investigate and restore the cluster DNS component.
Two nodes · ~5 min · 5 points
goldenkube start cka-trb-005
A Service forwards nowhere; find the mismatch and fix the Service only.
Two nodes · ~6 min · 6 points
goldenkube start cka-trb-006
A Deployment pinned to one node cannot schedule; find the node-level cause and fix it.
Two nodes · ~5 min · 6 points
goldenkube start cka-trb-007
A Deployment's containers keep exiting; find out why and make them stay running.
Single node · ~6 min · 6 points
goldenkube start cka-trb-008
A Deployment's pods cannot pull their image; correct the image and get the replicas Ready.
Single node · ~5 min · 5 points
goldenkube start cka-trb-009
Create a multi-replica Deployment with a memory request and a declared container port.
Single node · ~5 min · 4 points
goldenkube start cka-wkl-001
Update the image of a running Deployment with a rolling update and confirm all pods run the new image.
Single node · ~4 min · 4 points
goldenkube start cka-wkl-002
Create a ConfigMap and a Secret and consume them from a Pod as an environment variable and a mounted volume.
Single node · ~8 min · 6 points
goldenkube start cka-wkl-003
Run one Pod per node, including the control plane, with a DaemonSet.
Two nodes · ~6 min · 5 points
goldenkube start cka-wkl-004
Pin a Pod to nodes with a given label using required node affinity rather than a nodeSelector.
Two nodes · ~6 min · 5 points
goldenkube start cka-wkl-005
Create a Pod whose resource settings place it in the Guaranteed QoS class.
Single node · ~4 min · 4 points
goldenkube start cka-wkl-006
Run a batch Job that must complete a fixed number of times with limited parallelism.
Single node · ~5 min · 4 points
goldenkube start cka-wkl-007
goldenkube doctor.goldenkube login (free account).goldenkube submit.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.