The Docs Map — what you may open, and what you must know cold

Start with the fact that changes everything: the CNPE is not a broadly open-book exam. You do not get the project documentation sites for the tools you are being tested on. During the exam the permitted resources are narrow — essentially kubernetes.io/docs, kubernetes.io/blog, whatever task-specific pages the exam itself links from its Quick Reference box, and the documentation installed locally on the machine. Argo CD, Flux, Tekton, Crossplane, Backstage, Prometheus, OpenTelemetry, Kyverno, Istio and Helm are squarely in the exam domains, and their docs are not on the list. So this page does two jobs. First it maps kubernetes.io/docs properly, because that is your one real in-exam reference and it carries the Kubernetes-native half of the exam. Second it points you at the manifests you must be able to write from memory, because nothing will hand them to you — those now live on their own drillable page, Know It Cold — the manifests you must write from memory. The per-tool doc maps further down are still here, and still valuable — as study material, for the weeks before exam day.

Why the narrow allowlist should reshape your study plan

☺ Like you’re 10: You only get one book in the test. Learn that book by heart and memorise the recipes it doesn’t contain.

Let’s be precise about what the allowlist changes. Your preparation now has two distinct halves, and confusing them is how people fail. For anything Kubernetes-native — Deployments, Services, Ingress, NetworkPolicy, RBAC, storage, quotas, Pod Security Standards, HPA, scheduling, CRDs, admission webhooks — your bottleneck is retrieval and adaptation: can you find the example on kubernetes.io, change the three fields that matter, apply it and verify it inside the minutes the task deserves? For everything else — every CRD shipped by Argo CD, Flux, Tekton, Crossplane, Prometheus, OpenTelemetry, Kyverno, Gatekeeper or Istio — there is no page to retrieve. It is recall, or it is the Quick Reference box, or it is kubectl explain against the cluster in front of you.

Community reports of the CNPE consistently describe roughly seventeen hands-on tasks in 120 minutes, which averages out to something like seven minutes per task — and that average is a lie, because some tasks take ninety seconds and others will eat twenty minutes if you let them. That maths cuts both ways. Seven minutes is plenty of time to open a kubernetes.io page you already know and adapt the example. Seven minutes is not enough to reconstruct a Crossplane Composition from first principles with no reference — which is exactly why Know It Cold, the companion page holding every manifest you must recall unaided, is the highest-value thing this map points at, and why the per-tool maps below are study tools rather than exam tools.

Two in-exam fallbacks partly soften this, and you should rehearse both. The Quick Reference box: when a task involves a tool whose docs are not on the allowlist, the exam may link the specific page you need directly from the task. Read that box on every task before you reach for anything else — it is a permitted resource and it is targeted. kubectl explain: once a CRD is installed in the cluster, its full schema is in the cluster, and kubectl explain rollout.spec.strategy.canary --recursive gives you an authoritative, version-correct field list with no browser at all. For non-Kubernetes-core resources this is often the only reference you will have. Candidates who never learned it are the ones who guess.

The three failure modes to design your prep around

Foxy has collected the same three stories over and over from people who came out of the exam disappointed.

One: expecting a doc site that isn’t there. The single most expensive surprise is discovering at minute twenty that argo-cd.readthedocs.io is not reachable and you never learned the Application spec properly because you assumed you could look it up. Prepare as though the only reference is kubernetes.io, kubectl explain, and your own memory — because that is very nearly the case. Rule: if you cannot write a resource from memory today, that resource is on your study list, not your lookup list.

Two: the rabbit hole. A task looks nearly done, so you keep pushing. Twelve minutes later you’re debugging a webhook certificate and three easy tasks sit untouched. The universally repeated advice from people who passed: anything over five to seven minutes gets flagged and abandoned, and you come back only if there’s time at the end. Partial credit exists — people have passed without finishing every task — so a half-done task you leave behind still scores, and an unattempted easy task scores zero.

Three: not reading all the tasks first. Spend the first three or four minutes skimming every task and grading it: trivial / known / unknown. Bank all the trivial ones, then the known ones, then spend what’s left on the unknowns. This also lets your subconscious chew on the hard ones while your hands do the easy ones.

What you are allowed to open — and how to check

☺ Like you’re 10: You get to bring some books, not every book on the internet. Check the official rules yourself before exam day — don’t take my word for it.

Here is the most important sentence on this page: the only authority on what you may open during the exam is the official Linux Foundation / CNCF documentation for the CNPE. Not a blog. Not a YouTube video. Not this site. Exam rules are revised, permitted-resource lists get tightened and loosened, and a rule that was true when a blog post was written may be false on your exam day.

The pages to read before you book

Read these end-to-end at least once, and re-skim them in the final week:

• Resources Allowed During Exam — docs.linuxfoundation.org/tc-docs/certification/certification-resources-allowed. This is the authoritative per-exam allowlist. It is the page that tells you, in the Linux Foundation’s own words, that the CNPE permits kubernetes.io/docs, kubernetes.io/blog, exam-linked task documentation and locally installed docs — and nothing else. Read the CNPE row specifically; the neighbouring rows for CKA, CKAD and CKS are different and reading the wrong one is how the “Argo CD docs are open” myth spreads.
• Important Instructions: CNPE — docs.linuxfoundation.org/tc-docs/certification/important-instructions-cnpe. The canonical page for the exam environment: permitted resources, browser-tab rules, what the remote desktop provides, and how the terminal is set up.
• The Certification & Confidentiality FAQ on the Linux Foundation Training & Certification site — the general rules covering proctoring, ID, the room scan, permitted physical items, retakes, and conduct.

Two details on those pages routinely catch people out. The first is the search rule: you may use the search box on a permitted site, but you may not open external search results, and you may not follow outbound links off a permitted site onto a non-permitted one. A kubernetes.io page that links to helm.sh does not make helm.sh permitted. The second is the Quick Reference box in the exam interface: task-specific documentation linked from there is permitted, and for non-Kubernetes tooling it is frequently the only reference you will be given. Build the habit of reading it on every task.

The offline half of the map — which is most of it

Under a narrow allowlist, the division of labour is stark. Memorise names, shapes and the fields that carry meaning for every non-Kubernetes tool; look up syntax and exhaustive field lists for Kubernetes core on kubernetes.io, and for installed CRDs via kubectl explain. If you don’t know that the thing you want is called a “ConstraintTemplate,” nothing in the exam environment will tell you. That division is the whole study strategy — and it’s why the glossary and the flashcards earn their place next to this map rather than being replaced by it.

How to search docs fast

☺ Like you’re 10: There are a few tricks that get you to the right page in one jump instead of ten. Most of them are for studying at home; only the kubernetes.io ones work on the day.

Two audiences for this section. During the exam, the only site these techniques apply to is kubernetes.io — you may use its search box, but you may not click through to an external search engine or follow a link off-site. While studying, the techniques below are how you tour the project doc sites efficiently in the weeks beforehand. Keep the two contexts separate in your head.

Technique 1 — the scoped search-engine query (study time only)

A site: query on a general search engine is almost always faster and more forgiving than an in-site search box, because it matches full page text and tolerates the wrong vocabulary. Use these at your desk in the weeks before the exam — a general search engine is not a permitted in-exam resource, so the payoff on the day is what these searches put into your memory, not the searches themselves:

site:kubernetes.io networkpolicy default deny all ingress
site:kubernetes.io "topologySpreadConstraints" example
site:argo-cd.readthedocs.io applicationset matrix generator
site:fluxcd.io helmrelease values from configmap
site:tekton.dev workspaces pipeline example
site:argoproj.github.io rollouts analysistemplate prometheus
site:docs.crossplane.io composition patches toFieldPath
site:kyverno.io require pod resources policy
site:istio.io authorizationpolicy deny example
site:cert-manager.io issuer selfsigned example

# When you know the name but not the shape, ask for the reference page:
site:kubernetes.io PriorityClass reference
# When you want a copy-paste block, add the magic word:
site:tekton.dev triggers eventlistener yaml example

Two words do enormous work in these queries: example and yaml. Doc pages that contain a complete, copy-pasteable manifest almost always use one of them nearby. A third useful word is reference, which pulls you toward generated API reference pages when you need an exhaustive field list rather than a narrative.

Technique 2 — jump straight to the known anchor

Most project doc sites have the same three shelves, and you should learn which shelf each project keeps its gold on:

The habit to build, on kubernetes.io during the exam and on every project site while you study: go to the Tasks/Tutorials shelf first, not the Concepts shelf. You want a manifest, not an education. On kubernetes.io this maps cleanly — Tasks and Tutorials hold the complete manifests, Reference holds the field lists, and Concepts is where a timed candidate goes to lose four minutes (with the honourable exception that most Concepts pages end with a full example — scroll to the bottom before you leave).

Technique 3 — match the version

Nearly every doc site has a version selector, usually top-right or in the sidebar. Docs default to latest, which may be ahead of the cluster you’re given. This bites hardest around API-version churn: autoscaling/v2 vs v2beta2, Gateway API v1 vs v1beta1, Flux v1 vs v1beta2, Istio security.istio.io/v1 vs v1beta1. Check the cluster, then set the selector.

# What version is this cluster, really?
kubectl version

# Which API versions does THIS cluster actually serve?
kubectl api-resources | grep -i rollout
kubectl api-versions | grep -i gateway

# The single most under-used doc-avoidance tool: the docs are IN the cluster
kubectl explain networkpolicy.spec.ingress --recursive
kubectl explain hpa.spec.metrics
kubectl explain rollout.spec.strategy.canary   # works for CRDs too, once installed

Technique 4 — read the Quick Reference box before you touch the terminal

Because the general doc sites are closed to you, the exam’s own Quick Reference box is the highest-value thing on the screen for any task involving non-Kubernetes tooling. It is a permitted resource, it is task-specific, and it is the only sanctioned route to a Tekton or Crossplane page during the exam. Make reading it step zero of every task, before you open an editor and before you form a plan — a linked page you didn’t notice is a task you solved the hard way for no reason.

For the kubernetes.io half, speed still matters — but be clear about the rule. The Important Instructions state that candidates “are not allowed to have other applications or browser windows running except the one on which the Exam is being shown.” So plan on navigating within the exam’s own browser surface rather than parking a row of windows beforehand. Cold-starting a site — DNS, load, find search box, type, wait, scan — costs fifteen to thirty seconds each time, and you may do it dozens of times. And memorise the kubernetes.io URL patterns for the pages you use most, so you can type a deep link into the address bar rather than navigating to it.

Map 1 — kubernetes.io/docs, the reference you actually get

☺ Like you’re 10: This is the one book you’re allowed to bring. Learn it better than anything else on this page.

This is the only general doc site on the CNPE allowlist, so it deserves disproportionate study. The good news is that it is genuinely deep, and Kubernetes underpins every domain — a policy task still needs a Deployment to test against, a GitOps task still needs a Service, and an observability task still needs a workload emitting metrics. Whenever a task can be solved with Kubernetes-native objects, this site has your answer.

Its structure is stable and worth internalising as four shelves: Concepts (narrative, but nearly every page ends with a complete example manifest — always scroll to the bottom before leaving), Tasks (how-to pages with manifests and the commands to apply and verify them — your default destination), Tutorials (longer walk-throughs), and Reference (the generated API reference, the kubectl documentation, and the cheat sheet). kubernetes.io/blog is separately permitted and is occasionally the fastest source for a feature-introduction post explaining a newer API — Gateway API and the sidecar-container and in-place-resize features are good examples — but treat it as a supplement, not a primary map.

Two habits that pay off specifically because this site is all you get. First, learn the URL shape — kubernetes.io/docs/concepts/…, /docs/tasks/…, /docs/reference/… — so you can type a deep link instead of navigating. Second, learn the API reference, not just the narrative pages: kubernetes.io/docs/reference/kubernetes-api/ gives you the exhaustive, authoritative field list for every built-in kind, which is where you go when a narrative example doesn’t cover the field you need.

☺ Like you’re 10: The Network Policy page has a section that literally hands you the “block everything” recipe. That one bookmark is worth minutes.

If any of these rows made you think “I don’t actually know what that resource does,” that’s a study signal, not a search signal — go read the Kubernetes substrate, networking, storage & state, or scaling & scheduling first. The map only helps once you know the name of the thing.

What you must know cold — now its own page

☺ Like you’re 10: The recipes nobody will hand you got their own page, because they’re the part you actually have to memorise.

Here is the honest framing: kubernetes.io/docs will carry the Kubernetes-native half of the exam; there is a whole other half it won’t. Argo CD, Flux, Tekton, Rollouts, Crossplane, Prometheus, OpenTelemetry, Kyverno, Gatekeeper and Istio all sit inside named exam domains, and not one of their doc sites is on the allowlist. Your only routes to their specs are memory, the Quick Reference box, and kubectl explain — and memory is the one you control, so those skeletons deserve drilling rather than skimming.

Study maps — the project docs, for use before exam day

☺ Like you’re 10: Everything below is homework, not test material. These sites are shut on the day.

The four maps that follow are deliberately kept, because they are genuinely the fastest way to learn these tools — but be clear about what they are now for. Every external link below points at a site you cannot open during the CNPE. They are a study itinerary: a structured tour of where each project keeps its worked examples, so that in the weeks before your exam you can go and read the authoritative source, build the thing, and move the knowledge into memory where the exam can reach it.

Use them in that spirit. When a map says “copy the AnalysisTemplate from Features → Analysis,” read that as go and understand that page well enough to reproduce it. The one exception worth noting: if the exam’s Quick Reference box links a specific page for a task, that page is permitted — and it will usually be one of the pages mapped below, which is another reason to know their shape.

Map 2 — GitOps & continuous delivery (25%)

☺ Like you’re 10: This is the biggest exam domain, so these tabs are the ones you want open first.

The single largest domain, and the one where tool choice may be offered to you. Argo CD and Flux both appear in the official tool list; so do Tekton, Argo Workflows, Argo Rollouts and Flagger. You do not need to be expert in all six — but since none of their doc sites are open to you on the day, you need enough familiarity with each to write its core resource unaided. Work through this map at your desk, then close it and run the blank-page drill above. Pair it with GitOps Workflows and CI/CD & Progressive Delivery.

Map 3 — Platform APIs & self-service (25%)

☺ Like you’re 10: This is the “build a friendly button for developers” shelf — custom APIs, Crossplane, and the developer portal.

The other 25% domain. Tasks here tend to be “define an abstraction and prove a developer can use it”: a CRD, a Crossplane composite, a Backstage template, a Helm chart or Kustomize overlay. Background reading: Platform APIs & CRDs, Self-Service, IaC & Control Planes, Config Management.

☺ Like you’re 10: Crossplane has two YAMLs that look almost the same — the definition (for the platform team) and the claim (for the developer). Check which one the task wants.

Map 4 — Observability & operations (20%)

☺ Like you’re 10: This shelf is about seeing what’s happening: numbers, dashboards, traces, and what things cost.

Observability tasks split into “make the platform collect X” and “write the query/rule that uses X.” The collection half is nearly always a copyable manifest; the query half is where you may genuinely need to think, so budget accordingly. See also Observability, Reliability & Incidents, and FinOps.

☺ Like you’re 10: With the OpenTelemetry Collector, writing the receivers and exporters isn’t enough — you also have to say which ones connect to which. That’s the “pipelines” bit, and forgetting it is the classic mistake.

Map 5 — Security, policy & the mesh (15%)

☺ Like you’re 10: The guardrail shelf: rules that say no, encryption between services, and checks on what you ship.

Both major policy engines ship enormous libraries of ready-made policies — and neither library is reachable during the exam, so treat them as the best study resource in this domain rather than a lifeline on the day. Work through the Kyverno policy library and the gatekeeper-library now: read a dozen policies until the ClusterPolicy and ConstraintTemplate shapes feel obvious, so that when a task says “block containers running as root” you can write one rather than find one. Companion pages: Security & Policy Enforcement, Governance & Compliance, Secrets Management.

“Copy and adjust” — the discipline that turns an example into points

☺ Like you’re 10: Never reuse a recipe without changing the names to match your kitchen. Then taste it before you call it done.

Whether the example came from kubernetes.io, from a Quick Reference link, from an existing object already in the cluster, or straight out of your own memory, the same thing loses points next. Examples and remembered skeletons alike default to a fictional nginx in the default namespace; the grader is checking a specific object, in a specific namespace, with a specific name. Adopt a fixed checklist for every block you write:

# ── What the docs give you ─────────────────────────────────────
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress          # ① doc's name
  namespace: default                  # ② doc's namespace (often absent!)
spec:
  podSelector: {}                     # ③ matches ALL pods in the ns
  policyTypes:
  - Ingress

# ── What the task actually wanted ──────────────────────────────
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress-payments     # ① renamed to the required name
  namespace: payments                 # ② the namespace the task named
spec:
  podSelector: {}                     # ③ left broad ON PURPOSE — verified intent
  policyTypes:
  - Ingress                           # ④ add Egress too IF the task said "all traffic"

The four-point sweep, every time: ① name — does it match the string in the task, character for character? ② namespace — did the doc omit it (defaulting you to default)? ③ selectors and labels — do they actually match the workload in front of you, or the doc’s imaginary one? ④ scope — did the task ask for more than the example covers (both traffic directions, all namespaces, a second port)?

Then verify — the step that separates a pass from a near-miss

Applying without verifying is how people lose points on tasks they genuinely solved. Verification is cheap; make it reflexive.

# Did it even apply, and is the controller happy with it?
kubectl apply -f policy.yaml
kubectl get networkpolicy -n payments
kubectl describe networkpolicy deny-all-ingress-payments -n payments

# For anything reconciled by a controller, the STATUS is the truth
kubectl get application -n argocd            # SYNC STATUS / HEALTH STATUS
kubectl get kustomization -A                 # READY column + message
kubectl get rollout -n demo                  # DESIRED/CURRENT/UP-TO-DATE
kubectl get certificate -A                   # READY=True or it did not work
kubectl get clusterpolicy                    # Kyverno: BACKGROUND / READY

# When status is unhelpful, events almost always name the real problem
kubectl get events -n payments --sort-by=.lastTimestamp | tail -20
kubectl describe pod <pod> -n payments | sed -n '/Events/,$p'
kubectl logs -n argocd statefulset/argocd-application-controller --tail=50

# Prove a policy BLOCKS — the only real test of an enforcement task
kubectl run bad --image=nginx --privileged -n payments   # expect: rejected

Your exam-day reference plan

☺ Like you’re 10: You can’t line up a row of windows before you start — you get one. So the trick is knowing your way around the one site you’re allowed, fast. The long list of bookmarks is homework, not exam kit.

This is the part most study guides get wrong, so be deliberate — and the first thing to get right is that there is no tab allowance to plan around. The Important Instructions say candidates “are not allowed to have other applications or browser windows running except the one on which the Exam is being shown.” Anything you reach, you reach inside the exam’s own environment, and it must come from the permitted list: kubernetes.io/docs, kubernetes.io/blog, and pages the exam itself links from its Quick Reference box. That is a short list, which makes the terminal shortcuts below disproportionately important.

PERMITTED — park these before you read task one
 1  kubernetes.io/docs/                          ← home base; use its search box
 2  kubernetes.io/docs/reference/kubectl/quick-reference/     ← the cheat sheet
 3  kubernetes.io/docs/concepts/services-networking/network-policies/   ← default-deny
 4  kubernetes.io/docs/reference/access-authn-authz/rbac/     ← Role/RoleBinding
 5  kubernetes.io/docs/reference/kubernetes-api/  ← exhaustive fields for built-in kinds
 +  kubernetes.io/blog/                          ← permitted; good for newer APIs
 +  whatever the task's own "Quick Reference" box links — permitted, task-specific

NOT PERMITTED during the CNPE — study sites only, closed on the day
    argo-cd.readthedocs.io · fluxcd.io · tekton.dev · argoproj.github.io/argo-rollouts
    docs.crossplane.io · backstage.io · prometheus.io · prometheus-operator.dev
    opentelemetry.io · kyverno.io · open-policy-agent.github.io · istio.io · linkerd.io
    helm.sh/docs · cert-manager.io · grafana.com/docs · keda.sh · trivy.dev · falco.org
    …and general search engines. Do not follow outbound links off kubernetes.io either.

IN-TERMINAL SHORTCUTS — now your primary reference for everything above
  kubectl explain <kind>.spec --recursive        # authoritative, version-correct, instant
  kubectl api-resources | grep -i <word>         # find the kind, group + short name
  kubectl get <kind> -A -o yaml                  # an existing object IS a worked example
  kubectl create <thing> --dry-run=client -o yaml # generate boilerplate, don't type it
  argocd app --help / flux --help / kubectl <x> -h  # every CLI carries its own docs
  man <cmd>  ·  ls /usr/share/doc/               # locally installed docs are permitted

Re-check the rules, and re-walk the map, before exam day

Two things drift. The allowlist drifts — the Linux Foundation revises permitted resources per exam, and a page that describes the rules today (including this one) may be wrong by your exam date. Doc sites drift — pages move, sections get renamed, projects redesign navigation, and deep links rot, which matters for the study maps above.

So the thesis has two halves, and both are the actual job. For everything Kubernetes-native, the CNPE is not asking you to become a walking API reference — it is asking you to open kubernetes.io, adapt the right example, and prove it works. For everything else, the exam has quietly decided that a platform engineer should be able to write an Argo CD Application, a Tekton Pipeline or a Kyverno ClusterPolicy without help, and it is testing exactly that. Prepare for both halves and the narrow allowlist stops being a threat. Pair this map with the logistics in the exam guide, the lived experience in the field notes, the muscle memory in the command reference and the lab track, and the final sweep in the checklist. Then go and be fast.