CKA: Certified Kubernetes Administrator — Panduan Lengkap

# ============================================
# STEP 1: Prepare semua node (master + worker)
# ============================================

# Disable swap (wajib untuk Kubernetes)
sudo swapoff -a
sudo sed -i '/ swap / s/^/#/' /etc/fstab

# Load kernel modules
cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

# Sysctl settings untuk networking
cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

sudo sysctl --system

# Install containerd
sudo apt-get update
sudo apt-get install -y containerd

# Configure containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml
# Edit: SystemdCgroup = true
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' \
  /etc/containerd/config.toml

sudo systemctl restart containerd
sudo systemctl enable containerd

# Install kubeadm, kubelet, kubectl
sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl

curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | \
  sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] \
  https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | \
  sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

# ============================================
# STEP 2: Initialize control plane (master)
# ============================================
sudo kubeadm init --pod-network-cidr=10.244.0.0/16 \
  --apiserver-advertise-address=<MASTER_IP>

# Setup kubectl untuk user
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# ============================================
# STEP 3: Install CNI (network plugin)
# ============================================
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

# ============================================
# STEP 4: Join worker nodes
# ============================================
# Di setiap worker node, jalankan join command dari output kubeadm init:
sudo kubeadm join <MASTER_IP>:6443 \
  --token <TOKEN> \
  --discovery-token-ca-cert-hash sha256:<HASH>

# Verifikasi cluster
kubectl get nodes
kubectl get pods -A

# 1. Buat ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-deployer
  namespace: production

---
# 2. Buat Role (permission di namespace tertentu)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deploy-role
  namespace: production
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "create", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["get", "list"]

---
# 3. Bind Role ke ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployer-binding
  namespace: production
subjects:
  - kind: ServiceAccount
    name: app-deployer
    namespace: production
roleRef:
  kind: Role
  name: deploy-role
  apiGroup: rbac.authorization.k8s.io

# ============================================
# ClusterRole (cluster-wide, bukan per namespace)
# ============================================
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]

# Backup etcd
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Verifikasi backup
ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-snapshot.db \
  --write-table

# Restore etcd dari backup
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db \
  --data-dir=/var/lib/etcd-restored \
  --name=master1 \
  --initial-cluster=master1=https://127.0.0.1:2380 \
  --initial-advertise-peer-urls=https://127.0.0.1:2380

# Update etcd manifest untuk point ke data restored
# Edit /etc/kubernetes/manifests/etcd.yaml
# Ganti --data-dir ke /var/lib/etcd-restored

# ============================================
# IMPERATIVE COMMANDS — Lebih cepat dari YAML!
# Di ujian, gunakan imperative command untuk hemat waktu
# ============================================

# Create deployment
kubectl create deployment nginx --image=nginx:1.25 --replicas=3

# Create service (expose deployment)
kubectl expose deployment nginx --port=80 --type=ClusterIP

# Create namespace
kubectl create namespace production

# Create ConfigMap
kubectl create configmap app-config \
  --from-literal=DB_HOST=mysql.prod.svc \
  --from-literal=DB_PORT=3306

# Create Secret
kubectl create secret generic db-creds \
  --from-literal=username=admin \
  --from-literal=password='S3cur3P@ss!'

# Generate YAML tanpa apply (untuk edit dulu)
kubectl create deployment nginx --image=nginx --dry-run=client -o yaml > deploy.yaml

# Scale deployment
kubectl scale deployment nginx --replicas=5

# Rolling update
kubectl set image deployment/nginx nginx=nginx:1.26

# Rollback
kubectl rollout undo deployment/nginx

# Check rollout status
kubectl rollout status deployment/nginx

# Label node
kubectl label node worker1 disk=ssd

# Taint node (prevent scheduling)
kubectl taint node worker1 maintenance=true:NoSchedule

# Remove taint
kubectl taint node worker1 maintenance=true:NoSchedule-

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: "production"
  LOG_LEVEL: "info"
  config.json: |
    {
      "database": "mysql://db:3306/app",
      "cache": "redis://cache:6379"
    }

---
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  DB_PASSWORD: cGFzc3dvcmQxMjM=   # base64 encoded "password123"
  API_KEY: c2VjcmV0LWtleQ==        # base64 encoded "secret-key"

---
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
    - name: app
      image: myapp:1.0
      # Environment variables dari ConfigMap
      envFrom:
        - configMapRef:
            name: app-config
      # Individual env dari Secret
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: DB_PASSWORD
      # Volume mount ConfigMap sebagai file
      volumeMounts:
        - name: config-volume
          mountPath: /app/config
  volumes:
    - name: config-volume
      configMap:
        name: app-config

apiVersion: v1
kind: Pod
metadata:
  name: critical-app
spec:
  containers:
    - name: app
      image: myapp:1.0
      resources:
        requests:
          memory: "128Mi"
          cpu: "250m"
        limits:
          memory: "256Mi"
          cpu: "500m"
  # Node affinity — schedule ke node dengan SSD
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: disk
                operator: In
                values:
                  - ssd

  # Tolerations — schedule ke tainted node
  tolerations:
    - key: "maintenance"
      operator: "Equal"
      value: "true"
      effect: "NoSchedule"

# Default deny semua ingress di namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress

---
# Izinkan ingress hanya dari namespace tertentu
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend
        - podSelector:
            matchLabels:
              app: web
      ports:
        - protocol: TCP
          port: 8080

---
# Izinkan egress ke DNS dan database
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Egress
  egress:
    # Allow DNS
    - to: []
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Allow database
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 3306

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080
          - path: /web
            pathType: Prefix
            backend:
              service:
                name: web-service
                port:
                  number: 80

# Persistent Volume (dibuat oleh admin)
apiVersion: v1
kind: PersistentVolume
metadata:
  name: local-pv
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /mnt/data

---
# Persistent Volume Claim (dibuat oleh developer)
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: app-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi

---
# Pod menggunakan PVC
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
    - name: app
      image: nginx
      volumeMounts:
        - name: data
          mountPath: /usr/share/nginx/html
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: app-pvc

---
# StorageClass (dynamic provisioning)
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp3
  iopsPerGB: "10"
reclaimPolicy: Delete
allowVolumeExpansion: true

# ============================================
# NODE TROUBLESHOOTING
# ============================================

# Cek node status
kubectl get nodes -o wide
kubectl describe node <node-name>

# Cek node conditions
kubectl get nodes -o json | jq '.items[]|.status.conditions'

# SSH ke node (jika perlu)
ssh <node-ip>

# Cek kubelet status di node
sudo systemctl status kubelet
sudo journalctl -u kubelet -f

# Restart kubelet
sudo systemctl restart kubelet

# ============================================
# CONTROL PLANE TROUBLESHOOTING
# ============================================

# Cek control plane pods
kubectl get pods -n kube-system

# Cek specific component
kubectl describe pod kube-apiserver-master -n kube-system
kubectl logs kube-apiserver-master -n kube-system

# Cek static pods manifests
ls /etc/kubernetes/manifests/

# Cek etcd health
ETCDCTL_API=3 etcdctl endpoint health \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# ============================================
# POD TROUBLESHOOTING
# ============================================

# Cek pod status
kubectl get pods -o wide
kubectl describe pod <pod-name>

# Cek logs
kubectl logs <pod-name>
kubectl logs <pod-name> -c <container-name>  # multi-container pod
kubectl logs <pod-name> --previous            # logs dari crashed container
kubectl logs <pod-name> -f                    # follow/stream logs

# Execute ke dalam pod
kubectl exec -it <pod-name> -- /bin/sh

# Cek events
kubectl get events --sort-by='.lastTimestamp'

# ============================================
# NETWORKING TROUBLESHOOTING
# ============================================

# Cek service endpoints
kubectl get svc
kubectl describe svc <service-name>
kubectl get endpoints <service-name>

# DNS troubleshooting
kubectl run debug --image=busybox:1.36 --rm -it -- nslookup kubernetes
kubectl run debug --image=busybox:1.36 --rm -it -- nslookup <service-name>.<namespace>.svc.cluster.local

# Cek CoreDNS
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl logs -n kube-system -l k8s-app=kube-dns

# Cek NetworkPolicy
kubectl get networkpolicy -A

# Set di awal ujian (simpan 5 menit!)
alias k=kubectl
export do="--dry-run=client -o yaml"
alias kgp="kubectl get pods"
alias kgs="kubectl get svc"
alias kgn="kubectl get nodes"

# Generate YAML cepat
k create deploy nginx --image=nginx $do > deploy.yaml
k run pod1 --image=nginx $do > pod.yaml
k expose deploy nginx --port=80 $do > svc.yaml

# Vim settings (jika perlu edit YAML)
# Klik tombol "Settings" di exam environment
# Paste:
set tabstop=2
set shiftwidth=2
set expandtab
set number

# Shortcut generate resource dari existing
k get deploy nginx -o yaml > nginx-deploy.yaml

# Quick edit tanpa generate file
k edit deploy nginx

# Install Kind (Kubernetes in Docker) — untuk latihan lokal
# Kind memungkinkan kamu buat cluster multi-node di laptop

# Install kind
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind

# Buat multi-node cluster
cat > kind-config.yaml <<'EOF'
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
  - role: worker
EOF

kind create cluster --config kind-config.yaml --name cka-practice

# Verifikasi
kubectl get nodes
kubectl get pods -A

# Latihan CKA tasks di sini!
# Cluster Kind sangat ringan (berjalan di Docker container)