Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
A Deployment running a distroless Chainguard nginx image (cgr.dev/chainguard/nginx) is deployed in the namespace webapps, fronted by a ClusterIP Service. Port-forward that Service to localhost port 3333 on cplane-01, use curl to save the response body to /home/laborant/index.html, and verify the file is accessible and contains the expected content.
Use kubectl proxy to open a local, already authenticated HTTP endpoint to the Kubernetes API server, then use curl to list every Secret in the gliese-581 namespace and save the raw JSON response to /home/laborant/secret-list.json.
Add a new, separate Service CIDR range for the dev team using the ServiceCIDR API object — without touching or restarting the cluster's default Service CIDR — then create a Service with an explicit ClusterIP inside that new range and verify DNS resolution.
Configure a Kubernetes Service so that requests from the same client IP are always routed to the same backend Pod for a sustained period, using ClientIP-based session affinity.
Managing HTTP routing with Kubernetes Ingress resources the imperative way - host-based routing across namespaces, path-based routing, and a catch-all rule.
Create an Ingress resource for a shop application with path-based routing to multiple backend services and configure /etc/hosts for local DNS resolution.
A Deployment with two nginx containers has a port conflict — both containers use port 80. Fix the conflict by updating the ConfigMap, mounting it into the second container, updating the containerPort, and exposing both containers via a NodePort Service.
A Pod must be fully isolated from the cluster network. Deny all incoming traffic and block all outgoing traffic except DNS queries on port 53.
A multi-tier application runs across two namespaces. Learn how to isolate the application tier and restrict database access to only the application namespace.
