Hướng Dẫn Thi CKA
Đạt Chứng Chỉ 2026

# PersistentVolume — cluster-scoped (không có namespace)
apiVersion: v1
kind: PersistentVolume
metadata:
  name: my-pv
spec:
  capacity:
    storage: 5Gi
  accessModes: [ReadWriteOnce]
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual   # phải khớp với PVC!
  hostPath:
    path: /data/my-pv
---
# PersistentVolumeClaim — namespace-scoped
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
  namespace: default
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 2Gi
  storageClassName: manual   # phải khớp với PV!
---
# Pod sử dụng PVC
spec:
  containers:
  - name: app
    image: nginx:1.27
    volumeMounts:
    - name: data
      mountPath: /usr/share/nginx/html
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc

# Kiểm tra node
k get nodes
k describe node <node-name>
ssh <node> -- sudo systemctl status kubelet
ssh <node> -- sudo journalctl -u kubelet --no-pager | tail -50

# Kiểm tra pod
k describe pod <pod-name>           # xem phần Events ở cuối
k logs <pod-name>
k logs <pod-name> --previous        # pod đã crash
k logs <pod-name> -c <container>    # pod nhiều container

# Kiểm tra service/endpoint
k get endpoints <service-name>       # rỗng = selector không khớp pod
k describe svc <service-name>

# Kiểm tra DNS
k run test-dns --image=busybox:1.36 --rm -it -- nslookup kubernetes

# Kiểm tra control plane khi cluster bị lỗi
k get pods -n kube-system
sudo kubeadm certs check-expiration
ls /etc/kubernetes/manifests/

k create deployment webapp --image=nginx:1.26 --replicas=3

# Cập nhật image (trigger rolling update)
k set image deployment/webapp nginx=nginx:1.27
# ⚠️ LƯU Ý: "nginx" ở đây là TÊN CONTAINER trong pod spec, không phải tên deployment!

k rollout status deployment/webapp
k rollout history deployment/webapp

# Rollback về phiên bản trước
k rollout undo deployment/webapp

# Rollback về revision cụ thể
k rollout undo deployment/webapp --to-revision=2

# Tìm đường dẫn static pod
cat /var/lib/kubelet/config.yaml | grep staticPodPath
# Thường là: /etc/kubernetes/manifests

# Tạo static pod
sudo tee /etc/kubernetes/manifests/static-web.yaml <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: static-web
spec:
  containers:
  - name: web
    image: nginx:1.27
EOF

# Tạo Role (quyền trong namespace)
k create role pod-reader \
  --verb=get,list,watch \
  --resource=pods \
  -n dev

# Tạo RoleBinding
k create rolebinding read-pods \
  --role=pod-reader \
  --serviceaccount=dev:my-sa \
  -n dev

# Kiểm tra quyền (rất hay dùng trong thi)
k auth can-i list pods -n dev \
  --as=system:serviceaccount:dev:my-sa

# BACKUP etcd
ETCDCTL_API=3 etcdctl snapshot save /tmp/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Kiểm tra snapshot
ETCDCTL_API=3 etcdctl snapshot status /tmp/etcd-backup.db --write-table

# RESTORE etcd
# Bước 1: Restore ra thư mục mới
ETCDCTL_API=3 etcdctl snapshot restore /tmp/etcd-backup.db \
  --data-dir=/var/lib/etcd-restored

# Bước 2: Cập nhật etcd manifest để dùng thư mục mới
sudo vi /etc/kubernetes/manifests/etcd.yaml
# Đổi --data-dir=/var/lib/etcd → /var/lib/etcd-restored
# Đổi hostPath.path tương ứng

# Bước 3: Đợi etcd restart (~30-60s) — kubectl có thể không respond, bình thường!

### CONTROL PLANE NODE ###
sudo apt-mark unhold kubeadm
sudo apt-get install -y kubeadm=1.35.0-1.1
sudo apt-mark hold kubeadm
sudo kubeadm upgrade plan
sudo kubeadm upgrade apply v1.35.0
sudo apt-get install -y kubelet=1.35.0-1.1 kubectl=1.35.0-1.1
sudo systemctl restart kubelet

### WORKER NODE ###
# Từ control plane: drain worker
k drain worker-1 --ignore-daemonsets --delete-emptydir-data

# SSH vào worker, upgrade
sudo apt-get install -y kubeadm=1.35.0-1.1 kubelet=1.35.0-1.1 kubectl=1.35.0-1.1
sudo kubeadm upgrade node   # ← worker dùng "node", không phải "apply"!
sudo systemctl restart kubelet

# Từ control plane: uncordon
k uncordon worker-1

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-route
spec:
  parentRefs:
  - name: my-gateway
  rules:
  - backendRefs:
    - name: my-service
      port: 80

## POD
k run nginx --image=nginx:1.27
k run nginx --image=nginx:1.27 --port=80 --labels=app=web
k run nginx --image=nginx:1.27 --dry-run=client -o yaml > pod.yaml

## DEPLOYMENT
k create deployment webapp --image=nginx:1.27 --replicas=3
k scale deployment webapp --replicas=5
k set image deployment/webapp nginx=nginx:1.28

## SERVICE
k expose deployment webapp --port=80 --target-port=8080
k expose deployment webapp --port=80 --target-port=8080 --type=NodePort
k port-forward svc/webapp 8080:80   # test local

## RBAC
k create sa my-app -n prod
k create role pod-reader --verb=get,list,watch --resource=pods -n prod
k create rolebinding read-pods --role=pod-reader --serviceaccount=prod:my-app -n prod
k auth can-i list pods -n prod --as=system:serviceaccount:prod:my-app

## NODE
k cordon node-1
k drain node-1 --ignore-daemonsets --delete-emptydir-data
k uncordon node-1
k taint nodes node-1 key=value:NoSchedule

## CONFIGMAP / SECRET
k create configmap app-cfg --from-literal=LOG=debug --from-literal=ENV=prod
k create configmap nginx-conf --from-file=nginx.conf
k create secret generic db-creds --from-literal=user=admin --from-literal=pass=s3cr3t