Study Hub / Certified Kubernetes Application Developer (CKAD) / Domain 1.0
Certified Kubernetes Application Developer (CKAD) Domain 1.0: Application Design and Build — Explained
Domain 1.0 is about designing applications for Kubernetes: how to structure container images, when pods hold more than one container, and how run-to-completion work fits the platform. Developer thinking, platform concepts.
Designing container images
- Small, single-purpose images — one process per container, minimal base (distroless/slim). Smaller images pull faster, have fewer CVEs, and crash less mysteriously.
- Layering — each Dockerfile instruction adds a cached layer. Order instructions from least-changing (dependencies) to most-changing (your code) for fast rebuilds.
- Immutability — never change a running container; build a new image and redeploy. "Pets vs. cattle": containers are cattle.
- Tags vs. digests — tags (
:v1.2) are mutable labels; digests (@sha256:…) pin the exact bits. Production pins digests;:latestis a reproducibility hazard.
Multi-container pods: patterns
- Sidecar — a helper container alongside the main one, sharing its network and volumes: log shippers, service-mesh proxies, config watchers. The main container doesn't know it's there.
- Init containers — run to completion before app containers start, in order: wait for a database, run migrations, fetch config. If an init container fails, the pod never starts the app.
- Adapter/ambassador — variations: adapter normalizes output (metrics format), ambassador proxies outbound connections (a local proxy the app talks to instead of the real service).
- When not to multi-container — tightly coupled helpers share a pod; independently scalable components get their own pods/deployments. Sharing a pod means sharing fate (same node, same lifecycle).
Jobs: run-to-completion design
- Jobs vs. long-running services — Deployments run forever; Jobs run until done: migrations, batch processing, one-off computations. The platform restarts failed Jobs (backoffLimit) instead of rescheduling dead services.
- Parallelism and completions — a Job can run N pods in parallel until M completions succeed: "process these 1000 work items, 10 at a time."
- CronJobs — Jobs on a schedule: nightly reports, periodic cleanup. Same pod template, cron timetable.
- Design for failure — Jobs must be idempotent (safe to retry) because Kubernetes will retry them. A migration that double-applies on retry is a design bug.
The must-memorize table: pod patterns
Which pattern for which helper.
| Pattern | Container role | Example |
|---|---|---|
| Sidecar | Helper alongside main container | Log shipper, service-mesh proxy |
| Init container | Setup, runs first to completion | DB migration, wait-for-service |
| Adapter | Normalizes output | Metrics format converter |
| Ambassador | Proxies outbound traffic | Local proxy to external service |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An application needs its logs shipped to a central system, but the app itself can't be modified. Which pod design fits?
- A. A. An init container that ships logs then exits
- B. B. A sidecar container sharing the pod's volumes that tails and ships the logs
- C. C. A second Deployment for the logging agent
- D. D. A CronJob that restarts the app hourly
Show answer & reasoning
B. The sidecar pattern exists for exactly this: a helper container sharing the pod's network/volumes, running alongside the unmodifiable main container. Init containers (A) exit before the app starts — they can't ship ongoing logs. A separate Deployment (C) can't see the pod's local log files.
2. A database migration must run to completion before the application starts, and must block startup if it fails. Which construct?
- A. A. A sidecar container
- B. B. An init container — runs to completion before app containers start
- C. C. A liveness probe
- D. D. A second replica of the app
Show answer & reasoning
B. Init containers run sequentially to completion before any app container starts — and a failed init container blocks the pod. That's the "migrate first, then start" gate. Sidecars (A) run alongside; probes (C) check running containers; replicas (D) don't order anything.
3. A team's production incident was caused by ":latest" resolving to a different image than tested. What is the robust fix?
- A. A. Pull images more frequently
- B. B. Pin images by digest (@sha256:…) so deployments reference exact bits
- C. C. Use bigger nodes
- D. D. Add more replicas
Show answer & reasoning
B. Tags are mutable — :latest today isn't :latest tomorrow. Digests pin the exact image bits, making deployments reproducible: what you tested is what you ship. Pulling more often (A) makes the drift worse, not better.
4. A nightly report job occasionally fails from transient network errors and must retry automatically. Which Kubernetes behavior handles this, and what must the job guarantee?
- A. A. Deployments restart it; the job must be stateless
- B. B. The Job controller retries failed pods (backoffLimit); the work must be idempotent
- C. C. CronJobs never retry; the job must never fail
- D. D. The scheduler retries; the job must be faster
Show answer & reasoning
B. Jobs exist for run-to-completion work and retry failures automatically — but retries are only safe if the work is idempotent (re-running doesn't duplicate effects). A non-idempotent job retried by the platform is a data-corruption machine. Design for retry.
This was one domain. The simulator drills all 5.
This free preview covered Application Design & Build (Domain 1.0, 20%). Not covered here: Application Deployment (Domain 2.0, 20%); Application Environment, Configuration & Security (Domain 4.0, 25%). Deployment patterns and the highest-weight environment/security domain stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CKAD Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy