Bootstrap multi-node production clusters with kubeadm, configure control plane high availability, manage certificates, and secure etcd disaster recovery snapshots.
Syllabus Mastery Objectives:
Bootstrap a production-grade multi-node Kubernetes cluster using kubeadm on Linux instances.
Perform automated and manual etcd snapshots with etcdctl and execute full cluster state restorations.
Configure control plane high availability, TLS certificate rotations (kubeadm certs), and API server admission flags.
Manage RBAC authorization: Roles, ClusterRoles, RoleBindings, and ServiceAccounts.
Hands-On Operational Lab Challenge:
Simulate a catastrophic control plane failure by destroying the etcd data directory on a multi-node cluster, then restore cluster operational state from an encrypted snapshot while verifying pod persistence.
Tooling:kubeadm init / joinetcdctl snapshot save / restorekubeadm certs check-expirationkubectl create role / rolebinding
Step 02·15% of Domain Scope · Placement & Resource Governors
Workloads & Scheduling Constraints
Enforce node affinities, pod anti-affinities, taints, tolerations, topology spread constraints, and namespace-level ResourceQuotas.
Syllabus Mastery Objectives:
Configure node affinity, pod anti-affinity, and pod topology spread constraints across availability zones.
Enforce node taints, tolerations, and nodeSelectors for isolated workloads.
Define resource requests, limits, LimitRanges, and namespace-level ResourceQuotas.
Manage application controllers: Deployments, StatefulSets, DaemonSets, and CronJobs.
Hands-On Operational Lab Challenge:
Schedule a critical stateful workload with strict pod anti-affinity across three worker nodes, configure taints for dedicated GPU workloads, and prevent unreserved pods from being placed on specialized hardware.
Configure ClusterIP, NodePort, and LoadBalancer services with named target ports and selectors.
Deploy Ingress Controllers (NGINX Ingress) with path-based routing and TLS secret termination.
Implement fine-grained NetworkPolicies isolating frontend, backend, and database namespaces.
Hands-On Operational Lab Challenge:
Enforce a default-deny NetworkPolicy in a production namespace and author granular ingress rules allowing HTTP traffic strictly from a designated frontend service on port 8080.
Tooling:NetworkPolicy (ingress/egress CIDR & podSelector)CoreDNS ConfigMap & DNS lookup verificationIngress manifests with cert-manager TLSkubectl get endpoints / ep
Provision PersistentVolumes (PV) with specific access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany.
Configure PersistentVolumeClaims (PVC) with storage capacity requests and selector bindings.
Define dynamic StorageClasses utilizing volume provisioners with reclaim policies (Delete vs. Retain).
Manage volume mounts, subPath expressions, and dynamic volume expansion.
Hands-On Operational Lab Challenge:
Provision a high-availability persistent storage backend with dynamic volume provisioning, attach persistent volumes to a stateful database deployment, and safely expand the storage volume without container downtime.
Step 05·30% of Domain Scope · Systems Engineering Diagnostics
Cluster Troubleshooting, Upgrades & Maintenance
Diagnose worker node failure modes with kubelet/journalctl, safely drain/cordon nodes for maintenance, and execute sequential minor version upgrades.
Syllabus Mastery Objectives:
Diagnose worker node failure modes: Kubelet systemd services, container runtime (containerd) crashes, and disk pressure.
Safely drain, cordon, and uncordon nodes during rolling cluster OS maintenance.
Perform minor version cluster upgrades utilizing kubeadm, kubelet, and kubectl in sequential order.
Extract and analyze container crash logs, liveness/readiness probe failures, and OOMKilled events.
Hands-On Operational Lab Challenge:
Perform a zero-downtime rolling cluster upgrade from v1.30 to v1.31 across control plane and worker nodes, followed by diagnosing and reviving a broken worker node with a corrupted kubelet configuration file.