CKA (Certified Kubernetes Administrator) Exam Guide 2026

The CKA (Certified Kubernetes Administrator) certification, offered by the Cloud Native Computing Foundation (CNCF) and the Linux Foundation, is the industry's gold standard for Kubernetes operations skills. Unlike most IT certifications that test you with multiple-choice questions, the CKA is a performance-based exam — you work in a live Kubernetes environment for two hours, completing 17 real-world tasks using kubectl and other command-line tools. There is no multiple choice, no memorization of terminology alone, and no shortcuts: you either know how to configure a cluster or you do not. This reputation makes the CKA genuinely meaningful to hiring managers, and it is one of the most commonly required certifications for DevOps, SRE, and Platform Engineering roles in 2026.

Exam Format and What to Expect

The CKA exam experience is unlike any other certification you may have taken. Understanding the logistics before exam day eliminates surprises and lets you focus entirely on the tasks.

The exam is delivered through a PSI secure browser. You work in a remote desktop environment with a terminal connected to real Kubernetes clusters. Each task specifies which cluster context to use — you must switch contexts using kubectl config use-context at the start of each task. Forgetting to switch contexts is one of the most common causes of lost marks.

You are permitted to keep one additional browser tab open to kubernetes.io/docs. You can use the search function and navigate to any page on the official docs. You cannot use Google, GitHub, Stack Overflow, or any other external sites. Practice navigating the Kubernetes documentation efficiently — knowing where to find example YAML for PersistentVolumeClaims, NetworkPolicies, and RBAC resources will save you significant time.

The Five Exam Domains with Weights

The CKA curriculum (v1.32) is organized into five content domains. Each domain maps to real day-to-day cluster administration tasks:

Domain 1: Cluster Architecture, Installation, and Configuration — 25%

This is the heaviest domain. It covers RBAC (roles, cluster roles, role bindings, cluster role bindings), bootstrapping a Kubernetes cluster using kubeadm, upgrading cluster components with kubeadm, managing etcd (backup and restore using etcdctl), understanding the control plane components (kube-apiserver, kube-scheduler, kube-controller-manager, etcd), and configuring highly available control plane nodes. The etcd backup and restore task appears on almost every CKA exam — practice this until it is muscle memory.

Domain 2: Workloads and Scheduling — 15%

Covers Deployments, DaemonSets, StatefulSets, Jobs, CronJobs, and how to manage rolling updates and rollbacks. You must know how to configure resource requests and limits, use node affinity and anti-affinity, taints and tolerations, and understand how the kube-scheduler selects nodes. ConfigMaps and Secrets management also falls here.

Domain 3: Services and Networking — 20%

This domain tests your ability to expose applications: ClusterIP, NodePort, and LoadBalancer service types, Ingress resources and Ingress controllers, CoreDNS configuration, and most importantly NetworkPolicies. NetworkPolicy questions are notoriously tricky — they require you to write YAML that controls pod-to-pod and pod-to-external traffic using label selectors. Practice writing NetworkPolicies from scratch without copying templates.

Domain 4: Storage — 10%

PersistentVolumes (PVs), PersistentVolumeClaims (PVCs), and StorageClasses. You need to know how to create PVs with specific access modes (ReadWriteOnce, ReadOnlyMany, ReadWriteMany) and reclaim policies (Retain, Delete), bind a PVC to a specific PV using selectors, and configure pods to use PVCs as volumes. Volume types (emptyDir, hostPath, configMap, secret) are also tested.

Domain 5: Troubleshooting — 30%

The largest single domain. Troubleshooting covers: diagnosing application failures (CrashLoopBackOff, ImagePullBackoff, OOMKilled), cluster component failures (kubelet not running, API server unreachable), node failures (cordoning, draining, fixing NotReady nodes), and examining logs with kubectl logs, kubectl describe, and journalctl. This is where experienced practitioners pull ahead — practice deliberately breaking clusters and fixing them.

Imperative vs Declarative kubectl Cheat Sheet

Speed is critical in the CKA. Using imperative commands to generate starter YAML files is far faster than writing from scratch. The exam environment has no code editor with Kubernetes YAML support — you work in vim or nano. Here are the essential patterns:

3 Sample Tasks with Solutions

The following tasks are representative of CKA exam difficulty. For each, read the task description, attempt a solution, then review the provided answer.

Task 1: Create a Pod with Resource Limits

Task: In the default namespace on cluster k8s-prod, create a Pod named resource-pod using the image nginx:1.25. Configure the container with a CPU request of 100m, a CPU limit of 200m, a memory request of 128Mi, and a memory limit of 256Mi. The pod must remain running.

Solution:

kubectl config use-context k8s-prod

kubectl run resource-pod --image=nginx:1.25 --dry-run=client -o yaml > resource-pod.yaml

# Edit resource-pod.yaml to add resources block under the container spec:
# resources:
#   requests:
#     cpu: "100m"
#     memory: "128Mi"
#   limits:
#     cpu: "200m"
#     memory: "256Mi"

kubectl apply -f resource-pod.yaml

# Verify
kubectl get pod resource-pod
kubectl describe pod resource-pod | grep -A 6 Limits

Task 2: Create a NetworkPolicy

Task: In namespace web-ns, create a NetworkPolicy named web-policy that allows ingress traffic to pods labeled app=frontend only from pods labeled app=backend in the same namespace, on port 80. All other ingress to app=frontend pods must be denied.

Solution:

kubectl config use-context k8s-prod

cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-policy
  namespace: web-ns
spec:
  podSelector:
    matchLabels:
      app: frontend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend
    ports:
    - protocol: TCP
      port: 80
EOF

# Verify
kubectl describe networkpolicy web-policy -n web-ns

Task 3: Backup and Restore etcd

Task: Create a snapshot backup of the etcd cluster to /opt/etcd-backup.db. The etcd server runs on https://127.0.0.1:2379 with TLS certificates at /etc/kubernetes/pki/etcd/.

Solution:

# First, confirm the etcd endpoint and cert paths
kubectl describe pod etcd-controlplane -n kube-system | grep -E "listen-client|cert-file|key-file|trusted-ca"

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# Verify the snapshot
ETCDCTL_API=3 etcdctl snapshot status /opt/etcd-backup.db --write-out=table

killer.sh Simulator Tips

Every CKA registration includes two free sessions on killer.sh, the premier CKA practice simulator. These sessions are intentionally harder than the real exam — many candidates score 40–60% on killer.sh and still pass the actual CKA. Here is how to use it effectively:

• Do not use your first killer.sh session until you have completed at least 80% of your study plan. The simulator is most valuable as a final assessment tool, not as a learning tool for beginners. Using it too early wastes the session and can be demoralizing.
• Use the first session with a 2-hour time limit enforced. Sit down, set a timer, complete as many tasks as possible, and submit. Do not look up answers during the session — treat it exactly like the real exam.
• Spend 2–3 hours after the first session reviewing every task, including the ones you got right. The killer.sh solutions often show more efficient approaches than you used.
• Use the second session 3–4 days before your real exam as a final confidence calibration. At this point you should be scoring 65%+ on killer.sh, which typically correlates with a comfortable pass on the real exam.

Environment Setup: tmux, Aliases, Bash Completion

The exam environment supports customization of the terminal. Setting up your environment at the start of the exam takes 2 minutes but saves 10+ minutes over 120 minutes of work. Practice these setups until they are automatic:

# Enable kubectl bash completion (run once at start of exam)
source <(kubectl completion bash)
echo "source <(kubectl completion bash)" >> ~/.bashrc

# Set essential aliases
alias k=kubectl
alias kgp="kubectl get pods"
alias kgs="kubectl get svc"
alias kgn="kubectl get nodes"
alias kdp="kubectl describe pod"
complete -F __start_kubectl k

# Set default namespace shortcut (update per task)
export do="--dry-run=client -o yaml"
export now="--force --grace-period 0"

# Example usage:
# k run nginx --image=nginx $do > pod.yaml
# k delete pod nginx $now

Using tmux for Split Panes

tmux allows you to split the terminal into multiple panes — one for running kubectl commands and one for editing YAML files simultaneously. The basic setup:

• tmux — start a new session
• Ctrl+B, % — split vertically
• Ctrl+B, " — split horizontally
• Ctrl+B, arrow key — switch between panes

8-Week Study Timeline