Learn to expose apps with Services, debug CoreDNS lookups, route traffic with Ingress and Gateway API, and lock it down with NetworkPolicy.
It is a Friday morning, five minutes after the market opens. A fintech team in Bengaluru ships a one-line change to the order-status API.
A Service is a stable virtual IP and DNS name that load-balances traffic across the Ready Pods matching a label selector.
CoreDNS is the cluster's DNS server. It runs as a Deployment in kube-system, sits behind a Service called kube-dns, and answers questions like "what...
An Ingress is a set of HTTP routing rules, such as "requests for host shop.lab.test on path /cart go to Service cart". It is an object only.
Gateway API is the newer, more expressive way to route traffic into a cluster.
A NetworkPolicy is a firewall rule for Pods. It selects a group of Pods and lists which traffic is allowed in (ingress) and out (egress).
It is a Friday morning, five minutes after the market opens.
A Service is a stable virtual IP and DNS name that load-balances traffic across the Ready Pods matching a label...
CoreDNS is the cluster's DNS server. It runs as a Deployment in kube-system, sits behind a Service called kube-dns, and...
An Ingress is a set of HTTP routing rules, such as "requests for host shop.lab.test on path /cart go to Service cart".
Gateway API is the newer, more expressive way to route traffic into a cluster.
A NetworkPolicy is a firewall rule for Pods.
Troubleshooting is 30 percent of the CKA, and networking faults are among its favourite scenarios.
On the exam you do not write long YAML from scratch. You use imperative commands, generate a skeleton, and verify.
These eight labs run in order on one cluster.
Command cheat sheet Six mistakes and their fixes The most common mistake is a Service selector that does not match the...
Roles that use the skills in this module.
DevOps Engineer
Site Reliability Engineer
Platform Engineer
Cloud Engineer
Not a software engineer sheet. Every problem comes from real DevOps, SRE, Platform and Cloud interviews, from your first script to a system you build yourself.
Open the Coding SheetCheck endpoints first: an empty EndpointSlice usually means the selector matches no Ready Pod. If endpoints exist, look at the targetPort, whether the app is really listening, DNS, and any NetworkPolicy. Run kubectl get endpointslices for the Service and compare the selector with the Pod labels.
The port is what clients use when they call the Service. The targetPort is the port the container actually listens on. They can differ, for example port 80 on the Service forwarding to a container on 5678.
Yes. Ingress is frozen, not removed, and a huge number of clusters and exam tasks still use it. Learn Ingress first, then Gateway API, because the ideas of hosts, paths and backends carry across.
NetworkPolicy is enforced by the network plugin, not by the API server. If your CNI does not support it, the object is stored and silently ignored. Use a plugin such as Calico or Cilium and test with a Pod that should be blocked.