Skip to content
CKADServices and NetworkingSingle nodeMedium

Ingress with two paths and TLS

Scenario ckad-net-003 · about 8 minutes · 9 points · 9 grader checks

Expose two Services under one host with path-based Ingress rules and terminate TLS with a certificate Secret.

  • ingress
  • tls
  • secret
  • path-routing
  • networking

What you will practise

  • Create a kubernetes.io/tls Secret from files
  • Write an Ingress with several path rules
  • Add a tls section to an Ingress

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ckad-net-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In namespace "media" two applications run behind ClusterIP Services: "books-svc" and "music-svc" (both port 80). The ingress-nginx controller is installed (IngressClass "nginx"). On the control plane node exam-cp1 a certificate and key for media.example.com are stored in /opt/certs/media.crt and /opt/certs/media.key. 1. Create a TLS Secret "media-tls" in namespace "media" from that certificate and key. 2. Create an Ingress "media" in namespace "media" with ingressClassName "nginx" for the host media.example.com that - routes path /books (pathType Prefix) to books-svc port 80, - routes path /music (pathType Prefix) to music-svc port 80, - terminates TLS for media.example.com with the Secret "media-tls". The ingress controller must serve that certificate for media.example.com.

Requirements and details

Certification
CKAD · Certified Kubernetes Application Developer
Domain
Services and Networking
Difficulty
Medium
Cluster topology
Single node
Cluster features
Ingress
Recommended time
8 minutes
Points
9
Grader checks
9
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 9 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Services and Networking labs

CKADServices and NetworkingEasy

Expose a Deployment with ClusterIP and NodePort Services

Expose the same pods through a ClusterIP Service with port mapping and a NodePort Service on a fixed node port.

Single node · ~6 min · 9 points

  • service
  • clusterip
  • nodeport
  • endpoints

goldenkube start ckad-net-001

CKADServices and NetworkingMedium

NetworkPolicy: default deny plus one allowed client

Lock down a namespace with a default-deny ingress policy and allow a single client label to reach an API on one port.

Single node · ~8 min · 8 points

  • networkpolicy
  • default-deny
  • ingress
  • labels
  • networking

goldenkube start ckad-net-002

CKADServices and NetworkingEasy

Service with no working endpoints

Find why a Service does not reach the pods of a healthy Deployment and fix the Service.

Single node · ~6 min · 7 points

  • service
  • troubleshooting
  • selectors
  • endpoints

goldenkube start ckad-net-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.