Exam-day habits: vim, docs, time

A vim setup that behaves in the exam terminal, a time budget per task weight, the read-twice and verify-once routine, how to search the docs, the trap list, and what to do the night before and the morning of.

Most CKA failures are not knowledge failures. They are a Deployment created in the wrong namespace, a YAML file with a tab in it, a NodePort outside the allowed range, twenty minutes sunk into a 4% task, or a question answered as remembered rather than as written. These habits are cheap to build on the lab and expensive to skip. Both tasks at the end are deliberately small; the point is the routine, not the Kubernetes.

vim that behaves

cat > ~/.vimrc <<'EOF'
set ts=2 sw=2 et nu
EOF
# ts=2  tabstop: a tab displays as two columns
# sw=2  shiftwidth: > and < indent by two spaces
# et    expandtab: the Tab key inserts spaces, never a tab character (YAML rejects tabs)
# nu    line numbers, so error messages like "line 23" mean something

# Inside vim:
#   :set paste        before pasting from the docs (stops auto-indent from staircasing the text)
#   :set nopaste      after, or your Tab key and indentation stop working
#   Ctrl+v  j j j  >  select a block of lines, indent them one shiftwidth; . repeats it
#   Ctrl+v  j j j  <  outdent
#   :%s/old/new/g     replace everywhere; :%s/\t/  /g turns tabs into two spaces
#   :set list         show tabs as ^I so you can find them; :set nolist to hide again
#   u / Ctrl+r        undo / redo;  :w  save;  :q!  quit without saving

The remote desktop has its own clipboard rules: copy and paste in the terminal are Ctrl+Shift+C and Ctrl+Shift+V (or the right-click menu), while Firefox uses the usual Ctrl+C and Ctrl+V. Ctrl+W closes the browser tab you are testing in, so close terminal tabs with Ctrl+Alt+W instead. The Insert key is prohibited in the exam interface; enter insert mode in vim with i and leave it with Esc. tmux is optional: it is nice for a second pane watching kubectl get pods -w, but if you do not already use it daily, a second terminal tab does the same job without new muscle memory on exam day.

Time: one minute per percentage point

Read twice, verify once

• —Read the whole task before typing. Then read it again and note the nouns: namespace, names, image tag, replica count, file path, label keys. Half the tasks hide one more requirement in the last sentence.
• —Copy names from the question, never retype them. Select in the question panel, paste into the terminal. web-api and web-apl both look right at 90 minutes in.
• —Host and context first. Follow the infobox: ssh to the named host, and if a context or namespace is given, switch to it before any other command. When the task is done, exit back to the base host.
• —Set the namespace once if the task lives in one: k config set-context --current --namespace=<ns>. Remember you did it; the next task on the same host inherits it.
• —Verify end state, not intent. k get deploy web -n ns -o wide for replicas and image, k get pods -n ns -l app=web for Running, k rollout status for a rollout, cat for a file, k auth can-i ... --as=... for RBAC, curl for a Service or an Ingress.
• —Grep the live object when the question lists fields: k get pod web -o yaml | grep -E 'image:|serviceAccountName|nodeName|tier'. It takes five seconds and catches the wrong tag, the missing label and the Pod that landed on the wrong node.
• —Leave the cluster the way you found it except for what the task asked. A node you cordoned to test something, a tmp Pod you forgot, a namespace switch you did not undo: all of these can break the grader's assumptions on a later task.

The trap list

• —Wrong namespace. The object exists, it works, and the grader looks in the namespace the question named. -n on every command or set it in the context.
• —Wrong host or context. Same symptom, worse cause. Infobox first, always.
• —No rollout status. You changed the image and moved on; the new Pods never became ready because the tag was wrong; the grader sees the old image still serving. Wait for the rollout, then check -o wide.
• —Editing an immutable Pod field. kubectl edit pod refuses to change volumes, container names, nodeName and more. Write the YAML to a file (k get pod X -o yaml > p.yaml), edit, then k replace --force -f p.yaml. For Pods owned by a Deployment, edit the Deployment instead.
• —NodePort range. 30000 to 32767 by default. A question asking for port 3080 means something else (probably the Service port).
• —maxUnavailable and maxSurge rounding. Percentages round down for maxUnavailable and up for maxSurge. With 3 replicas and 25%, that is 0 unavailable and 1 surge. If a question needs an exact count, write the integer.
• —Secret values. data is base64; stringData is plain text and gets encoded for you. kubectl create secret encodes for you. If you encode by hand, echo -n, or the newline becomes part of the password.
• —Tabs in YAML. expandtab in vim; if a paste went wrong, :%s/\t/ /g.
• —Selector and labels that do not match. A Service with no endpoints, a NetworkPolicy that selects nothing, a Deployment that refuses to create. Compare spec.selector with the Pod template labels character by character.
• —Container name in set image. k set image deploy/web nginx=nginx:1.26 needs the container's name, not the image name. k get deploy web -o jsonpath='{.spec.template.spec.containers[*].name}'.
• —Files in the wrong place. The exact path from the question, created with mkdir -p for the directory, checked with cat. The grader does not search for your file.
• —Forgetting sudo -i on a node and then wondering why /etc/kubernetes/manifests is empty or journalctl -u kubelet shows nothing.

• —The night before: confirm the name on your government-issued photo ID with signature exactly matches your Linux Foundation account; run PSI's system check and the Secure Browser test from the handbook; make sure you have one monitor, a webcam you can move to show the room, and a quiet private room with walls, a door you can close, a clear desk and no bright light or window behind you; uninstall or disable anything that would be flagged (second display, screen-sharing tools); decide which language you want the questions in; sleep.
• —The morning of: eat beforehand, because eating and gum are not allowed during the exam; water in a clear, label-free bottle or glass is. Phone and notes out of the room. Click Take Exam up to 30 minutes early; check-in means an ID photo, a selfie, the agreement and a live room and workspace scan with a check-in specialist, and the wait should not exceed 15 minutes. The handbook does not describe breaks and you may not leave the camera view without the proctor's permission, so plan for none; the clock does not stop either way. Watch or hide the interface tour, and the clock starts.
• —First two minutes: aliases, the vimrc above, k get nodes on the first host to make sure the terminal is yours. Then task one, read twice.