Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
kubectl is dead: the kube-apiserver certificate expired and the control plane is down, while the workload quietly keeps serving. Diagnose the expiry offline, renew the certificates, bring the control plane back, and prove the cluster recovered.
Kubernetes 1.37 can hand every pod its own short-lived X.509 identity, no service mesh and no sidecar involved. The API is served out of the box, but it issues nothing without a signer, and a request nobody answers leaves the pod waiting forever. Get a stalled workload its certificates, give its client an identity of its own, and make the server actually enforce mutual TLS.
A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.
Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.
A daemon exposes a Unix domain socket that every local user can talk to. Protect it so that only root and members of a dedicated group may connect - the same way Docker restricts access to /var/run/docker.sock.
Configure the kube-scheduler static pod with CPU resource requests based on node allocatable, and disable the NodePort access to the Kubernetes API server so it is only reachable via ClusterIP.
A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.
Prove that Kata Containers Pods run inside a dedicated VM with a separate guest kernel, completely isolated from the host kernel, by comparing kernel versions across runc and Kata runtimes.
Set up your own OCI-compatible container registry with username/password authentication and HTTPS - the kind of protection you'd expect before using a registry in production.
