CKA — Certified Kubernetes Administrator

Certifications summarized the CKA in one line of a three-way comparison: 100% performance-based — no multiple choice anywhere on the exam. This page is the full profile behind that line: the exact format, the five official domains and how they're weighted, an honest accounting of how much of this course's existing Kubernetes coverage already prepares you and how much is a genuine gap, and what actually works when you study for an exam that grades the final state of a live cluster instead of a bubble sheet.

What the CKA actually tests, and who it's for

☺ Like you're 10: It's the test for the person who keeps the cluster itself alive — not the person deploying apps onto one someone else built.

The Certified Kubernetes Administrator is administered by The Linux Foundation on behalf of the CNCF and has existed since 2017, making it one of the oldest and most widely recognized credentials in the cloud-native space. It certifies exactly one thing: can you operate a Kubernetes cluster? Not describe one from memory, not diagram its architecture on a whiteboard — actually build it, keep it healthy, and fix it when it breaks, working directly at a terminal against real clusters.

That framing matters for where it sits relative to this course. Containers & orchestration and the Kubernetes tool page are written at the altitude of someone deploying onto a cluster that already exists and that someone else keeps running — writing correct manifests, reading what the reconciliation loop is telling you, shipping a workload with confidence. The CKA is written at the altitude of the person who is that someone else: the one who bootstraps the control plane, backs up the data store the whole cluster's state lives in, and gets paged when the API server itself won't start. If you're a DevOps engineer who's started picking up cluster-ownership responsibilities — or wants to prove you could — this is the exam that certifies it. If your job stops at the Deployment manifest and someone else runs the infrastructure underneath it, the CKAD is very likely the better match; see the comparison at the end of this page.

The format, in full

☺ Like you're 10: Two hours, real clusters, one browser tab of official docs allowed, and two-thirds right to pass — no multiple choice anywhere.

Every fact below is what The Linux Foundation and CNCF generally publish and what candidates consistently report as of this writing. Treat it as a reliable planning baseline, not a locked contract — every one of these numbers has changed at some point in the exam's history, and the warning box further down explains exactly what to check before you register.

The single detail worth over-explaining is what "performance-based" changes about how you're graded. A knowledge-based exam — the Terraform Associate on the comparison page is the example already on this site — scores whether you picked the correct option from a list. The CKA never asks you to pick anything. Each task describes an end state ("cluster ek8s, node node-1 is cordoned and upgraded to the target version") and a grader inspects the cluster afterward to see whether that end state was actually reached — not which commands you ran, not how elegant your YAML was, not whether you understood why it worked. An answer you didn't verify with kubectl get before moving on is an answer you may not have actually given.

↗ Linux Foundation official CKA page

The five domains and their weights

☺ Like you're 10: Five topics, not equally sized — nearly a third of the whole exam is just "something's broken, go find it and fix it."

The CNCF publishes a versioned curriculum for the CKA with five domains that sum to exactly 100%. The weights below have stayed stable across several curriculum revisions even as individual bullet points under each domain have shifted — most recently to add Helm and Kustomize under cluster installation, and the Gateway API alongside Ingress. Confirm you're studying the current revision's exact bullet list before you sit, since that detail moves faster than the weights do.

Two domains deserve a closer look because they're the ones that surprise people who last skimmed this curriculum a while back. Cluster Architecture, Installation & Configuration (25%) covers RBAC, preparing infrastructure for a cluster, building and upgrading clusters with kubeadm, running an HA control plane, installing components via Helm and Kustomize, and understanding the CNI/CSI/CRI extension interfaces — this whole domain is "own the cluster," not "deploy onto one," and it's the single biggest chunk of genuinely new material for most DevOps engineers coming in. Troubleshooting (30%) has no new objects to learn at all — it's a method, not a syllabus: troubleshoot cluster and node health, troubleshoot cluster components themselves, monitor resource usage, read container output streams, and troubleshoot services and networking, all under the same time pressure as everything else.

What this course already covers — and the real gap

☺ Like you're 10: You already know a good chunk of the "living in the apartment" half. The CKA adds the "wired the building" half on top.

Containers & orchestration and the Kubernetes tool page deliberately stop at the boundary the Kubernetes page itself names: the altitude of someone deploying onto a cluster, not administering one. That's genuinely useful CKA prep for two of the five domains and a meaningful head start on a third — but it's honest to be specific about exactly where the coverage stops, since the CKA doesn't care which parts feel familiar.

The honest summary: this course gets you real partial credit on two domains worth 45% of the exam combined, and a head start on a third worth 15% more — but the biggest single domain (Cluster Architecture, 25%) and the smallest (Storage, 10%) are both close to a cold start. The snippet below is a taste of exactly that gap material — the kind of task that shows up nowhere else on this site because it belongs to cluster ownership, not application deployment.

# etcd backup — the CKA's signature "know these flags cold" task.
# etcd is the cluster's only real state; nothing else in Kubernetes stores anything durably.
etcdctl snapshot save /opt/backups/etcd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

# a worker-node upgrade, in the order the Kubernetes docs give it —
# get this sequence wrong and you either strand workloads or skip the drain entirely
apt-mark unhold kubeadm && apt-get install -y kubeadm=1.31.1-1.1 && apt-mark hold kubeadm
kubeadm upgrade node
kubectl drain node-2 --ignore-daemonsets --delete-emptydir-data
apt-mark unhold kubelet kubectl && apt-get install -y kubelet=1.31.1-1.1 kubectl=1.31.1-1.1 && apt-mark hold kubelet kubectl
systemctl daemon-reload && systemctl restart kubelet
kubectl uncordon node-2

# "can this ServiceAccount actually do the thing" — the RBAC command that saves you every time
kubectl auth can-i delete deployments --as=system:serviceaccount:ci:deployer -n staging

How to actually prepare for a hands-on exam

☺ Like you're 10: Flashcards won't help here. You have to actually type the commands, over and over, until your hands remember them faster than your brain does.

Studying for a performance-based exam looks nothing like studying for a knowledge-based one, and treating the CKA like a bigger version of a multiple-choice test is the single most common way people burn a first attempt. There's no bank of facts to memorize because there's no question to answer from memory — there's a broken thing and a clock.

• Build real, disposable clusters, repeatedly. kind or minikube work for most of Workloads, Services, and Storage; the Cluster Architecture domain specifically needs real (or virtual) machines and kubeadm, since that's what's actually on the exam. Bootstrap a two-node cluster from scratch more than once — the second time is always faster, and that speed is the whole point.
• Practice being open-book, not just being allowed to be. Since kubernetes.io/docs is the only resource available, the winning skill is navigating it fast under pressure — knowing which page the etcd flags live on, not memorizing the flags themselves. Do every practice task with only that one tab open, the same constraint you'll have on the day.
• Sabotage your own cluster on purpose. Since Troubleshooting alone is 30% of the score, deliberately breaking things and fixing them without notes is worth more study time than any other single activity: corrupt a static Pod manifest in /etc/kubernetes/manifests/, delete a Service's label selector, scale CoreDNS to zero, write a NetworkPolicy with no DNS egress rule, point a PVC at a StorageClass that doesn't exist. Fix each one cold.
• Time yourself from day one. Fifteen to twenty tasks in two hours is roughly six minutes each on average, and some are worth far more than others — reading every task's point value before diving in, and triaging the high-value ones first, is a real exam skill independent of Kubernetes knowledge.
• Reuse what already overlaps, then dedicate separate time to what doesn't. Drill the rollout/rollback muscle memory in Drill — Roll Back a Bad Deploy and practice a full deployment cycle in Capstone Part 3 — Deployment Strategy; neither one touches kubeadm or etcd, so budget dedicated hours for those separately rather than assuming the course's labs already cover them.

Exam-day logistics and the open-book allow-list

☺ Like you're 10: You book online, prove who you are on camera, clear your desk completely, and get exactly one browser tab of official docs — nothing else.

The CKA is delivered remotely through a proctored secure browser — historically the PSI Secure Browser, though the vendor has changed before and could again. You'll go through an ID check and a room scan before the timer starts: a clear desk, no second monitor, no phone within reach, no notes on paper or screen. The open-book allowance is real but narrower than people expect — it's a single tab restricted to kubernetes.io/docs and a short, occasionally-updated list of related official pages, not the open internet, and not your own bookmarks or notes files. Read the current Candidate Handbook for the exact allow-list before you sit; it's the detail on this whole page most likely to have shifted since it was written.

Where CKA sits on the CNCF ladder — and what's next

☺ Like you're 10: It's the middle rung of a ladder, not a ladder by itself — know what's below it, beside it, and above it before you commit study time.

Treat the CNCF's certifications as a small floor plan rather than one straight line. KCNA — Kubernetes and Cloud Native Associate sits below the CKA as the knowledge-based, no-prerequisite entry point — a reasonable starting line if the CKA still feels premature. The CKA and CKAD sit side by side at practitioner level, same performance-based style, different half of Kubernetes: CKA is the cluster the workloads run on, CKAD is the workloads themselves, built by someone who doesn't necessarily administer the cluster underneath them. Above both, CKS — Certified Kubernetes Security Specialist requires an active CKA as a prerequisite and goes deep on hardening, supply-chain, and runtime security — not a place to start.

Relative to the rest of this course's certification shelf: if you're choosing a first certification and haven't touched Kubernetes hands-on yet, the three-way comparison still recommends the Terraform Associate as the faster, cheaper on-ramp — an hour, knowledge-based, no prerequisites. Come back to the CKA once you're ready to actually operate a cluster rather than just deploy onto one, and once you've put in real hours at a terminal against a throwaway cluster of your own — not before.