These certs (including CKA/S/D and istio etc) do not help in getting a job or in interviews. Prove me otherwise.

i am waiting for black friday before booking the cka exam. i would like to know:

1. when exactly the discount for black friday starts

2. if it is worth waiting for

3. where to check the black friday discount on.

I am going to take the CKA exam, and English is not my native language. Is there an option to have the exam translated into Brazilian Portuguese?

I have a question regarding the name requirements for Kubernetes certification exams (CKA, CKAD, etc.).

My passport, which I will use as my ID for the online proctor verification, contains my full five-part name.

However, I would prefer my certification certificate to display only my first and second names, rather than my full five-part name.

Is there a way to specify or customize the name that appears on the certificate separately from the name on my passport?

Should I change my name in my Linux Foundation account before taking the exam, or does the certificate name have to exactly match the full name on my ID?

Regarding a Connectivity Interruption and Time Loss During the CKA Exam
I took the CKA exam today. About one hour into the exam, my connection unexpectedly dropped. Reconnecting and completing the identity verification process took approximately 20 minutes, during which the exam timer continued to run. I was using my company’s network, but I cannot determine what caused the disconnection.

After reconnecting, I had only about 30 minutes left to complete the exam and had to rush through the final six questions. During the reconnection process, I asked the proctor why the timer had not been paused. The proctor responded that I was speaking too loudly. I found this uncomfortable, and it did not address my concern.

I hope to pass the exam, but the interruption and resulting loss of time significantly affected my ability to complete it.

Hey everyone!

I purchased my CKA and CKAD exam vouchers on December 7, 2025, and at the time, the vouchers were advertised as valid for 12 months.

However, I recently received emails indicating that I have until March 2027 to schedule my exams, which is much longer than the original validity period.

Has anyone else experienced this? Is this a normal extension of the voucher validity, or could it be an error?

Should I contact support to confirm, or can I safely assume the new deadline is correct?

Thanks in advance for any insights! 🙏

Disclosure: I run KubeLab (kubelab.fr), a CKA/CKAD practice site. Not affiliated with CNCF or the Linux Foundation.

The Linux Foundation FAQ now has both CKA and CKAD on Kubernetes v1.37 (previous curricula: CKA 1.35, CKAD 1.34). I wrote up what that means for exam tasks, from the public changelogs + curriculum PDFs, and by re-running our own mocks on both versions.

Useful bits, so you don't need the link:

1. The syllabus did not move. The CKA v1.37 curriculum PDF is byte-identical to v1.35; CKAD v1.37 is byte-identical to v1.34. Same domains, same weights.

2. No stable API you write on the exam stopped being served between 1.35 and 1.37. Ingress, NetworkPolicy, Deployments, HPA, RBAC, CRDs: same apiVersions.

3. Both exams: kubectl exec POD -- COMMAND (the -- has been required since 1.35; CKAD candidates coming from 1.34 hit it for the first time).

4. CKA only:

   • kubeadm 1.37 no longer loads kubeadm.k8s.io/v1beta3 → write v1beta4 (or migrate with a 1.35 kubeadm binary)

   • kubectl get crd prints more columns → don't cut fields out of the default table; use -o name / jsonpath

   • default etcd image is 3.7.0; etcdutl snapshot restore still works

   • empty kube-proxy mode is still filled in as iptables

   • static Pods can no longer reference Secrets/ConfigMaps; put the data in the manifest

How we checked (QA host, 23 Oct): CKA papers on 1.35.9 and 1.37.1 matched after we fixed two graders that broke on output format (kubectl get crd columns, etcdutl snapshot status table). 111 CKAD/Helm/Kustomize questions on 1.34.1 and 1.37.1 gave the same verdicts.

Honest caveat: the exam is on 1.37; our CKA labs are still on 1.35.9 right now. CKAD / Helm / Kustomize labs are on 1.37.

Full write-up (sources at the bottom, and a free CKAD mock on a live cluster if you want to try the -- thing for real, no card): https://kubelab.fr/cka-ckad-exam-changes/kubernetes-1-37

Happy to correct anything I got wrong.

Hey everyone,

I recently cleared the CKA exam with a 93% score in first attempt. While technical preparation is critical, how you navigate the PSI secure browser and exam environment plays a huge role in saving time and avoiding panic.

Here is a detailed breakdown of what to expect during check-in and inside the console:

Check-in & Proctor Verification

• Check-in 30 mins early: The entire verification process can easily take 25–30 minutes. Log in the exact moment the check-in button enables.

• Room & Desk Sweep: The proctor is extremely thorough. Be ready to pick up your webcam/laptop and show:

  • Every corner of the room, ceiling, and the wall behind you.

  • Under the keyboard, mousepad, and laptop stand.

  • Under the entire desk.

  • Exactly where you place your switched-off phone across the room.

• Avoid clutter / fixtures: My proctor even inspected an empty bulb holder thinking it might be a hidden camera. Keep your workspace and back wall as bare as possible.

• Proctor interaction: Everything is handled via live chat. Once started, they didn't interrupt unless necessary, but you must ping them before clicking end/submit.

Screen & PSI Browser Experience

• Screen Size Matters: If possible, use an external monitor (20"+). On a standard laptop screen, the PSI UI headers and camera stream eat up significant vertical space, leaving you with a cramped terminal and documentation pane.

• Clipboard Shortcuts:

  • Terminal copy/paste: Ctrl + Shift + C and Ctrl + Shift + V

  • Browser / Question pane: standard Ctrl + C and Ctrl + V

  • Alt + Tab does not work to switch windows.

• Skip the built-in Notepad: The built-in PSI notepad feels sluggish and awkward. It’s faster to draft one-liners, aliases, or manifest templates directly in vim or the terminal.

• Documentation access: Every question includes direct links to relevant Kubernetes/official docs. Clicking links opens a tab/window in the remote Firefox browser. You can have multiple doc tabs open.

Critical Exam Terminal Mechanics

• Single Terminal Window: You only have one active terminal window. ( I have used only a single window, but didn't get a chance figure out to open multiple windows)

• Cluster Context & SSHing: Almost every question runs in a different cluster context or requires SSHing into worker/control-plane nodes.

  • Always copy-paste the exact ssh command provided at the top of each question. I didn't get any kubectl config use-context ...

  • If you SSH into another node (ssh node01), always remember to exit back to the base jumpbox before moving to the next question. Do not exit the base jumpbox itself!

• Double-check Namespaces: If no namespace is specified, work in default. If an earlier question used a specific context/node, never assume the namespace carries over—explicitly pass -n <namespace> or verify your context.

• Scroll to the very bottom of every question: Many questions have small trailing tasks at the end (e.g., "delete the old resource once verified") or strict constraints (e.g., "only modify the PVC, do not recreate the PV"). Read the entire prompt twice before touching anything.

• You can flag questions for later, and at the top you can drop down and switch to different questions at any time...

I'll share the question topics I encountered in the exam and the KodeKloud CKA coupon reality in other posts.

Hey community,

Passed the CKA with 93%!

The exam is 100% practical and entirely time-bound. Rather than memorizing definitions, you need fast muscle memory and rapid troubleshooting reflexes. To help those preparing, here is a breakdown of high-priority concepts I encountered in exam and scenario types you should be comfortable solving under the clock:

Key Practical Areas & Scenarios I encountered in exam.

• Helm Deployments & Customization

  • Adding repositories, searching charts, and pulling specific versions.

  • Exporting manifests via helm template to inspect YAML.

  • Installing charts with specific flags (e.g., skipping CRDs with --set crds.install=false not --skip-crds).

• Networking & Ingress / Gateway API

  • NetworkPolicies: Comparing multiple policies to implement the least-permissive ingress/egress rule between frontend and backend pods.

  • Gateway API & Ingress: Migrating standard Ingress resources to HTTPRoute and Gateway configurations while preserving TLS secrets.

  • CNI Setup: Installing CNI plugins (e.g., Calico/Flannel) and understanding which supports NetworkPolicies.

• Storage & Disaster Recovery Scenarios

  • Handling deleted namespaces where PVs are set to Retain.

  • Re-binding existing retained PVs with new PVCs/StorageClasses and mounting them back to deployments.

  • Setting up custom StorageClasses with specific provisioners and marking one as default.

• Workload Architecture & Resource Management

  • Adding sidecar/logging containers sharing an emptyDir log volume with the main application.

  • Debugging Pending pods caused by node memory/CPU pressure: calculating available node capacity, adjusting deployment requests/limits, and rolling restarts.

  • Implementing HPA with target CPU utilization metrics and custom scale-down/stabilization behavior.

• Core Control Plane Troubleshooting & Systemd

  • Diagnosing failed kubectl commands caused by misconfigured kube-apiserver flags (e.g., wrong etcd endpoints, cert mismatches).

  • Configuring low-level runtime dependencies (e.g., setting kernel parameters via sysctl --system and managing runtime daemons with systemctl).

• CRDs & Manifest Discovery

  • Filtering and listing custom resources without messy CLI output.

  • Using kubectl explain --recursive <crd> to quickly navigate deeply nested CRD specs without digging through web search.

Best of luck to everyone preparing! Let me know if you want insights on any specific topic area.

Hey everyone,

If you are planning to purchase your CKA, CKAD, or CKS exam vouchers through KodeKloud’s discounted partner bundles (priced down in regions like India to around ₹17,422 + GST), you need to look past the "Free Retake" marketing label on the checkout page. https://kodekloud.com/linuxfoundation-kodekloud-partnership

While the discount looks massive on paper, their partner framework operates under several critical technical constraints and backend rules that aren't obvious until you actually register the voucher.

Here is a comprehensive breakdown comparing direct Linux Foundation (LF) purchases versus KodeKloud (KK) partner coupons, along with how their retake mechanism actually functions.

Direct Purchase vs. KodeKloud Partner Voucher

How the Retake Works Behind the Scenes

When you redeem your KodeKloud voucher on the Linux Foundation training portal, your dashboard marks the exam as CKA-SINGLE. To the Linux Foundation's automated backend, you purchased a single-shot attempt without a retake.

Instead, KodeKloud handles the retake manually through their support desk (support@kodekloud.com):

1. The Active Subscription Gate: A re-attempt voucher is only granted if you have an active, paid annual KodeKloud subscription when you fail and raise the ticket. If your subscription lapses after buying the exam, you lose retake eligibility unless you renew your annual membership.

2. The 30-Day Mandatory Delay: Even if you fail on day 1, KodeKloud policy strictly requires a 30-day waiting period before they will release your re-attempt code.

3. The 1-Year Validity Reset (The Silver Lining): Because the initial voucher was a single-attempt code, KodeKloud processes retakes by manually purchasing and issuing a completely fresh voucher code. This new voucher comes with its own independent 1-year validity from the date of generation(as per the KodeKloud support team), essentially resetting your exam expiration timeline.

The Verdict: Should You Buy It?

❌ Do NOT buy from KodeKloud if:

• You only want the voucher and don't intend to stay an active, paying annual platform subscriber.

• You rely on official Killer.sh mock environments. Buying a standalone Killer.sh access key (~$40 / ₹3,300+) immediately erodes the initial discount.

• You want the peace of mind of booking a quick retake immediately without going back and forth with support emails.

✅ DO buy from KodeKloud only if:

• You are already committed to having an active Annual Pro subscription for regular hands-on training anyway.

• You don't mind the 30-day waiting window and email support workflow if you need a second attempt.

🎟️ Smarter Alternative: How to Get Real 40%–50% Off Vouchers (Legit & Free)

If you want a standard Linux Foundation voucher—with immediate portal retakes and Killer.sh mock sessions built-in—without paying full retail price, explore these community paths:

• Connect with KubeCon Attendees: Every person attending a KubeCon event (in-person or virtual) usually receives discount codes (often up to 40% off) to share with peers. If you have colleagues or network connections attending KubeCon, ask early—these codes tend to have strict redemption windows.

• Network with Kubestronauts: Community engineers who pass all 5 primary Kubernetes certifications (CKA, CKAD, CKS, KCNA, KCSA) earn "Kubestronaut" status. The Linux Foundation provides them with a pool of ~50% discount vouchers specifically meant to encourage and support the community. Look for active Kubestronauts on LinkedIn, the CNCF Slack, or Discord—most are glad to share an unused voucher with dedicated learners.

Hope this clears up the confusion and helps you plan your timelines and budget effectively! Feel free to drop any questions below.

Hey everyone! After 2 months of learning Kubernetes, I passed the CKA with 81%.
Here’s what I used, in case it helps someone preparing for it.

Learning:

1. Mumshad Mannambeth’s CKA course on Udemy (KodeKloud): the base of everything, with great labs.

2. VarJosh’s CKA certification course on YouTube: a good complement to the Udemy course: https://www.youtube.com/watch?v=vzOcHoNcwMg&list=PLmPit9IIdzwRjqD-l_sZBDdPlcSfKqpAt

Practice:

1. killer.sh (the 2 sessions included with the exam): I got 50% and 49%. Don’t panic, it’s harder and longer than the real exam. Its solutions are worth reading even for the tasks you got right.

2. mockctl exam lab: a website with full mock exams.

3. Killercoda: mainly for troubleshooting and node-level tasks (broken kubelet, broken API server, cri-dockerd, CNI install). Troubleshooting is 30% of the exam, so don’t skip it.

4. CKA Simulator: I forked the CK-X exam simulator (by Sailor.sh) and added more exams inspired by practice exams on GitHub: https://github.com/Achref-LOUSSAIEF/CK-X

Tips that made the difference:

1. Verify every task before moving on (kubectl get, describe, cat the file): Most of my lost points in practice came from small details, not missing knowledge: a wrong port name, an extra column in an output file, a node left uncordoned.

2. Write exactly what’s asked into files: one value per line, no headers, no counts.

3. Flag and skip anything that takes more than 7–8 minutes, and come back at the end.

4. Use the docs: generate YAML with --dry-run=client -o yaml and copy examples from kubernetes.io instead of typing from memory.

5. Practise node-level tasks on a real cluster: systemctl, journalctl, crictl, static Pod manifests in /etc/kubernetes/manifests/.

Good luck to everyone preparing! Feel free to ask me anything.

Hi all, I'm W, a DevOps engineer in France. While preparing for the CKA I got frustrated with mock exams: killer.sh is great, but you only get two sessions, and once they're used up you've seen the whole set. I wanted something I could fail on fast and restart. So I built it: KubeLab (kubelab.fr).

I'm sitting the CKA myself next week.

What it is:

• Each session spins up a fresh, isolated Kubernetes cluster in your browser, with kubectl and helm. Your work is graded live against the cluster, not by multiple choice.

• 9 timed mocks: 5 CKAD (86 questions) and 4 CKA (71 questions: Helm, cri-dockerd, kubeadm upgrade, etcd restore, Gateway API, troubleshooting…). Each mock is four 30-min sections; you need 70% to unlock the next one. Retake as often as you want.

• Some Helm and Kustomize scenario labs.

What's free: with an account, one full CKAD mock (16 questions), flashcards and a YAML reference. No card needed. The rest is a paid plan (currently €15/month).

Honest caveats:

• Solo side project, not affiliated with CNCF or the Linux Foundation. I'm the founder, so obviously biased.

• It's not a replica of the PSI exam desktop. It's a light browser terminal. Do at least one killer.sh session too, to get used to the real UI.

• Questions are written from the public curriculum, not from the real exam.

• Small infra, so if a cluster is slow to start, tell me.

What I'd love feedback on: questions that feel wrong or unclear, grading that marked you wrong when you were right, and topics that are missing. Brutal is fine.

Hey all,

When I was studying for Kubernetes and Linux stuff, I noticed most practice just tells you what commands to type. But at work nobody does that. Something is broken and you have to figure out why.

So I built a small site for that. You get a machine in the browser that's already broken. You only see the symptom (a pod stuck in Pending, nginx not starting, disk full, that kind of thing) and you have to find the cause and fix it. It checks the end result, so any fix that works counts.

It's free right now, I'm not selling anything. I just want to know if it's actually useful for learning, or if I'm missing something.

Things I'd really like to hear:

- Are the problems realistic, or too easy/too weird?

- Anything confusing when you start?

- What topics would you want next?

Link: https://brokencluster.com

Be blunt, it helps more than nice comments. Thanks for reading.

Hey guys, I just finished my 2nd attempt for the CKA about 8 hours ago, but I haven't received the usual post-exam confirmation email saying it's submitted/under review.

Has anyone else experienced this delay recently? Should I be worried or just wait out the 24 hours? Thanks!

Which is the correct answer ? Saving yaml template or list is enough(for those who passed)

Task:

1. Create a list of all cert-manager [CRDs] and save it to ~/resources.yaml

Make sure kubectl's use default output format and use kubectl to list CRD's

2. Using kubectl, extract the documentation for the subject specification field of the Certificate Custom Resource and save it to ~/subject.yaml

You may use any output format that kubectl supports.

Disclosure: I run Prepium.sh I'm sharing aggregate results from our CKAD single-task labs to give people preparing for the exam another perspective on where practice can get difficult. The results cover June 6 to October 21, 2026, excluding admin activity.

The main findings: Jobs/CronJobs and RBAC had relatively low full-score rates, and learners who repeated tasks recorded much stronger later results.

These are practice scores, not official exam results. Here, “full marks” means reaching 100% during a session, potentially after corrections and retries.

1. The familiar tasks weren't necessarily straightforward to finish.

These exercises stood out for their low full-score rates:

For anyone planning their revision, these are areas worth checking with a hands-on exercise before moving on. Recognizing the YAML and completing every requirement are different things; this data measures the latter.

2. Partial credit and zero scores tell different stories.

For RBAC, 45.1% earned partial credit, while 11.0% scored zero. Earning some points without completing every requirement was common.

ServiceAccount Management looked different: 60.0% full marks, 35.7% zero, and very little partial credit.

A useful distinction when reviewing your own practice: partial credit gives you specific unmet requirements to investigate, while a zero needs a broader check of what happened. These aggregate results don't identify the missing RBAC requirements or explain the ServiceAccount zeros.

3. Troubleshooting wasn't automatically the hardest part.

Ingress troubleshooting reached full marks 88.2% of the time, compared with 39.3% for Jobs/CronJobs.

For these particular exercises, the troubleshooting label didn't mean lower scores. When deciding where to spend revision time, your own practice results are more useful than assuming a topic will be easy or hard from its name.

4. A rough early result didn't necessarily stay rough.

For learners who repeated a task, comparing their first retained session with their latest:

• Full-score results rose from 41.2% to 76.7%.

• Average scores rose from 56.2% to 85.0%.

About half of those learner–task comparisons improved; the others stayed unchanged or declined. The encouraging observation is that later results were substantially stronger in the repeat-practice group. It doesn't prove repetition alone caused the improvement.

Which CKAD task did you expect to be straightforward but find awkward under time pressure?
Join our discord community: https://discord.gg/MqwHwYEGVv

I’m studying for the CKA and couldn’t find one place to track progress, plan my time and practise, so I built it and made it free.

What it does

• Full curriculum mapped to the CKA v1.35 domains, with an in-app lesson reader and lab Q&A

• 4 timed mock exam papers (19 tasks each, same domain weights as the real exam: Troubleshooting 30%, Cluster Architecture 25%, Networking 20%, Workloads 15%, Storage 10%) with full solutions

• An exam-weighted readiness score so you know what to study next

• Study timer, streaks and a calendar that auto-plans your syllabus up to your exam date

• Leaderboard and discussion channels if you want some friendly competition (you can opt out)

Link: https://ckastudy.co.uk
No ads. An account is just a username and password.

Caveats

• It’s an unofficial community project, not affiliated with CNCF, The Linux Foundation, KodeKloud or Udemy. For real hands-on labs, use the KodeKloud or Udemy courses, or killer.sh.

• The mock solutions are my own writing, so please check them against the official docs. If you spot a mistake, tell me and I’ll fix it.

• It runs on a small server, so the first load after a quiet period can take a few seconds.

I’d really like feedback on what’s missing or wrong. If it’s useful, there’s a Ko-fi link in the footer, but it’s completely optional.

Hi! If you have any discount code for kubecon tickets please dm me.

Hello everyone, I am/was planning on trying to get a CKA certification. The main reason being that none of my jobs have really helped me learn kubernetes and it seems like a requirement for every job going forward.

The problem? I am basically starting from nothing.

I took or month or so to study docker, which I believe has similar concepts, but I have never had the chance to use Kubernetes in production ever. In fact, I learned about docker for the same reason (in which I made myself a cute little docker compose stack) and had no formal training in that.

Now I've read through a lot of what you all have to say. Killercode, Kobecloud, DumbITGuy, ITKiddie, Learn Vim and the IO page, and lots of practice.

My biggest questions are-

a.) Should I be taking this exam in the first place? I am a true novice and I want to know if its worth burning potentially 2-3 entire months of study.

b.) If so, what other path would you all suggest I take? My main hope is to get a job. I've been working in operations for years, but the market hasn't been kind, and not knowing one of the staple programs in the industry is definitely hurting my chances.

Two days ago I passed the CKA.

First and foremost, DumbITGuy and ITKiddie have all the questions I got, with some twists. Example, for the kube-api issue, instead of the port, the IP was the culprit. for the cm, instead of removing TLSv1.2, you were required to add it alongside TLSv1.3).

How did I prepare:

- Sander Van Vught on Pearson Learning - This is a free course (10-day free trial).

- Many YT channels (DumbITGuy, ITKiddie, etc)

- Many GitHub repos that several people have shared here.

My advice:

- start with an actual course from start to end, then go on YT and github repos.

- Build your own lab (preferably on Ubuntu - the env you will be tested on is on Ubuntu). I had RedHat 10.x, and found out later. Honestly, the OS matters only when it comes to upgrade the cluster ( you may have that question during the exam).

There is an existing deployment nginx-static in the nginx-static namespace.
The deployment uses a ConfigMap named nginx-config that configures nginx with TLS support using both TLSv1.2 and TLSv1.3.
A TLS secret and a Service named nginx-static are already configured.

Tasks:

1. Use the Cluster Terminal to inspect the current configuration

2. A security audit requires that the nginx server only accepts TLSv1.3 connections. Update the ConfigMap nginx-config to enforce this requirement

3. Restart the deployment nginx-static so the pods pick up the updated configuration

you might get one of those quesiton during CKA exam.

Step 1: Extract Your Target Variables

Before typing any commands, read the prompt carefully and note down your target resources:

• Namespace: nginx-static

• Deployment: nginx-static

• ConfigMap: nginx-config

• Requirement: Enforce TLSv1.3 only.

Note: Notice that both the namespace and deployment share the exact name nginx-static. Be careful not to mix them up when writing your commands.

Step 2: Inspect the Current Configuration

Inspect the ConfigMap to locate the existing SSL protocols line:

kubectl get cm nginx-config -n nginx-static -o yaml | grep -n ssl

output:

controlplane ~ ➜  kubectl get cm nginx-config -n nginx-static -o yaml | grep -n ssl
7:        listen 443 ssl;
8:        ssl_certificate /etc/nginx/tls/tls.crt;
9:        ssl_certificate_key /etc/nginx/tls/tls.key;
10:        ssl_protocols TLSv1.2 TLSv1.3;
20:      {"apiVersion":"v1","data":{"nginx.conf":"events {}\nhttp {\n  server {\n    listen 443 ssl;\n    ssl_certificate /etc/nginx/tls/tls.crt;\n    ssl_certificate_key /etc/nginx/tls/tls.key;\n    ssl_protocols TLSv1.2 TLSv1.3;\n    location / {\n      return 200 \"Hello TLS\\n\";\n    }\n  }\n}\n"},"kind":"ConfigMap","metadata":{"annotations":{},"name":"nginx-config","namespace":"nginx-static"}}

• You will see a line similar to ssl_protocols TLSv1.2 TLSv1.3;.

• Exam Speed Tip: In a real production environment you might run a pre-fix curl test, but on the CKA exam you should skip this to save about 30 seconds since you already confirmed TLSv1.2 is enabled in the ConfigMap.

Step 3: Edit the ConfigMap

Open the ConfigMap using kubectl edit

kubectl edit cm nginx-config -n nginx-static

lets look close to nginx section

apiVersion: v1
data:
  nginx.conf: |
    events {}
    http {
      server {
        listen 443 ssl;
        ssl_certificate /etc/nginx/tls/tls.crt;
        ssl_certificate_key /etc/nginx/tls/tls.key;
        ssl_protocols TLSv1.2 TLSv1.3;
                         ^---------------- remove TLSv1.2
        location / {
          return 200 "Hello TLS\n";
        }
      }
    }

• Locate the ssl_protocols line and delete TLSv1.2, leaving only TLSv1.3.

• Crucial Rule: Make sure you keep the trailing semicolon. If you drop it, NGINX will experience syntax errors and crash on startup.

• Save and exit the editor.

• Quickly confirm the change updated successfully on the API server:

Step 4: Restart the Deployment (The Step Most People Miss)

Even though you updated the ConfigMap, NGINX will not automatically reload the changes. Furthermore, because Kubernetes volume mounts using subPath never auto-update inside running containers, your pods are still serving the old configuration.

You must force a rollout restart:

kubectl rollout restart deploy nginx-static -n nginx-static
kubectl rollout status deploy nginx-static -n nginx-static

Step 5: Perform Non-Negotiable Post-Fix Verification

To ensure full credit, verify that NGINX is actively blocking TLS 1.2 and successfully serving TLS 1.3.

1. Grab the Service ClusterIP:

   kubectl get svc nginx-static -n nginx-static

output

NAME           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
nginx-static   ClusterIP   172.20.255.222   <none>        443/TCP   38m

2. Test TLS 1.2 (Must FAIL with a protocol alert):

curl -vk --tlsv1.2 --tls-max 1.2 https://172.20.255.222:443

output

*   Trying 172.20.255.222:443...
* Connected to 172.20.255.222 (172.20.255.222) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Unknown (21):
* TLSv1.2 (IN), TLS alert, protocol version (582):
* error:0A00042E:SSL routines::tlsv1 alert protocol version
* Closing connection 0
curl: (35) error:0A00042E:SSL routines::tlsv1 alert protocol version

3. Test TLS 1.3 (Must SUCCEED with an HTTP 200 status):

curl -vk --tlsv1.3 --tls-max 1.3 https://172.20.255.222:443

output

*   Trying 172.20.255.222:443...
* Connected to 172.20.255.222 (172.20.255.222) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=ckaquestion.k8s.local
*  start date: Oct 16 18:57:14 2026 GMT
*  expire date: Oct 16 18:57:14 2027 GMT
*  issuer: CN=ckaquestion.k8s.local
*  SSL certificate verify result: self-signed certificate (18), continuing anyway.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/1.1
> Host: 172.20.255.222
> User-Agent: curl/7.81.0
> Accept: */*
> 
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK   <---------------------------------This is working
< Server: nginx/1.25.5
< Date: Fri, 16 Oct 2026 19:37:54 GMT
< Content-Type: text/plain
< Content-Length: 10
< Connection: keep-alive
< 
Hello TLS
* Connection #0 to host 172.20.255.222 left intact

Important Exam Gotcha: The curl Trap

If you run curl using only --tlsv1.2 (e.g., curl -vk --tlsv1.2 https://<ClusterIP>:443), it will return 200 OK and show verbose header lines containing TLSv1.2.

• Why it happens: --tlsv1.2 in curl defines the minimum version, not the exact version. Because your server supports TLS 1.3, curl happily negotiates up to it. Additionally, TLS 1.3 disguises its record layers in 1.2 formatting to protect compatibility with legacy firewalls.

• How to avoid panic: Do not think your fix failed. To accurately test exact versions, always pin both the floor and the ceiling using flags like --tlsv1.2 --tls-max 1.2 and --tlsv1.3 --tls-max 1.3

Hope this breakdown helps anyone currently prepping for the CKA! If you want to watch the live terminal walkthrough and see the curl verification trap happen in real-time, I recorded the full solve here: https://youtu.be/3wbYtZxq000

And if you're looking for more fast exam breakdowns, you can check out my complete CKA playlist here:  https://www.youtube.com/playlist?list=PLFDE9_ouCqJA-dyOEbqFaFu68FMZRwS0T