On This Page
Tap to expand

In hands-on, performance-based exams like the Certified Kubernetes Administrator (CKA) and CKAD, your biggest bottleneck isn’t knowing the concepts—it’s time management.

Typing out YAML manifests from scratch or hunting through official docs for syntax during the exam is the easiest way to lose precious minutes.

Top scorers rely on quick muscle memory, imperative command generators, fast namespace switching, and battle-tested troubleshooting one-liners.

Here is a practical, no-fluff kubectl CLI Speed Cheat Sheet you can use during your exam prep and daily cluster operations.

1. Fast Shell Setup (Day 1 Exam Muscle Memory)

When your terminal session loads, configure these essential shortcuts immediately:

BASH 5 lines
# 1. Main kubectl alias
alias k=kubectl

# 2. Fast YAML Generator shortcut
export do="--dry-run=client -o yaml"

Tip: In the Linux Foundation terminal environment, kubectl bash completion is already enabled by default. Creating alias k=kubectl and having $do handy gives you immediate speed without clutter.

2. Namespace & Context Switching

Avoid typing -n <namespace> at the end of every command. If a question gives you multiple tasks in one namespace, switch your current context to that namespace right away:

BASH 6 lines
# Set default namespace for current context
k config set-context --current --namespace=finance

# Verify current context & active namespace
k config get-contexts
k config current-context

3. Imperative YAML Generators (Never Write YAML From Scratch)

Always generate a base manifest using $do (--dry-run=client -o yaml) and redirect to a file or pipe into kubectl apply.

3.1. Pods

BASH 8 lines
# Basic Nginx Pod
k run nginx-pod --image=nginx $do > pod.yaml

# Pod with custom command and arguments
k run busybox-pod --image=busybox --restart=Never $do -- /bin/sh -c "sleep 3600" > pod.yaml

# Pod with labels and exposed container port
k run web --image=httpd:alpine --port=80 --labels="tier=frontend,app=web" $do > web-pod.yaml

3.2. Deployments & Scaling

BASH 10 lines
# Create Deployment with 3 replicas
k create deployment web-deploy --image=nginx:1.25 --replicas=3 $do > deploy.yaml

# Scale deployment on the fly
k scale deployment web-deploy --replicas=5

# Update image and check rollout history
k set image deployment/web-deploy nginx=nginx:1.26
k rollout status deployment/web-deploy
k rollout undo deployment/web-deploy

3.3. Exposing Services (ClusterIP, NodePort, LoadBalancer)

BASH 8 lines
# Expose Deployment as ClusterIP (Port 80 -> TargetPort 8080)
k expose deployment web-deploy --port=80 --target-port=8080 --name=web-service

# Expose as NodePort with YAML export
k expose deployment web-deploy --type=NodePort --port=80 --target-port=80 --name=web-np $do > svc-nodeport.yaml

# Direct Service creation
k create service clusterip backend-svc --tcp=8080:8080 $do > svc.yaml

4. Ingress & Gateway API

Networking questions frequently ask for path-based routing, TLS termination, or modern Gateway API setups.

4.1. Ingress Imperative Creation

BASH 10 lines
# Create basic Ingress with host and path routing
k create ingress web-ingress \
  --rule="app.example.com/api*=backend-svc:8080" \
  --rule="app.example.com/*=web-service:80" \
  $do > ingress.yaml

# Ingress with default backend
k create ingress simple-ingress \
  --default-backend=fallback-svc:8080 \
  $do > ingress-default.yaml

4.2. Ingress Manifest Template (Host + TLS + Annotations)

YAML 23 lines
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
      - secure.example.com
    secretName: tls-secret
  rules:
  - host: secure.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

4.3. Gateway API (Modern Kubernetes Routing)

Kubernetes Gateway API separates routing (HTTPRoute) from gateway infrastructure (Gateway):

YAML 28 lines
# 1. Gateway definition
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-gateway
spec:
  gatewayClassName: eg-gateway-class
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
# 2. HTTPRoute definition
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
spec:
  parentRefs:
  - name: prod-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    backendRefs:
    - name: backend-svc
      port: 8080

5. ConfigMaps, Secrets & Environment Variables

BASH 13 lines
# ConfigMap from literal values
k create configmap app-config --from-literal=DB_HOST=10.0.0.5 --from-literal=DB_PORT=5432

# ConfigMap from an existing configuration file
k create configmap nginx-conf --from-file=nginx.conf

# Secret from literal password or env file
k create secret generic db-secret --from-literal=password=SuperSecret123
k create secret generic app-secret --from-env-file=.env

# Inject ConfigMap or Secret directly into a Deployment's env
k set env deployment/web-deploy --from=configmap/app-config
k set env deployment/web-deploy --from=secret/db-secret

6. Storage Essentials: PersistentVolume & PersistentVolumeClaim

When asked to bind storage to a pod, generate your PVC quickly:

YAML 11 lines
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: standard

Mounting inside a Pod:

YAML 11 lines
spec:
  volumes:
  - name: storage-vol
    persistentVolumeClaim:
      claimName: data-pvc
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: storage-vol
      mountPath: /var/data

7. Security, RBAC & ServiceAccounts

Role-Based Access Control questions are guaranteed points if you know the imperative syntax:

BASH 16 lines
# 1. Create a ServiceAccount
k create serviceaccount app-sa

# 2. Create a Role with specific resource access
k create role pod-reader --verb=get,list,watch --resource=pods,pods/log

# 3. Bind Role to ServiceAccount in a namespace
k create rolebinding read-pods-binding --role=pod-reader --serviceaccount=default:app-sa

# 4. Cluster-wide permissions (ClusterRole & ClusterRoleBinding)
k create clusterrole node-viewer --verb=get,list --resource=nodes
k create clusterrolebinding view-nodes-binding --clusterrole=node-viewer --serviceaccount=default:app-sa

# 5. Check permissions (Can I do this?)
k auth can-i create deployments --as=system:serviceaccount:default:app-sa
k auth can-i delete pods -n production

8. NetworkPolicies: Fast Isolation

Default deny ingress rule to secure a namespace:

YAML 8 lines
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Allow traffic only from specific frontend pods on port 80:

YAML 16 lines
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

9. Troubleshooting, JSONPath & Filtering Power Tools

When inspecting large clusters, these queries save immense time:

9.1. JSONPath Power Queries

BASH 8 lines
# Get Internal IPs of all Worker Nodes
k get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}'

# Extract Pod names and their Node placements
k get pods -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase

# Decode Secret data directly without manual base64 decoding
k get secret db-secret -o jsonpath='{.data.password}' | base64 -d

9.2. Real-Time Debugging & Diagnostic Pods

BASH 13 lines
# Run a quick temporary debugging container inside the cluster network
k run net-debug --rm -i --tty --image=curlimages/curl -- /bin/sh

# Stream logs with timestamps and limit lines
k logs -f deployment/web-deploy --tail=50 --timestamps

# View resource usage across all namespaces
k top nodes
k top pods -A --sort-by=cpu
k top pods -A --sort-by=memory

# Inspect events sorted by recent creation
k get events -A --sort-by='.metadata.creationTimestamp'

Summary Checklist for Exam Day

  1. Set alias k=kubectl and export do="--dry-run=client -o yaml".
  2. Always switch context namespaces (k config set-context --current --namespace=...) if working on multi-step questions.
  3. Generate YAML with $do > file.yaml rather than copy-pasting large blocks from external docs.
  4. Validate changes immediately with k get <resource> or test network endpoints using k run net-test --rm -it --image=curlimages/curl -- ....

Master these one-liners in your practice lab sessions, and you’ll easily finish your CKA tasks with time to spare for review!

Tags: #Kubectl #Cka #Ckad #Kubernetes #CLI #Cheat sheet #Dev ops
Share: Share on LinkedIn
Tharun Vempati

Tharun Vempati

GCP PCA · CNCF CKA · Red Hat EX280

Cloud Architect & DevOps Engineer focused on Kubernetes, OpenShift, Google Cloud, and TLS security.

Author Profile → · LinkedIn · GitHub
Recommended Companion Guide
Kubernetes CKA Exam Readiness: The Definitive Self-Assessment Checklist Certifications Passing the Red Hat OpenShift Administrator (EX280) Exam – Part 2: The Technical Side

Was this article helpful?

Share this guide:
Share on LinkedIn

Community Discussion 0