CKA Certification Overview

Certified Kubernetes Administrator (CKA)

The Certified Kubernetes Administrator (CKA) is a performance-based certification exam administered by the Cloud Native Computing Foundation (CNCF) in partnership with The Linux Foundation. It validates a candidate’s ability to install, configure, and manage production-grade Kubernetes clusters.

Exam Details (2025)

Attribute	Specification
Format	Performance-based, online proctored
Duration	2 hours
Tasks	16–20 practical hands-on problems
Passing Score	66%
Kubernetes Version	Aligned with latest minor release (~1.30.x at time of study)
Cost	~$395 USD (includes one free retake)
Validity	2 years
Curriculum Version	v1.30

Exam Domains & Weightings

Domain	Weight	Key Topics
Cluster Architecture, Installation & Configuration	~25%	kubeadm, HA, etcd, restore, upgrades, version skew, RBAC
Workloads & Scheduling	~15%	Deployments, DaemonSets, Jobs, scheduling
Services & Networking	~20%	Services, Ingress, NetworkPolicies, CoreDNS
Storage	~10%	PVs, PVCs, StorageClasses, volume mounts
Troubleshooting	~30%	Node failures, pod crashes, networking, control plane

What Makes CKA Unique

• Hands-On Only: No multiple-choice questions. Every task requires executing real kubectl commands or editing YAML in a live cluster.
• Speed & Accuracy: You must solve problems quickly. Practicing YAML creation and kubectl shortcuts is essential.
• Open Book (Limited): You can access the official Kubernetes documentation (kubernetes.io/docs) during the exam, but searching efficiently is a skill.

Key Tools & Resources

• kubectl: The primary CLI for cluster interaction
• kubernetes.io/docs: The only allowed external resource during the exam
• kubeadm: The standard tool for bootstrapping clusters
• kind / minikube: Local cluster tools for practice

Sources

• CKA Day 0: Introduction & Roadmap
• CKA Day 8: Deployments, ReplicaSets & Replication Controllers
• CKA Day 9: Kubernetes Services Explained
• CKA Day 10: Kubernetes Namespace Explained
• CKA Day 11: Multi Container Pod Kubernetes — Sidecar vs Init Container
• CKA Day 12: DaemonSet, Job & CronJob Explained
• CKA Day 13: Static Pods, Manual Scheduling, Labels, and Selectors
• CKA Day 14: Taints and Tolerations in Kubernetes
• CKA Day 15: Kubernetes Node Affinity Explained
• CKA Day 16: Kubernetes Requests and Limits
• CKA Day 17: Kubernetes Autoscaling Explained — HPA vs VPA
• CKA Day 18: Kubernetes Health Probes Explained — Liveness vs Readiness Probes
• CKA Day 19: Kubernetes ConfigMap and Secret Explained
• TLS Works
• CKA Day 21: Manage TLS Certificates In a Kubernetes Cluster — Create Certificate Signing Request
• CKA Day 22: Kubernetes Authentication and Authorization Simply Explained
• CKA Day 23: Kubernetes RBAC Explained — Role Based Access Control
• CKA Day 24: Kubernetes RBAC Continued — ClusterRole and ClusterRoleBinding
• CKA Day 25: Kubernetes Service Account — RBAC Continued
• CKA Day 29: Kubernetes Volume Simplified — Persistent Volume, Persistent Volume Claim & Storage Class
• CKA Day 31: Understanding CoreDNS In Kubernetes
• CKA Day 32: Kubernetes Networking Explained | Container Network Interface (CNI)
• CKA Day 33: Kubernetes Ingress Tutorial | Ingress Explained
• CKA Day 34: Step-By-Step Guide To Upgrade a Multi Node Kubernetes Cluster With Kubeadm
• CKA Day 35: Kubernetes ETCD Backup And Restore Explained
• CKA Day 36: Kubernetes Logging and Monitoring
• CKA Day 37: Application Failure Troubleshooting
• CKA Day 38: Troubleshooting Control Plane Failure
• CKA Day 39: Troubleshooting Worker Nodes Failures

Related Pages

• CKA 40-Day Study Roadmap
• Kubernetes Concepts Index
• Kubernetes Resource Requests and Limits
• TLS Fundamentals — Certificates and encryption underpinning Kubernetes control plane security
• Kubernetes Authentication & Authorization — The two-gate security model for API server access
• Kubernetes RBAC — Role-based access control for cluster and namespace-level permissions
• Kubernetes Storage — PVs, PVCs, StorageClasses, and the ~10% Storage domain
• Kubernetes Ingress — Layer 7 routing in the ~20% Services & Networking domain
• Kubernetes Cluster Upgrade — Rolling update strategy and kubeadm commands in the ~25% Architecture domain
• Node Maintenance: Drain, Cordon, Uncordon — Evacuation mechanics required before any node upgrade
• Kubernetes Versioning & Version Skew — Support window, component compatibility, and the no-skip-minor-versions rule
• Kubernetes ETCD Backup and Restore — Snapshot, restore, and certificate paths: guaranteed exam tasks in the Architecture domain
• Kubernetes Disaster Recovery — DR hierarchy, RTO/RPO, and production resilience patterns
• Kubernetes Logging and Monitoring — Day 36: container/node/cluster logs, Metrics Server, and troubleshooting matrix
• Kubernetes Application Troubleshooting — Day 37: systematic debugging of image pull errors, crash loops, service failures, and rollout stalls
• Kubernetes Control Plane Troubleshooting — Day 38: control plane component failures, certificate expiry, and Static Pod recovery
• Kubernetes Worker Node Troubleshooting — Day 39: kubelet, container runtime, CNI, kube-proxy, and resource pressure eviction
• CKA Practice Tasks — Hands-on drill index for every exam topic; use for pre-exam cramming and daily lab practice
• CKA Progress Tracker

After CKA: DevSecOps & CKS Path

The CKA provides the cluster administration foundation. The natural next specializations are:

• DevSecOps Fundamentals — Shift-left security, threat modeling, and secure CI/CD pipelines. Synthesized from DevOps to DevSecOps in 9 Hours.
• CKS (Certified Kubernetes Security Specialist) — The CNCF security-focused follow-up to CKA, covering cluster hardening, supply chain security, and runtime threat detection with Falco. Source: Falco CKS Scenarios

Many CKA topics (RBAC, NetworkPolicies, TLS, etcd backup) are prerequisites for DevSecOps and CKS. The 40-day CKA roadmap intentionally covers these security-adjacent domains before the exam.

---

Tags: cka kubernetes cncf certification devops production devsecops cks