CKAD Track

The Certified Kubernetes Application Developer exam tests whether you can design, deploy, configure and debug applications on a cluster somebody else runs. There is no cluster installation and almost no node access. Speed with kubectl decides the result more than depth of knowledge.

Exam format, shell setup and time management are in the Certifications hub. This page covers what to study.

Domain	Weight	Practice in this wiki
Application Design and Build	20%	Lab + practice for images, Jobs, CronJobs, multi-container Pods and volumes
Application Deployment	20%	Lab + practice for rolling updates, blue/green, canary, Helm and Kustomize
Application Observability and Maintenance	15%	Lab + practice for probes, logs, debugging and API deprecations
Application Environment, Configuration and Security	25%	Lab + practice for most objectives; admission control is reading only
Services and Networking	20%	Lab + practice for Services, NetworkPolicy and Ingress

The third column says what kind of practice exists, using the labels defined in the hub. It is not a readiness score. All CKAD labs were run on Kubernetes v1.37.0, the version the exam used on the check date.

Objective wording follows the Linux Foundation CKAD page as checked on 2026-10-13 (exam on Kubernetes v1.37, the same as this wiki’s baseline).

---

Prerequisites

Work through these once before starting the domains:

• L00 Start Here and Kubernetes Objects for the object model, labels and selectors.
• Namespaces, since almost every task names one.
• kubectl and Context Switching.
• Lab CKAD-01 Cluster Setup to get the practice cluster running.

---

1. Application Design and Build (20%)

Objective	Read	Practise
Define, build and modify container images	Dockerfile Best Practices, Images and Layers, Registries	Lab CKAD-08
Choose and use the right workload resource	Deployments, DaemonSet, StatefulSets, Jobs, CronJobs	Lab CKAD-02 (Deployment), Lab CKAD-10 (Job, CronJob). DaemonSet and StatefulSet: reading only
Understand multi-container Pod design patterns	Multi-Container Pods, Init Containers, Pods	Lab CKAD-10
Utilize persistent and ephemeral volumes	Volume Types, PersistentVolumeClaim, StorageClass	Lab CKA-01

Task drills

• Build an image from a given Dockerfile with a specific tag, then export it to a tar archive in OCI format (docker build and docker save, or the podman equivalents).
• Change the base image or CMD in a Dockerfile, rebuild, and run a Pod from the new tag.
• Create a Job with completions: 5, parallelism: 2 and a backoffLimit, then read its Pod logs.
• Create a CronJob that runs every two minutes, keeps three successful runs and has activeDeadlineSeconds set. Trigger it manually with kubectl create job --from=cronjob/<name>.
• Add a sidecar that tails a log file written by the main container through a shared emptyDir.
• Add an init container that blocks until a Service resolves in DNS.
• Create a PVC, mount it in a Pod, write a file, delete the Pod, and confirm the file survives in a new Pod.

---

2. Application Deployment (20%)

Objective	Read	Practise
Implement common deployment strategies (blue/green, canary)	Progressive Delivery Strategies, Services	Lab CKAD-12
Understand Deployments and how to perform rolling updates	Deployments, ReplicaSet	Lab CKAD-03
Use the Helm package manager to deploy existing packages	Helm, Helm Commands	Lab CKAD-11
Kustomize	Kustomize	Lab CKAD-07

The exam expects blue/green and canary built from plain Deployments and Service selectors. Argo Rollouts and service meshes are not in scope, so read the strategies note for the mechanics and skip the tooling sections.

Task drills

• Set maxSurge and maxUnavailable on a Deployment, change the image, watch kubectl rollout status, then roll back to a specific revision.
• Pause a rollout, make two changes, resume it, and confirm only one new ReplicaSet was created.
• Blue/green: run v1 and v2 Deployments side by side and cut over by editing the Service selector.
• Canary: run two Deployments behind one Service and size the replicas so roughly 20% of traffic reaches the canary.
• Add a Helm repository, install a chart into a new namespace with two overridden values, upgrade it, roll it back, and uninstall it.
• Find which values a chart accepts with helm show values, and what a release was installed with using helm get values.
• Apply a Kustomize overlay that changes the namespace, the image tag and the replica count (kubectl apply -k).

---

3. Application Observability and Maintenance (15%)

Objective	Read	Practise
Understand API deprecations	Deprecations, Updates Along the Versions	Lab CKAD-07
Implement probes and health checks	Probes	Lab CKAD-13 (design and repair), Lab CKAD-05 (readiness and endpoints)
Use built-in CLI tools to monitor applications	Metrics Sources, kubectl	Lab CKAD-06
Utilize container logs	kubectl Debug Toolkit	Lab CKAD-06
Debugging in Kubernetes	Troubleshooting Flow, Common Failure Modes, CrashLoopBackOff, ImagePullBackOff, Pod Pending	Lab CKAD-06

Task drills

• Fix a manifest that uses a removed API version. Find the served version with kubectl api-resources and kubectl explain.
• Add an HTTP readiness probe, a TCP liveness probe and a startup probe to one container, each with its own timings.
• Find the Pod using the most CPU in a namespace with kubectl top and write its name to a file.
• Get logs from a specific container of a multi-container Pod, and from the previous instance of a restarted container.
• Diagnose a Pod in CrashLoopBackOff from its exit code and events alone, then fix it.
• Attach an ephemeral debug container to a running Pod that has no shell.

---

4. Application Environment, Configuration and Security (25%)

The heaviest domain by weight.

Objective	Read	Practise
Discover and use resources that extend Kubernetes	CustomResourceDefinitions, Operators	Lab CKA-10
Understand authentication, authorization and admission control	Authentication vs Authorization, RBAC, Admission Controllers	Lab CKS-13 (RBAC), Lab CKS-01 (Pod Security admission). Other admission control: reading only
Understand requests, limits, quotas	Resource Requests and Limits, ResourceQuota and LimitRange	Lab CKAD-13
Understand ConfigMaps	ConfigMaps	Lab CKAD-04
Define resource requirements	Resource Requests and Limits	Lab CKA-02
Create and consume Secrets	Secrets	Lab CKAD-04
Understand ServiceAccounts	Service Accounts	Lab CKS-01
Understand application security (SecurityContexts, capabilities)	SecurityContext, Linux Capabilities, Pod Security Standards	Lab CKS-01

Task drills

• List the CRDs in a cluster, read the schema of one with kubectl explain, and create a custom resource from it.
• Create a Role, a ServiceAccount and a RoleBinding imperatively, then prove the result with kubectl auth can-i --as=system:serviceaccount:<ns>:<sa>.
• Fix a Pod that is rejected by a ResourceQuota because it declares no requests.
• Create a LimitRange with default requests and limits, and confirm a new Pod picks them up.
• Consume one ConfigMap three ways: single env var, envFrom, and a mounted file with subPath.
• Create a Secret from a file and from literals, then mount it read-only with a specific file mode.
• Run a Pod under a named ServiceAccount with token automounting disabled.
• Set runAsUser, runAsNonRoot, readOnlyRootFilesystem and allowPrivilegeEscalation: false, drop all capabilities and add back NET_BIND_SERVICE.

---

5. Services and Networking (20%)

Objective	Read	Practise
Demonstrate basic understanding of NetworkPolicies	NetworkPolicy, Network Policies (Security)	Lab CKS-01
Provide and troubleshoot access to applications via Services	Services, DNS in Kubernetes, Service Unreachable	Lab CKAD-05
Use Ingress rules to expose applications	Ingress, 503	Lab CKAD-09

Lab CKAD-05 covers Services, DNS, NodePorts and three ways to lose a backend. Lab CKS-01 section 7 tests NetworkPolicies with a before-and-after reachability matrix. Routing by host and path is in Lab CKAD-09. For mixed, unlabelled faults see Lab CKA-11.

Task drills

• Expose a Deployment as ClusterIP and as NodePort, and test both from a temporary Pod with kubectl run tmp --rm -it --image=busybox -- wget -qO- <svc>.
• Fix a Service with no endpoints by comparing its selector with the Pod labels, then fix one whose targetPort is wrong.
• Write a default-deny ingress policy for a namespace, then allow traffic to one app only from Pods carrying a given label.
• Add an egress rule that allows DNS and one destination port, and nothing else.
• Given existing NetworkPolicies you may not edit, make a Pod reachable by changing only its labels.
• Create an Ingress with two path rules and a host rule pointing at two Services, using kubectl create ingress.

---

Gaps in the wiki

Objective	What is missing	Use instead
DaemonSet and StatefulSet	Concept notes only; no lab creates or changes one	DaemonSet and StatefulSet
Admission control beyond Pod Security	Reading only for the CKAD level	Admission control
Imperative command fluency	Generators appear throughout the labs, not as one drill set	kubectl quick reference
Independent grading	The practice tasks give checks you run yourself; nothing scores you automatically	The exam simulator, if your registration includes it

---

Study plan

The plan below is a revision schedule for someone who passes the entry check, at about an hour a day. It does not include installing tools, pulling images or learning Linux and YAML from scratch; add time for those. Finishing it is not a pass prediction.

Do the CKAD labs in numeric order. Labs 02 to 06 share one application and each expects the state the previous one left; every other lab uses its own namespace and can be done at any point.

Week	Focus	Labs
1	Prerequisites, the shared application, configuration	CKAD-01, 02, 03, 04, 05
2	Observability, images, workload kinds, volumes	CKAD-06, 08, 10, 13 and CKA-01
3	Delivery, networking, security, extensions	CKAD-07, 09, 11, 12, CKS-01, CKS-13 and CKA-10
4	Every “Practice Without the Answer” section again, unguided; the timed practice set; weak spots; the simulator sessions if you have them	CKAD practice set

Use the Workloads refresher and Networking refresher in the last few days.

Ready when

• You complete each lab’s practice section without opening the guided part, on a second attempt some days after the first.
• You can produce a manifest for any object in the track by the fastest route available: a generator where one exists, an edited documentation example where none does.
• You finish the CKAD practice set inside two hours at or above the pass mark, using only the allowed documentation, and every check you ran before moving on was your own idea.
• If you have the simulator, your second session is at or above the pass mark.

Further reading

• CKAD curriculum
• CKAD exam page
• kubectl quick reference

Across the wiki

• CKA Track: the natural next exam, and about half of it is this material.
• CKS Track
• Dockerfile Best Practices