Focused, hands-on DevOps and server-side problems with hints, feedback, and automated solution checks.
A storefront needs eight replicas, and the platform team wants them split down the middle between the two availability zones. An uneven split must be refused by the scheduler rather than quietly tolerated.
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.
A Deployment running a distroless Chainguard nginx image (cgr.dev/chainguard/nginx) is deployed in the namespace webapps, fronted by a ClusterIP Service. Port-forward that Service to localhost port 3333 on cplane-01, use curl to save the response body to /home/laborant/index.html, and verify the file is accessible and contains the expected content.
A Job manifest at /home/laborant/batch-job.yaml is exiting with a non-zero exit status. The Job has limited retries configured. Inspect the cluster and the manifest to find the bug, fix it, and reapply.
Create a multi-container Pod with different user IDs per container while sharing a common group ID at the Pod level for collaborative file access.
Use kubectl proxy to open a local, already authenticated HTTP endpoint to the Kubernetes API server, then use curl to list every Secret in the gliese-581 namespace and save the raw JSON response to /home/laborant/secret-list.json.
Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.
A Deployment is using a disk-backed emptyDir volume. Convert it to a memory-backed tmpfs volume for better performance — but make sure to set a size limit to prevent the Pod from exhausting the node's RAM.
A distroless pod running in the cherry namespace has no shell or debugging tools. Use kubectl debug to attach an ephemeral container, test connectivity to the request-logger service, and verify the request was received in its logs.