Certified Kubernetes Administrator (CKA): how to prepare for a hands-on exam

Most IT certifications are multiple-choice exams you can partly pass through recognition: you see the right answer and it looks familiar. The Certified Kubernetes Administrator exam, run by the Cloud Native Computing Foundation and the Linux Foundation, doesn't work that way. You're given a terminal and a set of tasks, and you have to fix things on real clusters before time runs out.

That changes how you should prepare. You can't memorize your way through it. You have to build speed and fluency, which only comes from doing the tasks repeatedly.

What the exam is

The CKA is a performance-based exam: a time-limited session in a browser-based terminal where you complete practical tasks across several clusters. You're allowed to consult the official Kubernetes documentation during the exam, which is a double-edged sword — it's a safety net for syntax, but hunting through docs eats the clock.

The exam covers cluster administration rather than application development. Domains and weightings are published in the CNCF curriculum and are updated alongside Kubernetes releases, so always read the current curriculum before you start. In recent versions, the major areas include:

• Troubleshooting — typically the largest share, which makes the diagnostic loop in our troubleshooting field guide essential practice.
• Cluster architecture, installation, and configuration — including RBAC, kubeadm-based setup and upgrades, and etcd backup and restore.
• Services and networking — Services, Ingress, network policies, and DNS.
• Workloads and scheduling — Deployments, rolling updates, ConfigMaps and Secrets, scheduling constraints, and resource limits.
• Storage — volumes, PersistentVolumes, claims, and storage classes.

A realistic study plan

Plan for roughly six to eight weeks of consistent practice if you already have some Kubernetes exposure; longer if you're starting from zero. If you are, begin with Kubernetes 101 and the rest of our Kubernetes series.

1. Weeks 1–2: core objects and workloads. Pods, Deployments, ReplicaSets, Services, ConfigMaps, Secrets. Create everything from the command line, not just YAML files.
2. Weeks 3–4: networking, storage, and scheduling. Ingress, NetworkPolicies, PersistentVolumes, taints and tolerations, node affinity, resource requests and limits.
3. Weeks 5–6: cluster administration. Build a cluster with kubeadm, upgrade it, back up and restore etcd, configure RBAC, manage certificates.
4. Weeks 7–8: troubleshooting and timed mock exams. Break clusters on purpose and fix them against the clock.

Speed habits that matter

Time is the constraint, so shave seconds everywhere.

Use imperative commands to generate YAML. Writing manifests from scratch is slow. Let kubectl do it:

# Generate a Deployment manifest without creating it
kubectl create deployment web --image=nginx:1.27 --replicas=3 \
  --dry-run=client -o yaml > web.yaml
 
# Expose it as a Service
kubectl expose deployment web --port=80 --target-port=80 \
  --dry-run=client -o yaml

Set up your shell at the start. A few aliases and autocompletion pay for themselves within minutes:

alias k=kubectl
export do="--dry-run=client -o yaml"
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

(Check what the exam environment already provides — some conveniences may be preconfigured.)

Learn kubectl explain. It prints field documentation right in your terminal and is often faster than searching the docs:

kubectl explain pod.spec.containers.resources

Always check the context. The exam uses multiple clusters, and each task tells you which context to switch to. Running the right command on the wrong cluster is a painful, avoidable mistake.

kubectl config use-context <context-name>
kubectl config current-context

Skills worth over-practicing

• etcd backup and restore. A classic task with exact flags and certificate paths. Practice it until you can do it without notes.
• Cluster upgrades with kubeadm, including draining and uncordoning nodes.
• RBAC: creating roles, role bindings, and service accounts, then verifying with kubectl auth can-i.
• Network policies, which are easy to get subtly wrong.
• Troubleshooting a broken node or control plane component, which means getting comfortable with systemctl, journalctl, and static pod manifests.

# Verify permissions quickly
kubectl auth can-i list pods --as=system:serviceaccount:dev:app -n dev

Exam-day approach

• Triage. Skim all tasks, do the quick ones first, and flag long ones for later. Every task has a weight; don't sink 15 minutes into one low-value problem.
• Read the task twice. Namespaces, names, and exact values matter.
• Verify after every change with a get or describe. An unverified answer is a gamble.
• Don't panic-edit. If something breaks, step back and check the events rather than changing three things at once.

Practice environments

Build a local or cloud practice cluster, and practice breaking it. Mock exam environments and community practice labs exist; use them for timed runs near the end of your preparation. Whatever you use, make sure the practice mirrors a terminal-only workflow rather than relying on a graphical console.

Is the CKA worth it?

It's one of the few certifications that actually proves hands-on ability, which is why hiring managers respect it. Even if you never take the exam, preparing for it is among the best ways to learn how Kubernetes really works.

If you'd like a live instructor, guided labs, and timed practice with feedback, see our Certified Kubernetes Administrator (CKA) Prep course. If you're building up to it, Kubernetes and DevOps in Practice is the right stepping stone, and our Docker Fundamentals course covers the container basics underneath.