CNCF · 2026 Edition
A complete preparation guide written by CNCF-certified engineers. Covers the exam format,all 8 blueprint domains, a week-by-week study plan, and proven tips for passing first time.
2–4 months
Prep time
Advanced
Difficulty
Hands-on lab
Format
Exam code
CKA
Full name
Certified Kubernetes Administrator
Vendor
CNCF
Duration
120 minutes
Exam format
Performance-based lab (no multiple-choice)
Domains covered
8 blueprint domains
Recommended experience
Hands-on experience with Linux and Kubernetes; familiarity with container concepts
Typical prep time
2–4 months
CKA is the benchmark Kubernetes administration credential. It is a performance-based exam taken entirely in a live cluster environment — passing it proves you can actually operate Kubernetes, not just describe how it works.
Job roles this opens
Domain percentage weights are not currently available for this exam. The checklist below is still useful for planning your study.
Performance-based exam
The real CKA exam is entirely performance-based — you complete practical Kubernetes administration tasks in a live cluster environment. There are no multiple-choice questions. Courseiva practice questions reinforce the concepts and commands you need, but hands-on lab practice with kubeadm, kubectl, and etcd is still required.
Weeks 1–3
Cluster Architecture, Installation and Configuration: kubeadm setup, etcd backup, RBAC
Tip: etcd backup and restore is one of the most commonly tested tasks on CKA. Practise: ETCDCTL_API=3 etcdctl snapshot save, verify the snapshot, and restore from it. Know the flags required: --endpoints, --cacert, --cert, --key. A backup taken without these flags will fail silently.
Weeks 4–5
Workloads and Scheduling: Deployments, DaemonSets, static pods, resource limits, node affinity
Tip: Node affinity vs node selector vs taints/tolerations: node selector and node affinity control which nodes a pod CAN be scheduled on (pull); taints and tolerations control which pods can be scheduled on a tainted node (push). Know the difference and when to use each.
Weeks 6–7
Services and Networking: Services (ClusterIP, NodePort, LoadBalancer), NetworkPolicy, DNS, Ingress
Tip: NetworkPolicy is tested in CKA — know how to write a policy that allows ingress from pods with a specific label while denying all other ingress. Practice the YAML structure: podSelector (which pods this policy applies to), policyTypes, ingress/egress rules with namespaceSelector and podSelector.
Weeks 8–10
Storage: PersistentVolumes, PersistentVolumeClaims, StorageClasses, volume types
Tip: PersistentVolume access modes tested on CKA: ReadWriteOnce (single node, read/write), ReadOnlyMany (multiple nodes, read only), ReadWriteMany (multiple nodes, read/write). Know that not all storage providers support all access modes — StorageClass documentation specifies supported modes.
Weeks 11–14
Troubleshooting (30% of exam): node issues, pod failures, networking problems
Tip: Troubleshooting is the heaviest domain on CKA. Practise diagnosing: pods stuck in Pending (resource constraints, no schedulable node, PVC not bound), CrashLoopBackOff (application error — check kubectl logs), ImagePullBackOff (wrong image name or missing registry credentials). Know the exact kubectl commands for each investigation.
CKA is open-book — you can access kubernetes.io/docs, kubernetes.io/blog, and helm.sh/docs during the exam. Practise navigating these sites quickly. Know where to find: kubectl cheat sheet, Deployment YAML templates, RBAC examples, NetworkPolicy templates.
The exam uses a remote desktop browser environment with a terminal. Speed matters — practice alias shortcuts: alias k=kubectl, set up kubectl completion (source <(kubectl completion bash)). In the exam, every second counts across 15–20 tasks.
Context switching is required during the exam — each task specifies which cluster to use. Always run kubectl config use-context <name> as the first command for each task. Using the wrong context will cause your changes to apply to the wrong cluster.
Imperative kubectl commands save time over YAML editing. Know: kubectl run (create pod), kubectl create deployment, kubectl expose (create service), kubectl create serviceaccount, kubectl create role, kubectl create rolebinding. Use --dry-run=client -o yaml to generate YAML templates quickly.
CKA is valid for 2 years. The Linux Foundation offers a bundle (CKAD + CKA) that reduces the combined cost. Candidates who pass CKA with a strong score often progress to CKS (Certified Kubernetes Security Specialist) next.
Apply everything in this guide with adaptive practice questions, detailed answer explanations, and domain analytics.
Deep-dive explanations of the key topics tested on CKA — with exam key points and common misconceptions.