Kubernetes

Author Pod, Deployment and Service manifests and reason about scheduling.

45 challenges · 11 easy · 23 medium · 11 pro

• Author a Jobeasy · in-browser
  Write /home/player/job.yaml: a batch Job named import, restartPolicy Never, container image busybox. (No cluster here — authored manifest, graded structurally.)
• Author a Namespaceeasy
  No cluster here — author /home/player/namespace.yaml: a Kubernetes Namespace named staging.
• Author a PersistentVolumeClaimeasy · in-browser
  Write /home/player/pvc.yaml: a PersistentVolumeClaim named data, accessMode ReadWriteOnce, requesting 1Gi storage. (No cluster here — authored manifest, graded structurally.)
• Author a PriorityClasseasy · in-browser
  Write /home/player/pc.yaml: a PriorityClass named high with value 1000000. (No cluster here — authored manifest, graded structurally.)
• Author an Immutable ConfigMapeasy · in-browser
  Write /home/player/cm.yaml: a ConfigMap named app-settings that is marked immutable: true and contains two data keys — LOG_LEVEL with value info and MAX_CONN with value 100. (Authored config, graded structurally — the engine isn't run here.)
• Author an Opaque Secreteasy · in-browser
  Write /home/player/secret.yaml: a Secret named db-cred, type Opaque, with a data key 'password'. (No cluster here — authored manifest, graded structurally.)
• Pin a Deployment to a namespaceeasy · in-browser
  Write /home/player/d.yaml: a Deployment web with metadata.namespace set to prod. (No cluster here — authored manifest, graded structurally.)
• Schedule a Pod with nodeSelectoreasy · in-browser
  Write /home/player/pod.yaml: a Pod named gpu-job running image cuda that is constrained to nodes carrying the label disktype: ssd using nodeSelector. (Authored config, graded structurally — the engine isn't run here.)
• Service of Type NodePorteasy · in-browser
  Write /home/player/svc.yaml: a Service named web-np of type NodePort that selects pods with label app: web, exposing port 80 forwarding to targetPort 8080 on nodePort 30080. (Authored config, graded structurally — the engine isn't run here.)
• Share Data with an emptyDir Volumeeasy · in-browser
  Write /home/player/pod.yaml: a Pod named cache running image redis with an emptyDir volume named scratch mounted at /data inside the container. (Authored config, graded structurally — the engine isn't run here.)
• Write a Kubernetes Deployment manifesteasy
  There is no cluster here — this is about getting the YAML right. Create /home/player/deployment.yaml describing a Kubernetes Deployment named 'web': apiVersion apps/v1, 3 replicas, one container named 'web' using image nginx:1.27, exposing containerPort 80.
• A Parallel Completion Jobmedium · in-browser
  Write /home/player/job.yaml: a Job named batch that needs 6 successful completions running 3 at a time (parallelism), retries up to backoffLimit 4, and runs a container with image busybox and restartPolicy Never. (Authored config, graded structurally — the engine isn't run here.)
• Add a tolerationmedium · in-browser
  Write /home/player/pod.yaml: a Pod tolerating taint key dedicated, effect NoSchedule. (No cluster here — authored manifest, graded structurally.)
• Add an initContainermedium · in-browser
  Write /home/player/pod.yaml: a Pod web (image nginx:1.27) with an initContainers entry running busybox. (No cluster here — authored manifest, graded structurally.)
• Author a CronJobmedium · in-browser
  Write /home/player/cron.yaml: a CronJob named report, schedule '0 0 * * *', whose job runs a container using image busybox. (No cluster here — authored manifest, graded structurally.)
• Author a DaemonSetmedium · in-browser
  Write /home/player/ds.yaml: a DaemonSet named node-agent running container image busybox. (No cluster here — authored manifest, graded structurally.)
• Author a HorizontalPodAutoscalermedium · in-browser
  Write /home/player/hpa.yaml: an HPA targeting Deployment web, min 2, max 10 replicas, scaling on 80% CPU. (No cluster here — authored manifest, graded structurally.)
• Author a LimitRangemedium · in-browser
  Write /home/player/lr.yaml: a LimitRange named defaults with a Container default cpu 500m and memory 256Mi. (No cluster here — authored manifest, graded structurally.)
• Author a PodDisruptionBudgetmedium · in-browser
  Write /home/player/pdb.yaml: a PodDisruptionBudget minAvailable 1 selecting pods with app=web. (No cluster here — authored manifest, graded structurally.)
• Author a ResourceQuotamedium · in-browser
  Write /home/player/rq.yaml: a ResourceQuota named compute with hard requests.cpu 4 and requests.memory 8Gi. (No cluster here — authored manifest, graded structurally.)
• Author a Standalone PodTemplatemedium · in-browser
  Write /home/player/tpl.yaml: a PodTemplate named worker-template whose embedded pod template carries the label role: worker and runs a single container named worker using image alpine. (Authored config, graded structurally — the engine isn't run here.)
• Author a StorageClassmedium · in-browser
  Write /home/player/sc.yaml: a StorageClass named fast, any provisioner, reclaimPolicy Retain, volumeBindingMode WaitForFirstConsumer. (No cluster here — authored manifest, graded structurally.)
• Author an Ingressmedium · in-browser
  Write /home/player/ingress.yaml: an Ingress named web routing host app.example.com path / to service web on port 80. (No cluster here — authored manifest, graded structurally.)
• Drop Capabilities and Block Privilege Escalationmedium · in-browser
  Write /home/player/pod.yaml: a Pod named hardened running image nginx whose container securityContext sets allowPrivilegeEscalation to false and drops ALL Linux capabilities then adds back only NET_BIND_SERVICE. (Authored config, graded structurally — the engine isn't run here.)
• Env from a Secretmedium · in-browser
  Write /home/player/d.yaml: a Deployment api whose container loads all env vars from a Secret via envFrom secretRef name db-cred. (No cluster here — authored manifest, graded structurally.)
• Headless Servicemedium · in-browser
  Write /home/player/svc.yaml: a Service named db with clusterIP: None selecting app=db on port 5432. (No cluster here — authored manifest, graded structurally.)
• Inject a ConfigMap with envFrommedium · in-browser
  Write /home/player/pod.yaml: a Pod named app running image nginx whose single container loads ALL keys from a ConfigMap named app-config as environment variables using envFrom (configMapRef), with a prefix of APP_. (Authored config, graded structurally — the engine isn't run here.)
• Mount a ConfigMap as a volumemedium · in-browser
  Write /home/player/pod.yaml: a Pod that mounts a ConfigMap app-config as a volume at /etc/app. (No cluster here — authored manifest, graded structurally.)
• Mount a hostPath Volumemedium · in-browser
  Write /home/player/pod.yaml: a Pod named log-reader running image busybox with a hostPath volume named varlog pointing at host path /var/log of type Directory, mounted read-only at /host/var/log in the container. (Authored config, graded structurally — the engine isn't run here.)
• Multi-Port ClusterIP Servicemedium · in-browser
  Write /home/player/svc.yaml: a ClusterIP Service named api that selects app: api and exposes two named ports — a port named http on 80 (targetPort 8080) and a port named metrics on 9090 (targetPort 9090). (Authored config, graded structurally — the engine isn't run here.)
• Object-Count ResourceQuotamedium · in-browser
  Write /home/player/quota.yaml: a ResourceQuota named obj-limits capping the namespace at no more than 10 pods, 5 services, and 4 secrets via its hard limits. (Authored config, graded structurally — the engine isn't run here.)
• Set container resource limitsmedium · in-browser
  Write /home/player/deploy.yaml: a Deployment whose container sets resources requests (cpu 100m, memory 128Mi) and limits (cpu 500m, memory 256Mi). (No cluster here — authored manifest, graded structurally.)
• Tune a Deployment Rolling Updatemedium · in-browser
  Write /home/player/deploy.yaml: a Deployment named web with 4 replicas whose update strategy is RollingUpdate configured with maxSurge 1 and maxUnavailable 0, running a single container with image nginx:1.27. (Authored config, graded structurally — the engine isn't run here.)
• Write a Kubernetes Servicemedium
  No cluster here — author /home/player/service.yaml: a Service named web, type ClusterIP, port 80 forwarding to targetPort 8080, selecting pods with label app=web.
• Add liveness & readiness probespro
  Author /home/player/deploy.yaml: a Deployment named api whose container has BOTH a livenessProbe and a readinessProbe, each an httpGet on path /healthz, port 8080.
• Author ServiceAccount + RBACpro · in-browser
  Write /home/player/rbac.yaml with THREE documents (--- separated): a ServiceAccount ci, a Role pod-reader (get/list pods), and a RoleBinding binding them. (No cluster here — authored manifest, graded structurally.)
• Author a StatefulSetpro · in-browser
  Write /home/player/sts.yaml: a StatefulSet named db, serviceName db, 3 replicas, with a volumeClaimTemplates entry. (No cluster here — authored manifest, graded structurally.)
• Author a default-deny NetworkPolicypro · in-browser
  Write /home/player/np.yaml: a NetworkPolicy that selects all pods (empty podSelector) and denies all ingress. (No cluster here — authored manifest, graded structurally.)
• Combine Sources in a Projected Volumepro · in-browser
  Write /home/player/pod.yaml: a Pod named auth running image nginx with a single projected volume named bundle mounted at /etc/bundle, whose sources combine a ConfigMap named ca-config and the pod's serviceAccountToken (with audience api and expirationSeconds 3600). (Authored config, graded structurally — the engine isn't run here.)
• Graceful Shutdown with a preStop Hookpro · in-browser
  Write /home/player/pod.yaml: a Pod named graceful running image nginx with terminationGracePeriodSeconds 60 and a container lifecycle preStop exec hook whose command runs nginx with the -s quit signal (the command is a list, e.g. [nginx, -s, quit]). (Authored config, graded structurally — the engine isn't run here.)
• Harden a Pod securityContextpro · in-browser
  Write /home/player/pod.yaml: a Pod with securityContext runAsNonRoot true, runAsUser 1000, and a container readOnlyRootFilesystem true. (No cluster here — authored manifest, graded structurally.)
• Node affinitypro · in-browser
  Write /home/player/d.yaml: a Deployment with requiredDuringSchedulingIgnoredDuringExecution nodeAffinity on label disktype=ssd. (No cluster here — authored manifest, graded structurally.)
• Spread Pods Across Zonespro · in-browser
  Write /home/player/pod.yaml: a Pod named web labelled app: web that uses a topologySpreadConstraints rule with maxSkew 1 over the topologyKey topology.kubernetes.io/zone, whenUnsatisfiable DoNotSchedule, matching pods with label app: web. (Authored config, graded structurally — the engine isn't run here.)
• Two-container Pod (sidecar)pro · in-browser
  Write /home/player/pod.yaml: a Pod web with TWO containers — app (nginx:1.27) and a sidecar named logger (busybox) sharing an emptyDir volume. (No cluster here — authored manifest, graded structurally.)
• Wire a ConfigMap into a Podpro
  In /home/player/app.yaml put TWO YAML documents (separated by ---): a ConfigMap named app-config with a key GREETING, and a Pod named web (image nginx:1.27) that exposes GREETING as an environment variable sourced from that ConfigMap.