CKA Track

The Certified Kubernetes Administrator exam tests whether you can install, operate and repair a cluster. Compared with the CKAD it adds kubeadm, etcd, node-level work over ssh, and a troubleshooting domain worth almost a third of the score.

Exam format, shell setup and time management are in the Certifications hub. This page covers what to study.

Domain	Weight	Practice in this wiki
Troubleshooting	30%	Lab + practice for nodes, control plane components, Services and DNS
Cluster Architecture, Installation and Configuration	25%	Mixed: etcd, RBAC, Helm and operators are lab + practice; kubeadm install is not run; HA is reading only
Services and Networking	20%	Lab + practice, including Gateway API and unguided fault-finding
Workloads and Scheduling	15%	Lab + practice, including HPA and scheduling constraints
Storage	10%	Lab + practice; volume expansion cannot be exercised on the lab’s provisioner

The third column says what kind of practice exists, using the labels defined in the hub. It is not a readiness score.

Objective wording follows the Linux Foundation CKA page as checked on 2026-10-13 (exam on Kubernetes v1.35; this wiki’s baseline is 1.37 and the labs were run on v1.37.0). Lab CKAD-01 shows how to create the practice cluster on v1.35 instead. The differences that touch these labs are small: v1.35 ships etcd 3.6 where v1.37 ships 3.7, with the same etcdctl and etcdutl commands.

Where the labs run

Most labs use the kind cluster built in Lab CKAD-01, including the etcd, certificate and control plane repair labs, which reach the node with docker exec in place of ssh. Only the kubeadm install and upgrade labs need real or virtual machines. The install lab has not been run on machines; the upgrade lab’s command sequence was run on a kind cluster (v1.36.4 to v1.37.0). Each lab states what was and was not executed.

---

Prerequisites

• L01 Architecture and What Happens When You kubectl apply, so you know which component to suspect.
• Architecture refresher as a check that the request flow is clear.
• kubectl and Context Switching.
• Linux basics the node tasks assume: systemd (systemctl, journalctl), ss and iptables.
• If you have not done the CKAD, work through the CKAD Track drills for workloads and configuration first.

---

1. Troubleshooting (30%)

Objective	Read	Practise
Troubleshoot clusters and nodes	Node Not Ready, Troubleshooting Flow, Container Runtimes	Lab CKA-07, Lab CKAD-01
Troubleshoot cluster components	Static Pods, etcd in Kubernetes, Certificates, Scheduler Internals	Lab CKA-07, Lab CKA-05
Monitor cluster and application resource usage	Metrics Sources	Lab CKAD-06, Lab CKA-08
Manage and evaluate container output streams	kubectl Debug Toolkit, CrashLoopBackOff	Lab CKAD-06
Troubleshoot services and networking	Service Unreachable, DNS Resolution Failures, 503, EndpointSlices	Lab CKA-11 (unguided), Lab CKAD-05

Also read Common Failure Modes, Pod Pending, ImagePullBackOff and the Scenario-Based Incident Reviews, which are the closest thing in the wiki to exam-shaped tasks.

Task drills

• A node is NotReady. Over ssh, find out why from systemctl status kubelet and journalctl -u kubelet, and fix it. Practise at least these causes: kubelet stopped, wrong path in the kubelet config, wrong CA file, container runtime down.
• The API server is unreachable. Find the broken flag in /etc/kubernetes/manifests/kube-apiserver.yaml using crictl ps -a and crictl logs, since kubectl is not available.
• Pods stay Pending with no events. Find and fix a broken kube-scheduler static Pod manifest.
• A Deployment does not scale. Find and fix a broken kube-controller-manager.
• Write the name of the Pod using the most memory across all namespaces to a file (kubectl top pod -A --sort-by=memory).
• Extract every ERROR line from one container of a multi-container Pod into a file.
• A Service returns nothing. Work through selector, endpoints, targetPort, NetworkPolicy and kube-proxy in that order.
• DNS fails cluster-wide. Check the CoreDNS Pods, the kube-dns Service and the Corefile ConfigMap.

---

2. Cluster Architecture, Installation and Configuration (25%)

Objective	Read	Practise
Manage role based access control (RBAC)	RBAC, Service Accounts, Authentication vs Authorization	Lab CKA-06, Lab CKS-13
Prepare underlying infrastructure for installing a cluster	Setting up a Cluster, Memory Swap and NodeSwap, Container Runtimes, sysctl	Lab CKA-03 (package steps run; rest not run)
Create and manage Kubernetes clusters using kubeadm	Setting up a Cluster	Lab CKA-03 (not run on VMs)
Manage the lifecycle of Kubernetes clusters	Upgrade Strategy, Backup and Restore, etcd in Kubernetes, PodDisruptionBudget	Lab CKA-04 (run on kind, not on VMs), Lab CKA-05
Implement and configure a highly-available control plane	High Availability, High Availability (guide)	Reading only
Use Helm and Kustomize to install cluster components	Helm, Helm Commands, Kustomize	Lab CKAD-11, Lab CKAD-07
Understand extension interfaces (CNI, CSI, CRI)	CNI, Storage and CSI refresher, Container Runtimes	Reading only
Understand CRDs, install and configure operators	CustomResourceDefinitions, Operators	Lab CKA-10

The upgrade guide uses older version numbers in its examples. The sequence is what matters; substitute the version the task gives you.

Task drills

• Create a ClusterRole and bind it to a ServiceAccount in one namespace with a RoleBinding, then verify with kubectl auth can-i --as.
• Create a user from scratch: generate a key and CSR with openssl, submit a CertificateSigningRequest, approve it with kubectl certificate approve, build a kubeconfig entry, and grant the user a Role.
• Prepare a fresh node: load overlay and br_netfilter, set the forwarding sysctls, install and configure containerd with the systemd cgroup driver, install kubeadm, kubelet and kubectl at a pinned version.
• Initialise a control plane with kubeadm init, install a CNI, and join a worker using kubeadm token create --print-join-command.
• Upgrade a control plane node one minor version: upgrade kubeadm, run kubeadm upgrade plan and apply, drain, upgrade kubelet and kubectl, restart the kubelet, uncordon. Then upgrade a worker with kubeadm upgrade node.
• Take an etcd snapshot with the certificate paths read from the etcd static Pod manifest, then restore it to a new data directory and point the manifest at it.
• Check certificate expiry with kubeadm certs check-expiration and renew one certificate.
• Install a component from a Helm chart with custom values, and from a Kustomize directory.
• Install an operator from its manifests, list the CRDs it adds, and create one custom resource.
• Drain a node that hosts a Pod protected by a PodDisruptionBudget and a bare Pod, and explain each flag you needed.

---

3. Services and Networking (20%)

Objective	Read	Practise
Understand connectivity between Pods	Networking Overview, Networking Deep Dive, CNI	Lab CKAD-05
Define and enforce Network Policies	NetworkPolicy	Lab CKS-01 section 7, Lab CKA-11
Use ClusterIP, NodePort, LoadBalancer service types and endpoints	Services, EndpointSlices	Lab CKAD-05
Use the Gateway API to manage Ingress traffic	Gateway API, Gateway API lab runbook	Lab CKA-12
Know how to use Ingress controllers and Ingress resources	Ingress	Lab CKAD-09
Understand and use CoreDNS	DNS in Kubernetes, DNS Resolution Failures	Lab CKAD-05, Lab CKA-11 section 5

Finish with the Networking refresher.

Task drills

• Expose a Deployment as NodePort on a specific port and reach it from outside the cluster through a node IP.
• Write a NetworkPolicy that combines a namespaceSelector and a podSelector in one rule, then a second policy that lists them as separate rules, and explain the difference.
• Add a default-deny for ingress and egress in a namespace and restore DNS with an explicit egress rule.
• Create a Gateway and an HTTPRoute that routes two paths to two Services. Then migrate an existing Ingress to an equivalent HTTPRoute.
• Create an Ingress with a specific ingressClassName, a host rule and a path rule.
• Resolve a Service and a Pod by full DNS name from a temporary Pod, in the same namespace and across namespaces.
• Change the CoreDNS Corefile to forward one domain to a custom upstream, and confirm the Pods reloaded it.

---

4. Workloads and Scheduling (15%)

Objective	Read	Practise
Understand deployments, rolling updates and rollbacks	Deployments	Lab CKAD-03
Use ConfigMaps and Secrets to configure applications	ConfigMaps, Secrets	Lab CKAD-04
Configure workload autoscaling	HorizontalPodAutoscaler, Vertical Pod Autoscaler	Lab CKA-08
Understand the primitives for robust, self-healing deployments	Probes, ReplicaSet, DaemonSet, StatefulSets, Restart Policy	Lab CKAD-13 (probes), Lab CKAD-02
Configure Pod admission and scheduling (limits, node affinity)	Scheduling, Resource Requests and Limits, PriorityClass and Preemption, ResourceQuota and LimitRange	Lab CKA-02, Lab CKA-09, Lab CKAD-13

Finish with the Scheduling and Scaling refresher.

Task drills

• Create an HPA on CPU with a minimum, a maximum and a custom scale-down stabilisation window.
• Taint a node, then schedule a Pod onto it with a matching toleration and a nodeSelector.
• Use required node affinity to pin a Deployment to labelled nodes, and Pod anti-affinity to spread its replicas across nodes.
• Create a PriorityClass, assign it to a Deployment, and watch it preempt a lower-priority Pod on a full node.
• Run a static Pod on a worker node by placing a manifest in the kubelet’s static Pod path.
• Schedule a Pod manually by setting nodeName while the scheduler is down.
• Resize a container’s CPU request in place without restarting the Pod.

---

5. Storage (10%)

Objective	Read	Practise
Implement storage classes and dynamic volume provisioning	StorageClass, Storage Overview	Lab CKA-01
Configure volume types, access modes and reclaim policies	Volume Types, PersistentVolume	Lab CKA-01
Manage persistent volumes and persistent volume claims	PersistentVolumeClaim, PVC Stuck	Lab CKA-01

Finish with the Storage refresher.

Task drills

• Create a hostPath PersistentVolume and a PVC that binds to it specifically, matching capacity, access mode and storageClassName.
• Create a StorageClass with volumeBindingMode: WaitForFirstConsumer and allowVolumeExpansion: true, make it the default, and expand a bound PVC.
• Change a PV’s reclaim policy to Retain, delete its PVC, and make the Released volume bindable again.
• Diagnose a PVC stuck in Pending from its events.

---

Gaps in the wiki

Objective	What is missing	Use instead
kubeadm install	Lab CKA-03: only the package installation was run (in a container). kubeadm init, the CNI install and kubeadm join were not run on machines	Run it on three virtual machines and treat the lab’s output as a description
kubeadm upgrade	Lab CKA-04: the kubeadm and drain sequence was run on kind and the apt steps in a container, never together on machines	The same three machines, straight after Lab CKA-03
Highly-available control plane	Reading only. A three-control-plane cluster was too heavy for this wiki’s test machine, so no lab was written	HA clusters with kubeadm
Volume expansion	Lab CKA-01 shows the refusal; the lab’s provisioner cannot expand a volume	Expanding PVCs
Extension interfaces (CNI, CSI, CRI)	Reading only, plus the cri-dockerd outline in Lab CKA-03	The concept notes in the domain 2 table
Node-level network faults	Lab CKA-11 covers Service, DNS and policy faults, not a broken CNI or kube-proxy	Debug Services
Independent grading	The practice tasks give checks you run yourself; nothing scores you automatically	The exam simulator, if your registration includes it

---

Study plan

The plan below is a revision schedule for someone who passes the entry check and is comfortable in a Linux shell, at about an hour a day. It does not include provisioning virtual machines for the kubeadm labs; allow an extra evening or two for that. Finishing it is not a pass prediction.

The weeks follow the exam’s weights loosely: most of the last two go to troubleshooting, which is 30% of the score.

Week	Focus	Labs
1	Prerequisites, workloads and configuration	CKAD-01, 02, 03, 04, 13
2	Scheduling, autoscaling, storage	CKA-01, 02, 08, 09
3	Services and networking	CKAD-05, 09, CKA-12, CKS-01 section 7
4	Cluster lifecycle, RBAC, Helm, operators	CKA-03, 04 (on machines if you have them), 05, 06, 10, CKAD-11, CKS-13
5	Troubleshooting	CKAD-06, CKA-07, CKA-11; then repeat CKA-07 and CKA-11 unguided
6	Every “Practice Without the Answer” section again; the timed practice set; weak spots; the simulator sessions if you have them	CKA practice set

Ready when

• You can upgrade a node and restore etcd with only the allowed documentation open, and you check that the restored data and the cluster’s components are healthy afterwards.
• You can find a broken control plane component with crictl and journalctl when kubectl does not answer.
• You diagnose the faults in Lab CKA-11 from evidence, without the answers, on a second attempt some days after the first.
• You finish the CKA practice set inside two hours at or above the pass mark.
• If you have the simulator, your second session is at or above the pass mark.

Time targets depend on the task. Creating a Secret takes a minute; restoring etcd or upgrading a node takes ten or more even when it goes well. Judge yourself on correct, verified results inside the two hours as a whole, not on one number per task.

Further reading

• CKA curriculum
• CKA exam page
• kubeadm reference
• Gateway API documentation

Across the wiki

• CKAD Track: workload and configuration drills shared with this exam.
• CKS Track: the next exam, which requires a passed CKA.
• Maintenance Playbook: how this wiki tracks upstream Kubernetes releases.
• Systematic Debugging: the Linux side of node troubleshooting.