Challenges | iximiuz Labs

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Networking, Security

Pick and Deploy the Least Permissive NetworkPolicy

by Omkar Shelke

The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.

#cka #ckad #cks #network-policy

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

CKA Practice: Renew Expiring Control Plane Certificates

by Shiva Swaroop N K

kubectl is dead: the kube-apiserver certificate expired and the control plane is down, while the workload quietly keeps serving. Diagnose the expiry offline, renew the certificates, bring the control plane back, and prove the cluster recovered.

#cka #kubeadm #certificates

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Expose the Snake Game via TLS Ingress

by Omkar Shelke

A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.

#cka #ckad #ingress #tls #traefik

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Enforce TLSv1.3-Only Policy on a Production NGINX Deployment

by Omkar Shelke

Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.

#cka #ckad #tls #configmap #deployment

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Disable API Server NodePort and Configure kube-scheduler Resource Requests

by Omkar Shelke

Configure the kube-scheduler static pod with CPU resource requests based on node allocatable, and disable the NodePort access to the Kubernetes API server so it is only reachable via ClusterIP.

#cks #cka #kube-scheduler #api-server

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Troubleshoot CrashLoopBackOff Caused by a Missing TLS Secret

by Omkar Shelke

A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.

#cka #cks #tls #secrets #troubleshooting

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security

Schedule a Maintenance Pod with Host Namespace Access Using Taints, Tolerations, and NodeSelector

by Omkar Shelke

Learn how to taint a node, schedule a Pod using nodeSelector and tolerations, and share the host network, PID, and IPC namespaces with the Pod.

#cka #cks #scheduling #taints #tolerations

This challenge was created by a community author. Community content is reviewed by the iximiuz Labs team on a best effort basis.

Challenge on Kubernetes, Security, Networking

Control Cross-Namespace Traffic Using NetworkPolicy

by Omkar Shelke

A multi-tier application runs across two namespaces. Learn how to isolate the application tier and restrict database access to only the application namespace.

#ckad #cka #cks #network-policy