CKA: Networking & Storage

Services, DNS, and Ingress

Service types: ClusterIP (internal), NodePort (exposes 30000–32767 on every node), LoadBalancer (cloud LB), ExternalName (CNAME). A Service selects pods by label into EndpointSlices — mismatched labels mean kubectl get endpoints svc shows <none>, the single most common service failure.

DNS names follow <service>.<namespace>.svc.cluster.local; cross-namespace calls must include the namespace. Ingress needs a controller (ingress-nginx) and usually ingressClassName — a manifest alone routes nothing.

Connectivity triage order: endpoints populated? → DNS from a debug pod (kubectl run tmp --rm -it --image=busybox -- nslookup svc.ns) → NetworkPolicy → kube-proxy programming (kubectl get ds -n kube-system kube-proxy, iptables rules).

Persistent Storage

Binding chain: PVC requests storage → matches a PV (static) or triggers a StorageClass provisioner (dynamic) → Pod mounts the claim.

volumes:
- name: data
  persistentVolumeClaim: { claimName: app-data }
containers:
- name: app
  volumeMounts: [{ name: data, mountPath: /var/lib/app }]

PVC essentials: access modes ReadWriteOnce (single node), ReadWriteMany (NFS/CSI supporting it), ReadOnlyMany; storageClassName: fast selects the class (kubectl get sc — note the default marked (default)); expansion requires allowVolumeExpansion: true on the class, then edit the PVC size. volumeBindingMode: WaitForFirstConsumer delays binding until scheduling so zonal constraints resolve correctly.

Pitfalls and Interview Angles

PVC stuck Pending: no StorageClass matching the request, no free PV for static binding, zone mismatch (immediate binding chose the wrong zone), or the access mode nobody can satisfy. kubectl describe pvc states the reason.

PVC Terminating/Released: reclaimPolicy: Retain leaves PVs Released after claim deletion — data preserved, but manual reclaim (inspect, delete PV, rebind) is required.

RWO conflicts: a volume attached to node A cannot mount on node B — StatefulSet rescheduling to another node waits on detach.

Ingress 404 everywhere: missing/wrong ingressClassName or no controller running — check kubectl get ingressclass.

Interview angle: diagnose "connection refused from pod A to service B" stepwise (endpoints → selector/targetPort → DNS → policy), and walk PVC Pending from claim to class to provisioner.