Skip to main content

CKA Practice Questions

Le Anh TungAbout 5 minDevopsk8sCKAcertificationpractice

CKA Practice Questions

Question 1: Update NGINX ConfigMap for TLS Configuration

Scenario:

An NGINX Deploy named nginx-static is running in the nginx-static namespace. It is configured using a ConfigMap named nginx-config. Update the existing ConfigMap to allow only TLSv1.3 connections (TLSv1.2 should NOT be allowed). Re-create, restart, or scale resources as necessary.

Use the following command to test the changes:

[candidate@cka2025] $ curl --tls-max 1.2 https://web.k8s.local

As TLSv1.2 should not be allowed anymore, the command should fail.

Task Requirements:

  • Namespace: nginx-static
  • Deployment: nginx-static
  • ConfigMap: nginx-config
  • Requirement: Allow only TLSv1.3 connections (block TLSv1.2)
  • Validation: curl --tls-max 1.2 https://web.k8s.local should fail

Weight: 7%

Solution

Step 1: Set the Context and Namespace

# Switch to the correct namespace
kubectl config set-context --current --namespace=nginx-static

# Verify you're in the correct namespace
kubectl config view --minify | grep namespace

Why This Matters

Setting the namespace context prevents errors and saves time by avoiding the need to add -n nginx-static to every command.

Step 2: Examine the Current ConfigMap

# View the current ConfigMap
kubectl get configmap nginx-config -o yaml

# Save a backup (best practice)
kubectl get configmap nginx-config -o yaml > nginx-config-backup.yaml

Example Output:

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: nginx-static
data:
  nginx.conf: |
    events {
        worker_connections 1024;
    }
    http {
        server {
            listen 443 ssl;
            server_name web.k8s.local;
            ssl_protocols TLSv1.2 TLSv1.3;  # Currently allows both
            # ... rest of config
        }
    }

Step 3: Edit the ConfigMap

# Edit the ConfigMap
kubectl edit configmap nginx-config

Modify the NGINX configuration to restrict TLS to version 1.3 only:

# In the ConfigMap data section, change:
# FROM:
ssl_protocols TLSv1.2 TLSv1.3;

# TO:
ssl_protocols TLSv1.3;
ssl_prefer_server_ciphers on;

Complete ConfigMap Example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: nginx-static
data:
  nginx.conf: |
    events {
        worker_connections 1024;
    }
    
    http {
        server {
            listen 443 ssl;
            server_name web.k8s.local;
            
            # Only allow TLSv1.3
            ssl_protocols TLSv1.3;
            ssl_prefer_server_ciphers on;
            
            ssl_certificate /etc/nginx/ssl/tls.crt;
            ssl_certificate_key /etc/nginx/ssl/tls.key;
            
            location / {
                root /usr/share/nginx/html;
                index index.html;
            }
        }
    }

Step 4: Restart the Deployment

Critical Step

ConfigMap changes do NOT automatically trigger pod restarts. You MUST manually restart the deployment!

Option 1: Rollout Restart (Recommended)

kubectl rollout restart deployment nginx-static

Option 2: Scale Down and Up

# Scale to 0
kubectl scale deployment nginx-static --replicas=0

# Wait a moment, then scale back up
kubectl scale deployment nginx-static --replicas=1

Option 3: Delete Pods (Force Recreation)

# Delete all pods in the deployment
kubectl delete pods -l app=nginx-static

Step 5: Verify the Changes

# Check deployment status
kubectl rollout status deployment nginx-static

# Verify pods are running
kubectl get pods

# Check pod logs for any errors
kubectl logs -l app=nginx-static

# Describe the pod to see the ConfigMap mount
kubectl describe pod -l app=nginx-static

Expected Output:

deployment "nginx-static" successfully rolled out

NAME                            READY   STATUS    RESTARTS   AGE
nginx-static-7d8f9c5b6d-xyz12   1/1     Running   0          30s

Step 6: Test the Configuration

# This should FAIL (as TLSv1.2 is not allowed)
curl --tls-max 1.2 https://web.k8s.local

# This should SUCCEED (TLSv1.3 is allowed)
curl --tls-max 1.3 https://web.k8s.local

Alternative Testing with OpenSSL:

# Test TLSv1.2 - Should fail or show connection refused
openssl s_client -connect web.k8s.local:443 -tls1_2

# Test TLSv1.3 - Should succeed
openssl s_client -connect web.k8s.local:443 -tls1_3

Best Practices

1. Always Create Backups

# Backup ConfigMap before editing
kubectl get configmap nginx-config -o yaml > nginx-config-backup.yaml

# Backup the entire namespace (optional)
kubectl get all,configmap,secret -n nginx-static -o yaml > namespace-backup.yaml

2. Use Declarative Configuration

Instead of kubectl edit, use YAML files for better version control:

# Export current config
kubectl get configmap nginx-config -o yaml > nginx-config.yaml

# Edit the file
vim nginx-config.yaml

# Apply changes
kubectl apply -f nginx-config.yaml

3. Verify ConfigMap Changes

# Check the ConfigMap after editing
kubectl get configmap nginx-config -o yaml

# Compare with backup
diff nginx-config-backup.yaml <(kubectl get configmap nginx-config -o yaml)

4. Monitor Pod Restart

# Watch pods restart in real-time
kubectl get pods -w

# Check events for any issues
kubectl get events --sort-by='.lastTimestamp'

5. Use Labels for Easy Selection

# List all resources with specific labels
kubectl get all -l app=nginx-static

# Delete pods by label (safer than by name)
kubectl delete pods -l app=nginx-static

6. Validate NGINX Configuration

# Exec into the pod to test NGINX config
kubectl exec -it <pod-name> -- nginx -t

# Check NGINX error logs
kubectl exec -it <pod-name> -- cat /var/log/nginx/error.log

7. Use ConfigMap Immutability (Kubernetes 1.21+)

For production environments, consider using immutable ConfigMaps:

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: nginx-static
immutable: true
data:
  nginx.conf: |
    # ... configuration

Warning

Once a ConfigMap is marked as immutable, it cannot be modified. You must create a new ConfigMap and update the deployment.

8. Implement Rolling Updates

Ensure your deployment has proper rolling update strategy:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-static
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  # ... rest of spec

9. Use Health Checks

Ensure pods have proper liveness and readiness probes:

livenessProbe:
  httpGet:
    path: /
    port: 443
    scheme: HTTPS
  initialDelaySeconds: 30
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /
    port: 443
    scheme: HTTPS
  initialDelaySeconds: 5
  periodSeconds: 5

10. Document Changes

# Add annotations to track changes
kubectl annotate configmap nginx-config \
  change-cause="Updated to allow only TLSv1.3" \
  changed-by="candidate@cka2025" \
  changed-date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

Common Pitfalls to Avoid

Common Mistakes

  1. Forgetting to restart pods - ConfigMap changes don't automatically trigger pod restarts
  2. Not backing up - Always backup before making changes
  3. Wrong namespace - Verify you're in the correct namespace
  4. Syntax errors in NGINX config - Test configuration before applying
  5. Not verifying changes - Always test after making changes
  6. Using wrong TLS version - The question asks to BLOCK TLSv1.2, so only allow TLSv1.3

Time-Saving Tips

  • Use kubectl rollout restart instead of manually deleting pods
  • Use -o yaml to quickly view resource configurations
  • Use --dry-run=client -o yaml to generate YAML templates
  • Keep commonly used commands in a cheat sheet
  • Practice using vim/nano efficiently (these are the only editors available in the exam)

Important Notes

  • ConfigMaps are not automatically reloaded by pods
  • Some applications require a restart to pick up ConfigMap changes
  • In the exam, time is critical - practice these steps until they're muscle memory
  • Always verify your changes with the provided test command
  • Read the question carefully - understand what should PASS and what should FAIL

Quick Reference Commands

# Essential commands for this task (in order)
kubectl config set-context --current --namespace=nginx-static
kubectl get configmap nginx-config -o yaml > backup.yaml
kubectl edit configmap nginx-config
# (Change ssl_protocols to TLSv1.3 only)
kubectl rollout restart deployment nginx-static
kubectl rollout status deployment nginx-static
kubectl get pods
curl --tls-max 1.2 https://web.k8s.local  # Should FAIL
curl --tls-max 1.3 https://web.k8s.local  # Should SUCCEED

Exam Tips for This Question

  1. Read Carefully: The question states TLSv1.2 should NOT be allowed. This means you need to configure ONLY TLSv1.3.

  2. Time Allocation: This is a 7% question, so allocate approximately 8-10 minutes.

  3. Verification is Key: Always run the test command provided in the question to verify your solution.

  4. Don't Overthink: The solution is straightforward - edit ConfigMap, restart deployment, test.

  5. Use kubectl edit: In the exam, kubectl edit is faster than creating/editing YAML files unless you're very comfortable with vim.

  6. Check Pod Status: Make sure pods are running before testing. A failing test might just mean pods aren't ready yet.

  • ConfigMaps: Store configuration data as key-value pairs
  • TLS/SSL: Transport Layer Security for encrypted communications
  • Rolling Updates: Update deployments without downtime
  • NGINX: Popular web server and reverse proxy
  • Namespaces: Logical isolation of resources in Kubernetes

Additional Practice

Try these variations to deepen your understanding:

  1. Create a ConfigMap from scratch with NGINX configuration
  2. Mount ConfigMap as environment variables instead of files
  3. Update a ConfigMap and use a sidecar container to reload NGINX automatically
  4. Implement ConfigMap versioning strategy
  5. Use Secrets for SSL certificates instead of hardcoding paths
Last update:
Contributors: TungLa3
Design by Talee
Copyright © 2026 Le Anh Tung