Your complete guide to earning the Certified Kubernetes Administrator (CKA) certification from CNCF and the Linux Foundation — the industry's leading Kubernetes administration credential, covering cluster architecture, workloads, networking, storage, and troubleshooting.
The Certified Kubernetes Administrator (CKA) is a performance-based certification offered by the Cloud Native Computing Foundation (CNCF) and the Linux Foundation. Unlike multiple-choice exams, CKA is a 2-hour hands-on practical exam where you solve real Kubernetes administration tasks using kubectl in a live cluster environment. You are allowed to use the official Kubernetes documentation (kubernetes.io) during the exam. CKA validates the skills to design, install, configure, and manage production-grade Kubernetes clusters — one of the most in-demand DevOps and cloud-native skills in the industry.
Set up a multi-node Kubernetes cluster on your laptop using kind (Kubernetes in Docker) for fast iteration, or VirtualBox VMs with kubeadm for real-world practice. Practice both since kubeadm is tested on the exam.
Practice kubectl run, create deployment, expose, scale, rollout undo/status without looking at docs. Speed is critical on the exam — you must complete ~15 tasks in 2 hours.
Create ServiceAccounts, Roles, ClusterRoles, RoleBindings. Use kubectl auth can-i to verify every policy. Practice the --as flag for user impersonation in testing.
Upgrade a kubeadm cluster from v1.29 to v1.30: upgrade kubeadm, run upgrade plan, apply upgrade, drain control-plane, upgrade kubelet, uncordon. Repeat on worker node. Time yourself — aim under 30 minutes.
Practice the complete backup-restore cycle daily until you can do it from memory: find cert paths → etcdctl snapshot save → verify status → restore to new dir → update manifest → verify cluster recovery.
Create a 3-tier app (frontend, backend, database). Implement NetworkPolicies: only backend can reach database. Verify with kubectl exec + curl/nc that policies are enforced. Deploy with Calico CNI for enforcement.
SSH to node → journalctl -u kubelet → fix common issues: kubelet service stopped, config error, certificate expired, CNI missing. Target: resolve in under 10 minutes.
Investigate: kubectl describe pod → check Events and Last State exit code → kubectl logs --previous → identify: OOM (137), app crash (1), exec format (wrong arch). Fix the root cause.
Check selector labels match pod labels → check Endpoints object exists → test connectivity from within cluster → check NetworkPolicy → check kube-proxy logs. Systematically isolate the layer.
kubectl exec into pod → nslookup myservice → check CoreDNS pods in kube-system → review CoreDNS ConfigMap forward plugin → check pod's /etc/resolv.conf. Distinguish internal vs external DNS failures.
Pod: kubectl run mypod --image=nginx --restart=Never
Deploy: kubectl create deployment myapp --image=nginx --replicas=3
Service: kubectl expose deployment myapp --port=80 --type=ClusterIP
ConfigMap: kubectl create configmap myconfig --from-literal=key=val
Secret: kubectl create secret generic mysecret --from-literal=pass=secret
Job: kubectl create job myjob --image=busybox -- echo hello
CronJob: kubectl create cronjob mycron --image=busybox --schedule="*/5 * * * *" -- echo hi
SA: kubectl create serviceaccount mysa
Role: kubectl create role reader --verb=get,list --resource=pods
YAML: kubectl create deployment myapp --image=nginx --dry-run=client -o yaml > deploy.yaml
alias k=kubectl; source <(kubectl completion bash); complete -F __start_kubectl k in every terminal tabkubectl config use-context)kubectl explain <resource>.spec.fieldname for quick field documentation without leaving the terminalkubectl get -o yaml before editingPractice with our hands-on performance-based questions and flashcards — 150 kubectl scenario tasks covering all 5 CKA domains, designed to build the speed and accuracy needed for the live exam environment.