jsonpath Reference

Mon, 15 Jun 2026 16:02:07 -0400

jsonpath — the mental model Link to heading

The dot notation is just the YAML structure of the resource, flattened.

Whatever you see in k get <resource> -o yaml — that’s the map. Every key is a dot. Every list item is [0] or [*].

The thinking method Link to heading

Step 1 — run this:

k get <resource> <name> -o yaml

Step 2 — read the YAML, trace the path to what you want

CKA Imperative Commands

Mon, 15 Jun 2026 15:33:28 -0400

CKA Imperative Commands — Full Reference Link to heading

Pods Link to heading

# Basic pod
k run web --image nginx

# With labels
k run app --image node:18 --labels tier=frontend,env=dev

# With command
k run runner --image busybox --command -- sleep 7200

# With env vars
k run api --image python:3.11 --env DEBUG=true --env PORT=8080

# With port
k run backend --image redis:7 --port 6379

# With service account
k run web --image nginx --port 80 --env ENV=prod --labels app=foo --serviceaccount my-sa

# In namespace
k run api --image nginx -n production

# Generate YAML
k run web --image nginx $do

# Force delete
k delete pod web --now

# Exec into pod
k exec -it web -- sh
k exec -it web -c <container> -- sh

# Logs
k logs web
k logs web -c <container>
k logs web --previous
k logs web -f

# Top
k top pods
k top pods -n <namespace>
k top nodes

Temp Pods (Connectivity Testing) Link to heading

# Single command — use -i only (NOT -it)
k run tmp -i --rm --restart Never --image nginx:alpine -- curl http://<svc>:<port>

# wget (busybox)
k run tmp -i --rm --restart Never --image busybox -- wget -O- http://<svc>:<port>

# nc raw TCP test
k run tmp -i --rm --restart Never --image busybox -- nc -zv <svc> <port>

# Save output to file
k run tmp -i --rm --restart Never --image nginx:alpine -- curl http://<svc>:<port> > /path/to/file

# Source pod already exists
k exec <pod> -- curl http://<svc>:<port>
k exec <pod> -- nc -zv <svc> <port>

Deployments Link to heading

# Create
k create deploy nginx --image nginx

# With replicas
k create deploy nginx --image nginx --replicas 3

# With port
k create deploy nginx --image nginx --port 80

# Scale
k scale deploy nginx --replicas 5

# Set image
k set image deploy nginx nginx=nginx:1.21

# Rollout status
k rollout status deploy nginx

# Rollout history
k rollout history deploy nginx

# Rollback to previous
k rollout undo deploy nginx

# Rollback to specific revision
k rollout undo deploy nginx --to-revision 2

# Restart — forces pod recycle (required after ConfigMap/Secret env var changes)
k rollout restart deploy nginx
k rollout restart daemonset nginx
k rollout restart statefulset nginx

# Pause / resume (hold rollout mid-way)
k rollout pause deploy nginx
k rollout resume deploy nginx

# Generate YAML
k create deploy nginx --image nginx $do

Services Link to heading

# Expose
k expose <resource> <name> --name <svc-name> --type <type> --port <port> --target-port <target-port>

# Examples
k expose pod web --name web-svc --type ClusterIP --port 80 --target-port 8080
k expose deploy nginx --name nginx-svc --type NodePort --port 80 --target-port 80
k expose deploy app --name app-svc --type LoadBalancer --port 443 --target-port 8443

# Debug: check endpoints (none = selector mismatch)
k get endpoints <svc>
k get ep <svc>

# Blue/Green switch
k edit svc my-svc #change selector

ConfigMaps Link to heading

# From literal
k create cm app-config --from-literal key=value
k create cm app-config --from-literal DB_HOST=mysql --from-literal DB_PORT=3306

# From file
k create cm app-config --from-file config.properties

# From file with key
k create cm app-config --from-file=index.html=/usr/file/nginx/html

# Generate YAML
k create cm app-config --from-literal key=value $do

# Inspect
k get cm app-config -o yaml
k describe cm app-config

Secrets Link to heading

# Generic (opaque)
k create secret generic db-secret --from-literal password=mysecret
k create secret generic db-secret --from-literal user=admin --from-literal password=pass123

# From file
k create secret generic tls-secret --from-file cert.pem

# TLS secret
k create secret tls tls-secret --cert /path/to/tls.crt --key /path/to/tls.key

# Docker registry
k create secret docker-registry regcred \
 --docker-server <registry> \
 --docker-username <user> \
 --docker-password <pass>

# Inspect
k get secret db-secret -o yaml
k get secret db-secret -o jsonpath='{.data.password}' | base64 -d

# SA token extraction
k get secret <secret-name> -o jsonpath='{.data.token}' | base64 -d > /path/to/file

ServiceAccounts Link to heading

# Create
k create sa my-sa

# Describe
k describe sa my-sa

# Verify auth as SA
k auth can-i get pods --as=system:serviceaccount:<namespace>:<sa-name>

RBAC — Roles and RoleBindings Link to heading

# Create Role
k create role pod-reader --verb get,list,watch --resource pods
k create role dev-role --verb get,list,create --resource pods,deployments,services

# Create RoleBinding — user
k create rolebinding pod-reader-binding --role pod-reader --user jane

# Create RoleBinding — group
k create rolebinding dev-binding --role dev-role --group developers

# Create RoleBinding — ServiceAccount
k create rolebinding sa-binding --role pod-reader --serviceaccount default:my-sa

# Generate YAML
k create role pod-reader --verb get,list,watch --resource pods $do

# Verify
k auth can-i get pods --as=jane
k auth can-i list secrets --as=jane

RBAC — ClusterRoles and ClusterRoleBindings Link to heading

# Create ClusterRole
k create clusterrole node-reader --verb get,list,watch --resource nodes
k create clusterrole pv-reader --verb get,list,watch --resource persistentvolumes

# Create ClusterRoleBinding — user
k create clusterrolebinding node-reader-binding --clusterrole node-reader --user kevin

# Create ClusterRoleBinding — group
k create clusterrolebinding dev-binding --clusterrole deploy-viewer --group developers

# Create ClusterRoleBinding — ServiceAccount
k create clusterrolebinding sa-binding --clusterrole secret-admin --serviceaccount security:vault-sa

# Generate YAML
k create clusterrole node-reader --verb get,list,watch --resource nodes $do

# Verify
k auth can-i list nodes --as=kevin
k auth can-i get pods --as=system:serviceaccount:security:vault-sa

--role → RoleBinding only. --clusterrole → ClusterRoleBinding only. --serviceaccount=namespace:name — colon separator, no -n flag. No -n on ClusterRole/ClusterRoleBinding (cluster-scoped).

CKA Exam Checklist

Mon, 15 Jun 2026 15:21:41 -0400

CKA Exam Start Checklist

Beginning of Exam — Run Once Link to heading

Step 1 — check .vimrc Link to heading

vim ~/.vimrc

set expandtab
set tabstop=2
set shiftwidth=2
set number
set autoindent

Beginning of Every Question — Run These First Link to heading

export do="--dry-run=client -o yaml"
echo $do
k config set-context --current --namespace=<namespace>

Exam Strategy — First 2 Minutes Link to heading

Run the setup above
Read through ALL questions quickly
Flag hard ones, do easy ones first

Allowed Resources Link to heading

Kubernetes Documentation https://kubernetes.io/docs
Kubernetes Blog https://kubernetes.io/blog/
Helm Documentation https://helm.sh/docs
CKA only: Gateway API Documentation https://gateway-api.sigs.k8s.io

CKA Study Guide

Mon, 15 Jun 2026 14:57:30 -0400

Well, it’s a tall order but here we go!

In the series I will place my exam prep guides and study reference files. Not sure I want to throw all 150 notes here, so for now just the exam stuff. If there is interest and demand I’ll place the rest. ;)

I’ll likely start CKAD, KCNA, KCSA, and CKS series as well.

Remember, this is me sharing a ton of work to help you. Input is not only appreciated, please give feedback! Let me know any issues! I want it to be helpful and it is publicly visible so some feedback would be great.

Cka on Kevin Morris