CNCF · 2026 Edition
A complete preparation guide written by CNCF-certified engineers. Covers the exam format,all 8 blueprint domains, a week-by-week study plan, and proven tips for passing first time.
2–4 months
Prep time
Advanced
Difficulty
Hands-on lab
Format
Exam code
CKA
Full name
Certified Kubernetes Administrator
Vendor
CNCF
Duration
120 minutes
Exam format
Performance-based lab (no multiple-choice)
Domains covered
8 blueprint domains
Recommended experience
Hands-on experience with Linux and Kubernetes; familiarity with container concepts
Typical prep time
2–4 months
CKA is the benchmark Kubernetes administration credential. It is a performance-based exam taken entirely in a live cluster environment — passing it proves you can actually operate Kubernetes, not just describe how it works.
Job roles this opens
Official CNCF blueprint weights — study time should roughly match these percentages.
Performance-based exam
The real CKA exam is entirely performance-based — you complete practical Kubernetes administration tasks in a live cluster environment. There are no multiple-choice questions. Courseiva practice questions reinforce the concepts and commands you need, but hands-on lab practice with kubeadm, kubectl, and etcd is still required.
Weeks 1–3
Cluster Architecture, Installation and Configuration: kubeadm setup, etcd backup, RBAC
Tip: etcd backup and restore is one of the most commonly tested tasks on CKA. Practise: ETCDCTL_API=3 etcdctl snapshot save, verify the snapshot, and restore from it. Know the flags required: --endpoints, --cacert, --cert, --key. A backup taken without these flags will fail silently.
Weeks 4–5
Workloads and Scheduling: Deployments, DaemonSets, static pods, resource limits, node affinity
Tip: Node affinity vs node selector vs taints/tolerations: node selector and node affinity control which nodes a pod CAN be scheduled on (pull); taints and tolerations control which pods can be scheduled on a tainted node (push). Know the difference and when to use each.
Weeks 6–7
Services and Networking: Services (ClusterIP, NodePort, LoadBalancer), NetworkPolicy, DNS, Ingress
Tip: NetworkPolicy is tested in CKA — know how to write a policy that allows ingress from pods with a specific label while denying all other ingress. Practice the YAML structure: podSelector (which pods this policy applies to), policyTypes, ingress/egress rules with namespaceSelector and podSelector.
Weeks 8–10
Storage: PersistentVolumes, PersistentVolumeClaims, StorageClasses, volume types
Tip: PersistentVolume access modes tested on CKA: ReadWriteOnce (single node, read/write), ReadOnlyMany (multiple nodes, read only), ReadWriteMany (multiple nodes, read/write). Know that not all storage providers support all access modes — StorageClass documentation specifies supported modes.
Weeks 11–14
Troubleshooting (30% of exam): node issues, pod failures, networking problems
Tip: Troubleshooting is the heaviest domain on CKA. Practise diagnosing: pods stuck in Pending (resource constraints, no schedulable node, PVC not bound), CrashLoopBackOff (application error — check kubectl logs), ImagePullBackOff (wrong image name or missing registry credentials). Know the exact kubectl commands for each investigation.
CKA is open-book — you can access kubernetes.io/docs, kubernetes.io/blog, and helm.sh/docs during the exam. Practise navigating these sites quickly. Know where to find: kubectl cheat sheet, Deployment YAML templates, RBAC examples, NetworkPolicy templates.
The exam uses a remote desktop browser environment with a terminal. Speed matters — practice alias shortcuts: alias k=kubectl, set up kubectl completion (source <(kubectl completion bash)). In the exam, every second counts across 15–20 tasks.
Context switching is required during the exam — each task specifies which cluster to use. Always run kubectl config use-context <name> as the first command for each task. Using the wrong context will cause your changes to apply to the wrong cluster.
Imperative kubectl commands save time over YAML editing. Know: kubectl run (create pod), kubectl create deployment, kubectl expose (create service), kubectl create serviceaccount, kubectl create role, kubectl create rolebinding. Use --dry-run=client -o yaml to generate YAML templates quickly.
CKA is valid for 2 years. The Linux Foundation offers a bundle (CKAD + CKA) that reduces the combined cost. Candidates who pass CKA with a strong score often progress to CKS (Certified Kubernetes Security Specialist) next.
Apply everything in this guide with adaptive practice questions, detailed answer explanations, and domain analytics.
Deep-dive explanations of the key topics tested on CKA — with exam key points and common misconceptions.