Certified Kubernetes Administrator (CKA): Exam, Skills and Preparation
The Certified Kubernetes Administrator (CKA) exam is a different kind of test. Instead of choosing answers from a list, you sit in a terminal, you are given a set of tasks and a clock, and you must make Kubernetes clusters behave. You either fix the broken node, configure the network policy and get the deployment running, or you do not. That has direct consequences for how you should prepare.
This guide covers who CKA suits, the exam format and package terms, what each domain covers, a study plan built around labs, exam-day techniques, common mistakes, and how CKA compares with related credentials.
Who should consider CKA
CKA is built for people who operate Kubernetes clusters:
- System administrators moving into container platforms.
- DevOps and platform engineers who build and run Kubernetes for their organisation.
- Site reliability engineers responsible for cluster reliability.
- Cloud engineers working with managed or self-managed Kubernetes.
- Infrastructure engineers whose organisations are moving workloads to containers.
It assumes you are comfortable at a Linux command line, can edit files quickly with a terminal editor, and understand containers.
It is a poor fit if you only deploy applications to someone else's cluster, or if you want a conceptual overview. In those cases a foundation-level route may serve you better, and developers may prefer the Linux Foundation's application-developer credential, which focuses on designing and deploying applications rather than administering clusters.
Exam format
| Item | Detail |
|---|---|
| Delivery | Online and proctored, with a live command-line environment |
| Format | Performance-based: you solve tasks rather than answer multiple-choice questions |
| Length | Two hours |
| Environment | A current Kubernetes release, updated periodically; check the version before booking and again before the exam |
| Resources | Access to the official Kubernetes documentation is permitted during the exam, under the Linux Foundation's rules |
Package terms
The Linux Foundation's direct purchase of the CKA currently includes:
- A 12-month window to schedule and take the exam.
- Two exam attempts in total: a first attempt plus one retake.
- Two exam simulator attempts, which reproduce the exam environment.
Reseller bundles can differ, so check what you are buying. "Two attempts" means two in total, not unlimited retakes.
Price
The Linux Foundation's published exam-only price is US$445. It also lists bundles at US$625 (exam with a THRIVE-ONE annual subscription) and US$645 (exam with the Kubernetes Fundamentals course, LFS258). These are the Linux Foundation's prices, not CertScope's training fees. Regional pricing, taxes and promotions can change the amount you pay.
What the exam covers
| Domain | Weight |
|---|---|
| Cluster Architecture, Installation and Configuration | 25% |
| Workloads and Scheduling | 15% |
| Services and Networking | 20% |
| Storage | 10% |
| Troubleshooting | 30% |
Cluster Architecture, Installation and Configuration (25%)
- Role-based access control (RBAC).
- Preparing infrastructure for a cluster installation.
- Creating and managing clusters with kubeadm.
- Managing the cluster life cycle, including upgrades.
- Implementing and configuring a highly available control plane.
- Using Helm and Kustomize to install cluster components.
- Understanding extension interfaces: CNI (networking), CSI (storage) and CRI (container runtime).
- Understanding custom resource definitions (CRDs) and operators.
Workloads and Scheduling (15%)
- Deployments, rolling updates and rollbacks.
- ConfigMaps and Secrets.
- Workload autoscaling.
- Primitives for robust, self-healing deployments.
- Pod admission and scheduling: resource limits, node affinity, taints and tolerations.
Services and Networking (20%)
- Pod-to-pod connectivity.
- Network policies.
- Service types: ClusterIP, NodePort and LoadBalancer, and their endpoints.
- The Gateway API and Ingress, including controllers and resources.
- CoreDNS.
Storage (10%)
- StorageClasses and dynamic volume provisioning.
- Volume types, access modes and reclaim policies.
- PersistentVolumes and PersistentVolumeClaims.
Troubleshooting (30%)
- Troubleshooting clusters and nodes.
- Troubleshooting cluster components such as the API server, scheduler, controller manager, etcd and kubelet.
- Monitoring cluster and application resource usage.
- Managing and evaluating container output streams and logs.
- Troubleshooting services and networking.
Troubleshooting is the largest domain and the one candidates underestimate. If you can only practise one thing, break clusters on purpose and fix them. Work through a consistent order: is the node ready, are the control-plane components running, what do the events and logs say, and does the service actually route to healthy pods? Check the Linux Foundation's current curriculum before you start, because the domains and topics are revised periodically.
What preparation should include
- Daily command-line practice. Speed with kubectl, an editor and shell shortcuts is part of the skill. Learn the imperative commands that generate YAML (for example, using a dry run to output a manifest) so you are not typing it from scratch.
- Cluster building. Install a cluster with kubeadm, upgrade it and manage its life cycle. Understand what each control-plane component does and where its configuration lives.
- Access and configuration. RBAC, Helm, Kustomize and extension interfaces are easier to learn by doing than by reading.
- Networking and storage. Services, Ingress or the Gateway API, network policies, CoreDNS, PersistentVolumes and StorageClasses.
- Deliberate breakage. Stop the kubelet, corrupt a manifest, misconfigure DNS, then diagnose and fix it. Repeat until the diagnosis is routine.
- Timed practice. Do tasks against a clock. Learn when to skip and return rather than losing ten minutes on one problem.
- Documentation fluency. Practise finding the page you need on the Kubernetes documentation site in seconds.
- A simulator pass. Use the simulator attempts included in your package to rehearse the exam environment shortly before the real exam.
An eight-week lab plan
| Week | Focus | Lab outcome |
|---|---|---|
| 1 | Linux, containers and kubectl fluency | Create and inspect resources quickly, imperatively and with YAML |
| 2 | Cluster architecture and kubeadm | Build a cluster from scratch; explain each component |
| 3 | Cluster life cycle, HA, Helm and Kustomize | Upgrade a cluster; install components with Helm and Kustomize |
| 4 | RBAC, CRDs and operators | Grant least-privilege access; install and inspect a CRD |
| 5 | Workloads and scheduling | Roll out, roll back and scale deployments; control placement |
| 6 | Services, networking and storage | Expose apps, restrict traffic, provision persistent storage |
| 7 | Troubleshooting | Diagnose and fix broken nodes, components, apps and networking |
| 8 | Timed simulations | Full timed runs; review and repeat weak tasks |
Adjust the plan to your experience. If you already run clusters in production, you may move faster through weeks 2 to 6 and spend more time on timed troubleshooting.
Where to practise
- A local cluster on your laptop for quick experiments.
- Virtual machines for kubeadm installs, upgrades and multi-node troubleshooting, which local single-node tools do not fully reproduce.
- The exam simulator included in your package, for the real environment.
- A training provider's lab environment, if it persists and can be reset.
Commands worth knowing cold
You will not have time to look up basic commands in the exam. These should be automatic:
| Task | Commands to practise |
|---|---|
| Switch cluster | kubectl config use-context <name> |
| Generate a manifest | kubectl create deployment ... --dry-run=client -o yaml, kubectl run ... --dry-run=client -o yaml |
| Inspect | kubectl get, kubectl describe, kubectl get events --sort-by=.metadata.creationTimestamp |
| Explore fields | kubectl explain <resource>.<field> |
| Roll out and back | kubectl rollout status, kubectl rollout history, kubectl rollout undo |
| Expose and scale | kubectl expose, kubectl scale |
| Check permissions | kubectl auth can-i <verb> <resource> --as <user> |
| Node maintenance | kubectl cordon, kubectl drain, kubectl uncordon |
| Upgrades | kubeadm upgrade plan, kubeadm upgrade apply |
| Node-level diagnosis | systemctl status kubelet, journalctl -u kubelet, crictl ps |
| Logs | kubectl logs, including previous containers and specific containers in a pod |
Practise until you can type them without thinking, and learn the flags you use most. Set up a short alias for kubectl at the start of the exam if the rules and environment allow it.
Exam-day techniques
- Check the context for every task. Tasks often run against different clusters. Switch to the context the task specifies before doing anything else. Doing the right work on the wrong cluster scores nothing.
- Read the whole task first. Note the namespace, resource names and any requirements that are easy to miss.
- Use the weight of each task. Tasks carry different weights. If a task is long and worth little, consider moving on and returning.
- Generate, then edit. Use imperative commands to create a manifest, then edit it, instead of writing YAML from memory.
- Verify your work. After each task, check that the resource exists and behaves as asked.
- Keep an eye on the clock. Two hours goes quickly. Leave time to revisit skipped tasks.
- Prepare your environment. Run the Linux Foundation's system checks in advance, and follow the proctoring rules for your room and desk.
Common mistakes
- Studying by reading only. The exam tests what you can do, not what you know.
- Practising only on single-node local clusters, then struggling with kubeadm and multi-node troubleshooting.
- Ignoring the troubleshooting domain, which carries the most weight.
- Working in the wrong context or namespace.
- Typing YAML from scratch instead of generating it.
- Assuming unlimited retakes. The direct package includes two attempts in total.
- Using outdated material for an older Kubernetes version.
CKA versus related credentials
| Credential | Focus | Best for |
|---|---|---|
| CKA | Administering Kubernetes clusters | Administrators, platform engineers, SREs |
| Kubernetes application developer credential | Designing, building and deploying applications on Kubernetes | Developers |
| Kubernetes security specialist credential | Securing clusters and workloads; usually requires an active CKA | Security-focused platform engineers |
| DevOps Foundation | Culture, practices and vocabulary of DevOps | Anyone working in or with DevOps teams |
| Cloud provider certifications | A specific cloud's services | Engineers working in that cloud |
CKA versus DevOps Foundation
DevOps Foundation-style courses teach culture, practices and vocabulary: why teams automate, how pipelines and feedback loops work, and how to collaborate across development and operations. CKA tests whether you can administer a specific platform under time pressure. They complement rather than compete: the first builds shared language, the second proves hands-on skill. See CertScope's DevOps Foundation training.
CKA and cloud certifications
Many organisations run Kubernetes on a managed cloud service. Cloud provider certifications teach that cloud's services; CKA teaches Kubernetes itself, which carries across providers. Our guide to cloud certification paths explains how to combine them.
Is CKA worth it?
CKA is worth it when your work involves running Kubernetes, or when the roles you want ask for it. Because the exam is practical, passing shows employers that you can operate a cluster under pressure, not just describe one. It does not guarantee a role or a pay rise; production experience and the ability to explain your decisions matter at least as much.
Choosing training
Training can shorten the path, but only if it gives you real lab time. Ask a provider:
- How many hours are hands-on, and how many are slides?
- Do lab environments persist between sessions, and can they be reset?
- Are labs multi-node, so you can practise kubeadm and node troubleshooting?
- Does the course cover the current curriculum and Kubernetes version?
- Is the exam included, and on what terms?
Get free certification pathway advice →
Key takeaways
- CKA is a two-hour, performance-based exam taken in a live command-line environment.
- Troubleshooting is the largest domain at 30%.
- The Linux Foundation lists the exam at US$445, with two attempts in total in the direct package.
- Prepare with labs, timed tasks and deliberate breakage, not reading alone.
- Always switch to the context a task specifies before you start it.
Next step
CertScope's CKA training is planned around lab work and will be published once the lab environment and trainer are ready. If you want to be told when it opens, or you need a team cohort, tell us.
Ready to get certified?
Browse our full catalog of expert-led courses and certifications.