Room 99

EXIT EXAM - THE GRAND ESCAPE

The Ultimate Challenge

• You’ve fought through 56 rooms of Kubernetes mastery.
• This is your final test. No hints. No hand-holding.
• Complete all tasks from memory to prove you are a true Kubernetes master.

Challenge 1: Cluster Bootstrap

Token: k8

Create a Kind cluster named final-exam with:

• 1 control-plane node
• 2 worker nodes
• Port mappings: host 80 → container 30080, host 443 → container 30443

Verify all nodes are Ready.

Expected: 3 nodes in Ready state

Challenge 2: Namespace Architecture

Token: s

Create these namespaces with appropriate labels:

Apply a default deny-all NetworkPolicy to each namespace, then selectively allow:

• frontend → backend (port 8080)
• backend → data (port 5432)
• monitoring → all namespaces (port 9090)

Challenge 3: RBAC & Security

Token: m

Set up these service accounts and permissions:

Verify:

• frontend-sa can list pods in frontend but NOT in backend
• platform-admin can list pods everywhere but cannot delete anything

Challenge 4: Stateful Application

Token: a

Deploy a StatefulSet in the data namespace:

• Name: exam-db
• 3 replicas
• Headless Service: exam-db-headless
• Each pod gets a 1Gi PVC
• Pods must start in order (0, 1, 2)

Verify:

• All 3 pods are running with stable network identities
• exam-db-0.exam-db-headless.data.svc.cluster.local resolves

Challenge 5: Application Deployment

Token: s

Deploy in the frontend namespace:

• Deployment: web-app with 3 replicas
• Rolling update: maxUnavailable=1, maxSurge=1
• Readiness probe: HTTP GET / port 80, every 5s
• Liveness probe: HTTP GET /healthz port 80, every 10s
• Resource requests: 50m CPU, 64Mi memory
• Resource limits: 100m CPU, 128Mi memory

Deploy in the backend namespace:

• Deployment: api-server with 2 replicas
• Environment from ConfigMap api-config and Secret api-secret
• Anti-affinity: prefer spreading across nodes

Create services for both deployments.

Challenge 6: Ingress & Traffic

Token: t

Install the NGINX Ingress Controller and create ingress rules:

Test with:

curl -H "Host: exam.local" http://localhost/
curl -H "Host: exam.local" http://localhost/api

Challenge 7: Jobs & CronJobs

Token: e

Create in the backend namespace:

• Job: db-migration - runs once, must complete within 60s, retry up to 3 times
• CronJob: health-check - runs every 5 minutes, checks if api-server is responding, keeps last 3 successful and 1 failed job

Verify the Job completes and the CronJob schedules correctly.

Challenge 8: Autoscaling

Token: r

Configure:

• HPA for web-app: min 2, max 10, target CPU 50%
• HPA for api-server: min 1, max 5, target CPU 60%

Generate load and verify the HPAs scale up:

kubectl run load-gen --image=busybox:1.36 --restart=Never -- \
  sh -c "while true; do wget -q -O- http://web-app-svc.frontend.svc.cluster.local; done"

Verify pods scale beyond the initial replica count.

Challenge 9: Observability

Token: 5

Set up:

• Metrics-server (patched for Kind with --kubelet-insecure-tls)
• Resource monitoring: kubectl top nodes and kubectl top pods -A must work
• Log aggregation: Create a DaemonSet that collects container logs from /var/log/containers/ and writes summaries to a shared volume

Verify:

• kubectl top nodes shows CPU and memory usage
• kubectl top pods -A shows all pod metrics
• The log aggregator DaemonSet has a pod on every node

Challenge 10: Disaster Recovery

Token: 6

Prove you can recover from failure:

1. Take an etcd snapshot (from the Kind control-plane node).
2. Delete the frontend namespace and all its resources.
3. Restore from the etcd snapshot.
4. Verify the frontend namespace and web-app deployment are back.

OR (if etcd restore is not feasible in Kind):

1. Export all resources from frontend namespace to YAML.
2. Delete the namespace.
3. Recreate everything from the exported YAML.
4. Verify full recovery.

Assemble the Password

Collect all tokens from the 10 challenges:

Final Password: k8smaster56