labs.MD

CKS labs

• TASK=01 make run_cks_task - create cks lab number 01
• TASK=01 make delete_cks_task - delete cks hands-on labs
• TASK=01 make run_cks_task_clean - run cks_task with clean terragrunt cache for cks_task
• make output_cks_task - show outputs from cks_task

Task	Description	Solution
01	kubectl contexts	SOLUTION
02	Falco, sysdig	SOLUTION
03	Kube-api. disable access via nodePort	SOLUTION
04	Pod Security Standard	SOLUTION
05	CIS Benchmark	SOLUTION
07	Open Policy Agent - Blacklist Images	SOLUTION
09	AppArmor	SOLUTION
10	Container Runtime Sandbox gVisor	SOLUTION
11	Read the complete Secret content directly from ETCD	SOLUTION
17	Enable audit log	SOLUTION
19	Fix Dockerfile	SOLUTION
20	Update Kubernetes cluster	SOLUTION
21	Image Vulnerability Scanning	SOLUTION
22	Network policy	SOLUTION
23	Set tls version and allowed ciphers for etcd, kube-api	SOLUTION
24	Encrypt secrets in ETCD	SOLUTION
25	Image policy webhook	SOLUTION
26	Install Cilium with WireGuard	SOLUTION VIDEO SOLUTION
27	Cilium network policy with mTLS	SOLUTION VIDEO SOLUTION
28	Detect and stop unauthorized access with Falco	SOLUTION VIDEO SOLUTION
29	Perform Docker security configutaion	SOLUTION VIDEO SOLUTION
30	Create istio network policy	SOLUTION

CKA labs

• TASK=01 make run_cka_task - create cka lab number 01
• TASK=01 make delete_cka_task - delete cka hands-on labs
• TASK=01 make run_cka_task_clean - run cka_task with clean terragrunt cache for cka_task
• make output_cka_task - show outputs from cka_task

Task	Description	Solution
01	Fix problem with kube-api	SOLUTION VIDEO SOLUTION
02	Horizontal Pod Autoscaling .CPU	SOLUTION
03	Nginx ingress. Routing by header	SOLUTION VIDEO SOLUTION
04	Nginx ingress. Routing 30% of requests to new version of app.	SOLUTION VIDEO SOLUTION
05	PriorityClass.	SOLUTION VIDEO SOLUTION
06	Create general resources (Namespace, Deployment, Service)	SOLUTION VIDEO SOLUTION
07	CPU throttle	SOLUTION
08	Cilium NetworkPolicy L7	SOLUTION VIDEO SOLUTION
09	Gateway API in Kubernetes	SOLUTION VIDEO SOLUTION
10	Kubernetes resource orchestration (kro)	SOLUTION

CKAD labs

• TASK=01 make run_ckad_task - create ckad lab number 01
• TASK=01 make delete_ckad_task - delete ckad hands-on labs
• TASK=01 make run_ckad_task_clean - run cka_task with clean terragrunt cache for ckad_task
• make output_ckad_task - show outputs from ckad_task

Task	Description	Solution
01	test	SOLUTION

ICA labs (Istio Certified Associate)

• TASK=01 make run_ica_task - create ica lab number 01
• TASK=01 make delete_ica_task - delete ica hands-on lab
• TASK=01 make run_ica_task_clean - run ica_task with clean terragrunt cache
• make output_ica_task - show outputs from ica_task

Task	Description
01	Installing Istio on a Kubernetes Cluster
02	Dark Launch (Header-based routing)
03	Fault Injection and Retry
04	Zero Trust: mTLS and AuthorizationPolicy
05	Controlled Egress: ServiceEntry, Egress Gateway and Sidecar scope
06	Load Balancing and Traffic Mirroring
07	Helm install and Canary upgrade with revisions
08	Observability: Prometheus, Jaeger and Kiali
09	Advanced: Ambient mode
10	Resilience: Timeout and Circuit Breaker
11	End-user authentication: RequestAuthentication and JWT
12	Troubleshooting: istioctl analyze, proxy-status, proxy-config
13	Securing Edge Traffic with TLS
14	Locality-aware Failover
15	Installation & Configuration: customizing the Istio install (IstioOperator + MeshConfig)
16	Kubernetes Gateway API: ingress routing with Gateway and HTTPRoute
17	Rate Limiting: local rate limit with EnvoyFilter
18	Telemetry API: access logs and distributed tracing
19	Custom CA: plug your own root and intermediate CA into istiod
20	mTLS migration: PERMISSIVE to STRICT with zero downtime
21	Sidecar scoping: limit the proxy configuration scope
22	TLS origination: initiate TLS from the mesh
23	WasmPlugin: extend the data plane with WebAssembly
24	Ambient: waypoint proxy and L7 authorization
25	Progressive delivery with Flagger
26	Dynamic CA: cert-manager and istio-csr
27	EnvoyFilter and Lua: custom logic with an inline script
28	TCP routing: routing non-HTTP traffic
29	Ingress TLS: MUTUAL and PASSTHROUGH modes
30	StatefulSets and headless services in the mesh
31	Zero-downtime production migration: ingress-nginx to Istio Gateway
32	gRPC: per-request load balancing, port naming, retries and timeouts
33	Control plane performance & operations: discovery selectors, Sidecar scope, istiod golden signals, OPA Gatekeeper
34	Hardening & threat model: STRICT mTLS, default-deny, egress control, RBAC on Istio CRDs, OPA Gatekeeper, NetworkPolicy
35	Multicluster mesh: multi-primary, multi-network, shared CA, east-west gateway, cross-cluster discovery

EKS labs

• TASK=01 make run_eks_task - create ckad lab number 01
• TASK=01 make delete_eks_task - delete ckad hands-on labs
• TASK=01 make run_eks_task_clean - run cka_task with clean terragrunt cache for ckad_task
• make output_eks_task - show outputs from ckad_task

Task	Description	Solution
02	Karpenter Basics
03	Application Autoscaling with KEDA and Prometheus

AWS mock exams

Task	Description	Solution
01	AI practitioner