Certified Kubernetes Administrator (CKA) Prep Guide

By Kokil Thapa | Last reviewed: September 2026

The Certified Kubernetes Administrator (CKA) Prep Guide you need is not another list of video courses. The CKA is a two-hour, hands-only exam where you fix broken clusters under time pressure. You must type real kubectl commands, edit YAML fast, and recover etcd without guessing. This guide maps the 2026 curriculum to a practical study plan built for engineers who already manage Linux production servers and want cluster admin skills they can use on real workloads—not just a badge.

What does the Certified Kubernetes Administrator (CKA) exam actually test?

The CKA is issued by the Linux Foundation and CNCF. It is performance-based, not multiple choice. You get a remote terminal, a broken cluster, and tasks worth points. Partial credit exists on some items, but sloppy YAML or wrong namespaces often score zero.

As of 2026, the passing score remains 66%. You have 120 minutes for about 15–17 tasks. One free retake is included if you buy through the official training bundle. Book through the Linux Foundation CKA certification page—third-party vouchers sometimes expire without warning.

Domain weights you must respect

Troubleshooting is the largest slice at 30%. Cluster architecture follows at 25%. Treat those two domains as non-negotiable before you touch flashcards or theory reading.

If you already run Ubuntu servers with Apache, PHP-FPM, and GitLab CI pipelines, the mindset transfers. You are diagnosing production systems where one misconfigured file breaks everything. Read our Kubernetes control plane and worker node architecture article before you start labs. It saves hours of confused kubectl output later.

How should you build a local lab for CKA practice?

You cannot pass CKA by watching videos. You need clusters you can break, fix, and rebuild weekly. Local options differ mainly in realism versus RAM cost.

Pick a practice environment

• kind — Fast on laptops, great for NetworkPolicy and Ingress drills. See our minikube vs kind comparison.
• minikube — Single-node, good for storage and addon experiments.
• kubeadm on VMs — Closest to exam clusters. Use Multipass or VirtualBox with two control-plane nodes if RAM allows.
• k3s — Lightweight for edge-style tests. Useful but not identical to kubeadm exam tasks. Our k3s guide covers install patterns.

For a budget Nepal setup, a used mini PC with 32 GB RAM (~Rs 45,000, ~USD 335) beats cloud credits that expire mid-study. A ₹500/month VPS cannot run multi-node kubeadm realistically.

Baseline cluster bootstrap with kubeadm

Exam tasks assume you know kubeadm init, join, and upgrade flows. Practice on Ubuntu 24.04 with containerd—not Docker CE—as the runtime. The official kubeadm cluster creation guide is the canonical reference.

# Control plane (replace 10.0.0.10 with your node IP)
sudo kubeadm init \
  --pod-network-cidr=10.244.0.0/16 \
  --apiserver-advertise-address=10.0.0.10

mkdir -p $HOME/.kube
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# Install CNI — Calico is common in labs
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

# Worker join (command printed by kubeadm init)
sudo kubeadm join 10.0.0.10:6443 --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash>

Break things on purpose. Delete /etc/kubernetes/manifests/kube-apiserver.yaml and restore it. Cordon a node, drain it, uncordon it. Each failure teaches a muscle memory path the exam rewards.

Which kubectl workflows save the most exam time?

Speed comes from generators, aliases, and namespace discipline—not memorising every YAML field. The exam permits the official Kubernetes documentation site. Your job is to find the right page in under 30 seconds.

Imperative commands with dry-run

Never hand-write a Deployment from scratch under pressure. Generate a base manifest, then edit.

# Create deployment skeleton
kubectl create deployment web --image=nginx:1.27 --dry-run=client -o yaml > deploy.yaml
kubectl apply -f deploy.yaml

# Expose service
kubectl expose deployment web --port=80 --target-port=80 \
  --dry-run=client -o yaml > svc.yaml

# Run diagnostic pod
kubectl run tmp --image=busybox:1.36 --restart=Never \
  --rm -it -- sh

Set these aliases in your shell profile before exam day. They are allowed in the exam environment if you configure them at session start.

alias k=kubectl
export dry="--dry-run=client -o yaml"
complete -F __start_kubectl kubectl

Namespace and context traps

Every task specifies a namespace. A correct object in default when the question says dev scores zero. Always run context setup first.

kubectl config set-context --current --namespace=dev
kubectl config get-contexts
kubectl get all -n dev

Use kubectl explain when field names slip your mind. Example: kubectl explain pod.spec.containers.resources. This beats scrolling docs for nested keys. Validate YAML with kubectl apply --dry-run=server -f file.yaml before you submit mentally.

RBAC task pattern

RBAC questions follow a template: create ServiceAccount, Role or ClusterRole, bind with RoleBinding or ClusterRoleBinding, verify with auth can-i.

kubectl create serviceaccount app-sa -n finance
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n finance
kubectl create rolebinding read-pods --role=pod-reader \
  --serviceaccount=finance:app-sa -n finance
kubectl auth can-i get pods --as=system:serviceaccount:finance:app-sa -n finance

For cluster-scoped resources, swap Role for ClusterRole and RoleBinding for ClusterRoleBinding. Mixing scopes is the most common RBAC failure I see in mock exams.

How do you master CKA troubleshooting and etcd tasks?

Troubleshooting is 30% of your score. Exam scenarios recycle the same failure modes: CrashLoopBackOff, ImagePullBackOff, node NotReady, Service with no endpoints, and broken static control plane manifests.

Start every pod issue with a fixed command chain. Do not random-guess edits.

1. kubectl get pods -A -o wide — find status and node placement
2. kubectl describe pod <name> -n <ns> — read Events at the bottom
3. kubectl logs <name> -n <ns> --previous — if the container restarted
4. kubectl get events -n <ns> --sort-by=.metadata.creationTimestamp
5. Exec in only after you know the container is running: kubectl exec -it <name> -n <ns> -- sh

Our dedicated walkthrough on debugging CrashLoopBackOff pods covers probe misconfigurations, wrong commands, and missing ConfigMaps—the three causes that appear most often in practice labs.

Node NotReady checklist

When a node shows NotReady, SSH to the node—not the control plane—and check kubelet first.

sudo systemctl status kubelet
sudo journalctl -u kubelet -e --no-pager | tail -40
ls /var/lib/kubelet/pki/
sudo systemctl restart kubelet

CNI failures often leave nodes NotReady after reboot. Confirm the CNI pods run in kube-system. A missing /etc/cni/net.d config breaks pod networking cluster-wide.

etcd backup and restore

etcd tasks appear regularly under cluster architecture. Know the exact paths from /etc/kubernetes/manifests/etcd.yaml on your lab cluster. Our etcd in Kubernetes deep dive explains why snapshot timing matters for consistency.

# Backup (paths vary—read etcd manifest first)
ETCDCTL_API=3 etcdctl snapshot save /var/backups/etcd-snap.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Verify
ETCDCTL_API=3 etcdctl snapshot status /var/backups/etcd-snap.db -w table

Restore requires stopping API server and etcd, clearing data dir, restoring snapshot, then restarting static pods. Practice the full sequence twice. Partial steps leave the cluster in a worse state than before you started.

Service and DNS failures

A Service with zero endpoints means selector labels do not match pod labels. Fix labels or the Service selector—not the Deployment replicas count.

kubectl get svc my-svc -n app -o yaml | grep selector -A2
kubectl get pods -n app --show-labels
kubectl run dnstest --image=busybox:1.36 --restart=Never -it --rm -- \
  nslookup my-svc.app.svc.cluster.local

For NetworkPolicy tasks, default-deny then allow specific ingress/egress. Read our NetworkPolicy explained article for label selector gotchas that cost exam points.

What storage and workload tasks appear most on the CKA exam?

Storage is only 10% by weight, but missed PVC binding fails entire tasks. Workload scheduling questions test taints, tolerations, and node affinity—not just replica counts.

PersistentVolume workflow

# StorageClass (if not provided)
kubectl apply -f - <<EOF
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-fast
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
EOF

# PV + PVC + Pod mount — practise the full chain
kubectl get pv,pvc -A

Understand accessModes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany. A PVC stuck in Pending usually means no matching PV or wrong StorageClass name. The persistent volume lifecycle guide walks through reclaim policies and common binding errors.

Scheduling with taints

kubectl taint nodes node1 dedicated=ops:NoSchedule
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: ops-pod
spec:
  tolerations:
  - key: dedicated
    operator: Equal
    value: ops
    effect: NoSchedule
  containers:
  - name: c
    image: nginx:1.27
EOF

DaemonSets ignore taints only when tolerations are defined on the template. Jobs and CronJobs need restartPolicy: OnFailure or Never—another silent YAML error. Review Jobs and CronJobs before exam week.

Resource limits appear in smaller tasks. Know how requests affect scheduling. Our resource limits and requests article shows how OOMKilled pods look in kubectl describe output.

How do you manage time and exam-day logistics for CKA?

Two hours sounds generous until question seven eats forty minutes. Flag hard tasks and return later. Easy points left on the table hurt more than one skipped etcd restore.

Pre-exam checklist

• Valid ID matching PSI registration name exactly
• Quiet room, wired internet preferred over Wi-Fi
• Clear desk—no papers, second monitor removed unless approved
• Browser bookmarks to kubernetes.io/docs/tasks and /docs/reference/kubectl
• PSI compatibility check completed 24 hours before slot

Exam fee is roughly USD 395 (~Rs 53,000) including one retake via the bundle. Schedule morning slots if your brain handles CLI work better before noon. Nepali candidates should confirm power backup—a UPS costs Rs 8,000 (~USD 60) and beats rescheduling fees.

Mock exam providers worth your money

Killer.sh includes two exam simulators with the Linux Foundation bundle. They feel harder than the real exam, which builds confidence. KodeKloud and Mumshad's CKA course labs align closely with task wording. Free alternatives exist but rarely enforce time limits.

Pair CKA study with broader platform knowledge if you deploy apps afterward. Our Kubernetes for Laravel getting started guide bridges cert skills to PHP workloads. For HA control planes, read building a highly available control plane after you pass.

Validate YAML during study with our JSON and YAML formatter tool—indentation errors in multi-document files fail silently until apply time. If you deploy clusters for clients, enterprise application development services often include container orchestration alongside Laravel or API backends.

Production backup strategies extend beyond etcd snapshots. Tools like Velero matter once you run real workloads. See Velero backup and restore after certification. For interview prep alongside cert paths, the backend interview prep guide complements CKA for platform roles.

On teams I've supported with Linux and deployment pipelines, the engineers who pass CKA first are the ones who logged daily terminal time. They did not binge videos the week before. They typed commands until muscle memory kicked in.

Review related material in our earlier CKA exam preparation overview and Kubespray deployment guide for multi-node production patterns beyond kubeadm labs. The Adventure Third Pole Trek booking platform shows what production Laravel plus reliable infrastructure looks like when uptime actually matters to a business.

Key Takeaways

• Weight study time toward troubleshooting (30%) and cluster architecture (25%)—those domains decide pass or fail.
• Build kubeadm labs you can break weekly; kind alone will not prepare you for etcd restore or node join tasks.
• Use --dry-run=client -o yaml generators and always set the task namespace before you apply anything.
• Practice etcd snapshot and restore end-to-end twice; partial restore sequences brick clusters.
• Run timed mocks with kubernetes.io/docs open—exam success is speed plus doc navigation, not memorisation.
• Flag hard tasks, bank easy points first, and verify every answer with kubectl get before moving on.

People Also Ask

How long does it take to prepare for the CKA exam?

Most working engineers need six to eight weeks at one to two hours daily. Linux admins with prior container experience sometimes pass in four weeks. Without daily hands-on kubectl practice, three months is more realistic. Cramming the final week rarely works because etcd and troubleshooting tasks require repeated muscle memory.

Is the CKA exam open book?

You may use the official kubernetes.io/docs site during the exam. Stack Overflow, personal notes, and PDF cheatsheets are not allowed. Bookmark the Tasks and Reference sections before exam day. Practice finding NetworkPolicy, RBAC, and kubeadm upgrade pages under time pressure.

What is the passing score for CKA in 2026?

The passing threshold remains 66% of total points. Tasks have different weights—a high-value troubleshooting question can equal two smaller workload tasks. Partial credit applies when only part of a multi-step answer is correct, but wrong namespaces typically receive zero.

CKA vs CKAD vs CKS—which should you take first?

Take CKA first if your goal is cluster administration, node operations, and platform engineering. CKAD suits application developers who mostly deploy workloads. CKS requires CKA and focuses on security hardening. Platform and DevOps hiring managers in 2026 still treat CKA as the baseline admin credential.

Start your CKA prep with a plan, not a playlist

The Certified Kubernetes Administrator (CKA) Prep Guide only works if you treat the exam like production on-call duty. Build clusters, break them, restore etcd, and run timed mocks until eight-minute tasks feel routine. Pair cert study with real deploy patterns—GitOps, backups, and app workloads—so the credential translates to jobs and client work.

Need help running production workloads on Linux infrastructure or planning a container platform for your team? Contact us to discuss architecture, deployment, and the path from certification to a system that stays up after exam day.