Kubernetes Administrator (CKA)

Key Topics to Master:

• Troubleshoot clusters and nodes, including kubelet and container runtime failures
• Troubleshoot cluster components such as the API server, scheduler, controller manager, and etcd
• Monitor cluster and application resource usage
• Manage and evaluate container output streams with kubectl logs and previous-container logs
• Troubleshoot services and networking, including endpoints, selectors, and CoreDNS resolution
• Read events with kubectl describe and kubectl get events to locate scheduling and image-pull failures

Key Topics to Master:

• Manage role based access control with Roles, ClusterRoles, RoleBindings, and ServiceAccounts
• Prepare underlying infrastructure for installing a Kubernetes cluster
• Create and manage clusters using kubeadm, including join tokens and certificate handling
• Manage the lifecycle of clusters, including version upgrades and node drain and uncordon
• Implement and configure a highly available control plane
• Use Helm and Kustomize to install cluster components
• Understand extension interfaces including CNI, CSI, and CRI
• Understand custom resource definitions, and install and configure operators

Key Topics to Master:

• Understand connectivity between Pods and the flat pod network model
• Define and enforce NetworkPolicies for ingress and egress
• Use ClusterIP, NodePort, and LoadBalancer service types and inspect endpoints
• Use the Gateway API to manage ingress traffic
• Know how to use Ingress controllers and Ingress resources
• Understand and use CoreDNS, including service and pod DNS naming

Key Topics to Master:

• Understand application deployments and perform rolling updates and rollbacks
• Use ConfigMaps and Secrets to configure applications
• Configure workload autoscaling with the HorizontalPodAutoscaler
• Understand the primitives used to create robust, self-healing application deployments
• Configure Pod admission and scheduling using resource limits, node affinity, taints, and tolerations

Key Topics to Master:

• Implement storage classes and dynamic volume provisioning
• Configure volume types, access modes, and reclaim policies
• Manage persistent volumes and persistent volume claims
• Bind a PersistentVolumeClaim into a Pod and verify the mount
• Understand the CSI extension interface for third-party drivers

• 1Build a two-node lab with kind or minikube, then confirm you can also reach a kubeadm-built cluster, because managed clusters hide the control plane the exam asks you to fix
• 2Work through the free Linux Foundation Introduction to Kubernetes course to fix vocabulary before drilling commands
• 3Read the Kubernetes concepts section of kubernetes.io/docs on Pods, ReplicaSets, Deployments, and Services
• 4Configure your shell exactly as you will on exam day: alias k=kubectl, source <(kubectl completion bash), complete -F __start_kubectl k
• 5Time yourself creating ten Deployments and Services purely with imperative kubectl commands

• 1Practise kubectl create and kubectl run with --dry-run=client -o yaml until generating a base manifest takes under fifteen seconds
• 2Export do='--dry-run=client -o yaml' and use it on every object you create for the rest of your preparation
• 3Learn kubectl explain with the --recursive flag as a substitute for hunting through documentation pages
• 4Practise kubectl edit, kubectl patch, and kubectl replace --force for objects that cannot be updated in place
• 5Memorise the vim settings you will need for YAML: set expandtab, set tabstop=2, set shiftwidth=2

• 1Run rolling updates and rollbacks with kubectl rollout status, history, and undo on a Deployment
• 2Mount the same ConfigMap as environment variables and as a volume, and repeat with a Secret
• 3Set requests and limits, then deliberately create a Pod that stays Pending and read the scheduler event that explains why
• 4Apply taints with kubectl taint, then schedule a Pod onto the tainted node using a toleration plus node affinity
• 5Configure a HorizontalPodAutoscaler and confirm metrics are available before expecting it to scale

• 1Create a StorageClass and demonstrate dynamic provisioning, then a static PersistentVolume bound to a matching claim
• 2Work through every access mode and reclaim policy combination and record what happens on claim deletion
• 3Mount a PersistentVolumeClaim into a Pod, write a file, delete the Pod, and prove the data survived
• 4Practise resizing a claim on a StorageClass that allows volume expansion
• 5Read the Kubernetes documentation persistent volumes page and note where the reclaim policy table sits, since you can open it during the exam

• 1Expose the same Deployment as ClusterIP, NodePort, and LoadBalancer, then inspect kubectl get endpoints for each
• 2Break a Service by changing a label selector and rehearse finding it from empty endpoints
• 3Resolve service names from a debug Pod using nslookup against the CoreDNS service
• 4Write a default-deny NetworkPolicy, then add ingress and egress rules that allow exactly one namespace
• 5Confirm your lab CNI plugin enforces NetworkPolicy, because policies applied under a CNI that ignores them will appear to work and will not

• 1Install an Ingress controller and route two hostnames to two backends with a single Ingress resource
• 2Work through the Gateway API documentation at gateway-api.sigs.k8s.io, which the Linux Foundation lists as an allowed CKA resource
• 3Create a GatewayClass, a Gateway, and an HTTPRoute, then confirm traffic reaches the intended Service
• 4Compare the Ingress and Gateway API object models side by side so a task naming either one does not slow you down
• 5Practise reading Gateway status conditions to find a route that is accepted but not programmed

• 1Build a cluster from scratch with kubeadm init and kubeadm join, then regenerate an expired join token
• 2Upgrade a control plane and then a worker node one minor version, following the kubeadm upgrade page on kubernetes.io
• 3Take an etcd snapshot with etcdctl snapshot save, including the --cacert, --cert, and --key flags, then restore it
• 4Drain and uncordon a node, and note which Pods refuse to evict without --ignore-daemonsets or --force
• 5Read the static Pod manifests in /etc/kubernetes/manifests and change an API server flag, watching the kubelet restart the component

• 1Create a ServiceAccount, Role, and RoleBinding, then verify permissions with kubectl auth can-i --as
• 2Repeat with a ClusterRole and ClusterRoleBinding and compare the scope of each
• 3Install a chart with Helm, list releases, upgrade with a values override, and roll back, using helm.sh/docs which is allowed during the exam
• 4Build the same application with a Kustomize base and two overlays, then apply with kubectl apply -k
• 5Install a CustomResourceDefinition and an operator, then create an instance of the custom resource and inspect its status

• 1Deliberately break the kubelet on a worker node, then restore it using systemctl status, journalctl -u kubelet, and the kubelet config file
• 2Corrupt an API server static Pod manifest and recover the control plane from the container runtime logs
• 3Practise the fixed order: kubectl get nodes, kubectl describe, kubectl logs, kubectl logs --previous, then node-level systemctl and journalctl
• 4Fix at least ten failure scenarios on killercoda.com, which hosts free browser-based Kubernetes labs
• 5Rehearse image-pull, CrashLoopBackOff, Pending, and Evicted Pods until you can name the likely cause from the event alone

• 1Use your first Killer.sh session under a strict two-hour clock and do not look at solutions until it ends
• 2Score yourself honestly, then list every task you left incomplete and the minute at which you lost control of the clock
• 3Redo only the failed tasks from a clean environment, with the timer running
• 4Re-read the curriculum PDF and mark any bullet you have never practised
• 5Rebuild your shell setup from memory in under sixty seconds

• 1Practise finding six specific YAML examples on kubernetes.io/docs using only the site search, timing each lookup
• 2Add a verification step to every task you practise: kubectl get, kubectl describe, or a curl from a debug Pod
• 3Rehearse kubectl config use-context and kubectl config get-contexts until switching clusters is automatic
• 4Drill the tasks in your weakest domain until each one finishes inside six minutes
• 5Run a full two-hour mixed set from killercoda and your own lab, skipping any task that passes eight minutes

• 1Take your second Killer.sh session, which contains a different set of 17 tasks from the first
• 2Run the PSI system check on the exact machine and network you will use, and install the PSI Secure Browser in advance
• 3Complete the Verify Name step in My Portal so your account name matches your government photo identification exactly
• 4Clear your desk and walls to the published standard: no papers, no notes, no second screen, door closed
• 5Book the exam at least three weeks ahead, since PSI slots are limited and reservations require 24 hours of lead time