Build a cluster, start to finish

The CKA doesn't hand you a multiple-choice question about a stuck PersistentVolumeClaim — it hands you a broken cluster and two hours to prove you can run one. Reading a Deployment spec doesn't build that reflex; running one, breaking it, and fixing it does. This hub is where you build it. You'll take taskboard — a small three-piece app (a stateless API, a static web frontend, and a Postgres database) — from an empty kind cluster through five connected parts to a cluster a real cluster administrator would trust: namespaced and access-controlled, running real workloads with real health checks, reachable through a real Ingress, backed by storage that survives a restart, and locked down with least-privilege RBAC. Each part opens by stating exactly what "done" looks like. If you only have an afternoon, the fast path below still gets you real reps across all five.

The world you're building

☺ Like you're 10: Before any building starts, here's the map: one cluster, one small app with three pieces, two drawers to keep things tidy in, and one repo that grows a new room every part.

The hub you're reading and all five parts build inside one continuous cluster, so nothing you set up in Part 1 goes stale by Part 5. Here is the whole world, once, so you never have to re-derive it:

• The cluster is created with kind create cluster --name taskboard-dev and stays up for the whole capstone (minikube is a fine substitute; translate the commands yourself).
• The app is taskboard — a small HTTP API with GET /healthz, GET /boards/:id, and POST /boards/:id/cards, a static web frontend that calls it, and a single-replica Postgres instance behind both. Images are built locally as taskboard-api:dev and taskboard-web:dev and loaded straight into the cluster with kind load docker-image — no registry needed for a lab this size.
• Namespaces split cleanly in two: taskboard hosts the app itself, and platform hosts every add-on — ingress-nginx, metrics-server, and anything you bolt on in going further. Every part keeps this split consistent.
• The repo is a single git repo, taskboard, that starts with just api/, web/, and two Dockerfiles, and grows exactly one new manifests/ subdirectory per part.

taskboard-dev (kind cluster)
├── namespace: platform          # ingress-nginx, metrics-server, add-ons from "going further"…
├── namespace: taskboard          # api + web Deployments, postgres StatefulSet, Services, NetworkPolicies, RBAC…
└── (git) taskboard/
    ├── api/, web/, Dockerfile.api, Dockerfile.web   # the bare repo you start with
    ├── manifests/01-cluster/          # Part 1 — cluster foundation
    ├── manifests/02-workloads/        # Part 2 — workloads & config
    ├── manifests/03-networking/       # Part 3 — networking & ingress
    ├── manifests/04-storage/          # Part 4 — storage & stateful apps
    └── manifests/05-security/         # Part 5 — security & RBAC

The cluster itself is created once, from a config that reserves host ports 80 and 443 so Part 3's Ingress has somewhere real to answer from:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: taskboard-dev
nodes:
  - role: control-plane
    kubeadmConfigPatches:
      - |
        kind: InitConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            node-labels: "ingress-ready=true"
    extraPortMappings:
      - containerPort: 80
        hostPort: 80
      - containerPort: 443
        hostPort: 443

The five parts

☺ Like you're 10: Five chapters of the same story. Each one hands the next chapter a cluster that's a little more finished than the one before.

Work them in order. Each part pairs with a slice of the official CKA curriculum, so you always know which domain your hands are earning you reps in. Troubleshooting (Domain 5, 30% — the single largest domain on the exam) never gets a part of its own, because on the real exam it never announces itself as one task either; instead, every part below ends by breaking something on purpose that you have to diagnose with nothing but kubectl describe, kubectl logs, and kubectl get events — same as Foxy would.

Deep-dive the concept behind any part via its linked lesson before or after you build — the lesson explains why, the part makes you prove it works. For the mechanics this app is standing on, Platform Engineering's Kubernetes-as-Substrate covers the same object model one altitude up, and for a genuinely adversarial pass at Part 5's RBAC once you're comfortable, DevSecOps' Kubernetes Security Deep Dive walks the same objects from an attacker's-eye view.

The fast path — for an afternoon

☺ Like you're 10: No time for five chapters? Here's the one-page summary of the whole story, still worth doing.

The five parts are the deep version of this track — real manifests, real breakage, real triage. If you only have an afternoon, or want one condensed pass before the exam, work this shorter nine-item version instead. It touches every domain at a lighter depth, using the exact same taskboard/taskboard-dev world as the parts above, so nothing you build here is wasted if you come back and go deep later.

What you'll have built

☺ Like you're 10: By the end, your laptop holds a small working version of the whole building this course keeps describing — the floors, the tenants, the mail slots, the bolted-down cabinets, and the keys that only open what they should.

Finish the five parts (or the fast path) and you'll have hands-on reps across every domain of the CKA curriculum, weighted the way the real exam weights it: Cluster Architecture, Installation & Configuration (D1, 25%), Workloads & Scheduling (D2, 15%), Services & Networking (D3, 20%), Storage (D4, 10%), and Troubleshooting (D5, 30%) — the full 100%, since the last one is threaded through every part rather than boxed into one. That matters more here than it would for a multiple-choice exam: the CKA is graded on the end state of a live cluster, not on a bubble sheet, so the only real practice is a cluster you built, broke, and fixed with your own hands. Pair this with this course's Certifications hub and CKA Study Plan once your reps are in, and if the Kubestronaut ladder is the eventual goal, the other nine CNCF certifications plus the LFCS live in this platform's Golden Astronaut course once CKA, CKAD, and CKS are behind you.