Certified Kubernetes Administrator (CKA)
Install, configure, run and troubleshoot Kubernetes clusters from the command line with kubectl and kubeadm. Lessons, exam-style practice, timed mocks and an AI tutor, mapped to every objective of the official exam guide.
Free Included · 7-day free trial
The exam
- Format
- About 15–20 hands-on tasks in a terminal
- Time
- 120 minutes
- Passing score
- 66%
- Exam fee
- USD 445 (exam only; bundles cost more), one free retake included; two killer.sh simulator sessions included (36 hours each, 17 tasks)
- Valid for
- 2 years; renew by retaking and passing the current exam before expiry (earning or renewing CKS from 18 June 2026 extends CKA to match)
- Delivery
- Online proctored; performance-based tasks solved in a terminal on live Kubernetes clusters
Official exam page · booked with CNCF
Every section of the exam guide
5 sections and 27 objectives, in the official weights. Each lesson is mapped to the objectives it covers.
Section 1 · Cluster Architecture, Installation and Configuration25%
What the exam asks
- Manage role based access control (RBAC)
- Prepare underlying infrastructure for installing a Kubernetes cluster
- Create and manage Kubernetes clusters using kubeadm
- Manage the lifecycle of Kubernetes clusters
- Implement and configure a highly-available control plane
- Use Helm and Kustomize to install cluster components
- Understand extension interfaces (CNI, CSI, CRI, etc.)
- Understand CRDs, install and configure operators
Lessons
- Role-based access control (RBAC)
- Preparing infrastructure and building a cluster with kubeadm
- Cluster lifecycle and high availability
- Helm and Kustomize
- Extension interfaces, CRDs and operators
Section 2 · Workloads and Scheduling15%
What the exam asks
- Understand application deployments and how to perform rolling update and rollbacks
- Use ConfigMaps and Secrets to configure applications
- Configure workload autoscaling
- Understand the primitives used to create robust, self-healing, application deployments
- Configure Pod admission and scheduling (limits, node affinity, etc.)
Lessons
- Deployments, rolling updates and rollbacks
- ConfigMaps and Secrets
- Autoscaling and self-healing workloads
- Pod admission and scheduling
Section 3 · Services and Networking20%
What the exam asks
- Understand connectivity between Pods
- Define and enforce Network Policies
- Use ClusterIP, NodePort, LoadBalancer service types and endpoints
- Use the Gateway API to manage Ingress traffic
- Know how to use Ingress controllers and Ingress resources
- Understand and use CoreDNS
Lessons
- Pod Connectivity and Network Policies
- Services and Endpoints
- Gateway API and Ingress
- CoreDNS and Cluster DNS
Section 4 · Storage10%
What the exam asks
- Implement storage classes and dynamic volume provisioning
- Configure volume types, access modes and reclaim policies
- Manage persistent volumes and persistent volume claims
Lessons
- StorageClasses and dynamic provisioning
- Volumes, access modes, reclaim policies, PVs and PVCs
Section 5 · Troubleshooting30%
What the exam asks
- Troubleshoot clusters and nodes
- Troubleshoot cluster components
- Monitor cluster and application resource usage
- Manage and evaluate container output streams
- Troubleshoot services and networking
Lessons
- Troubleshooting Clusters and Nodes
- Troubleshooting Control-Plane Components
- Monitoring Cluster and Application Resource Usage
- Container Output Streams and Logs
- Troubleshooting Services and Networking
14-Day Standard Plan
The default path. It covers all 20 lessons and all 10 labs in order, with a section drill after each section and flashcards on most days. Troubleshooting (30%) and cluster setup (25%) get the most days. Mock exams and the first killer.sh session fill the last three days, as the real exam is hands-on and wants stamina. Lab days are longer than lesson days: the kubeadm lab alone is about two hours. About 1.5–3 hours a day.
- Day 1RBAC and building a cluster with kubeadm
- Day 2Lifecycle, high availability and the kubeadm lab
- Day 3Helm, Kustomize, CRDs and operators
- Day 4k1 drill, Deployments and configuration
- Day 5Autoscaling, self-healing and scheduling
- Day 6Pod connectivity, network policies, Services
- Day 7Gateway API, Ingress and CoreDNS
- … and 7 more days, with mock exams at the end
Sample questions
Written for practice in the style of the real exam: never questions from the real exam.
Sample question 1
A GitOps pipeline applies a manifest with spec.replicas: 3 for a Deployment that also has an HPA. After each pipeline run, the Deployment drops back to 3 Pods even when the HPA wants 8. What is the best fix?
- ASet the HPA minReplicas to 3 so that the pipeline matches the autoscaler
- BRemove spec.replicas from the applied manifest so that the HPA owns the count
- CAnnotate the Deployment as paused so that the pipeline can no longer change it at all
- DChange the Deployment strategy to Recreate so apply keeps the current count
Show the answer
B. If the manifest sets replicas, every apply writes that number and briefly fights the HPA. Leaving the field out lets the HPA manage replicas.
Sample question 2
Which command shows the expiration dates of the certificates that kubeadm manages on a control-plane node?
- A
kubectl get csr --watchon the control plane node - B
kubeadm certs check-expirationon the control plane - C
kubeadm token liston the control-plane node, with the TTL column - D
etcdctl member listwith the etcd endpoint and TLS flags
Show the answer
B. Leaf certificates last one year. kubeadm certs check-expiration is the quickest overview; kubeadm certs renew all renews them.
About this exam
Is the CKA multiple choice?
No. It is a performance-based exam: about 15 to 20 tasks solved in a terminal on live clusters within 2 hours, graded automatically. This course's questions are multiple choice to test understanding; the labs and killer.sh train the hands-on side.
What score do I need?
66%. Tasks are weighted, so a long task can be worth more than a short one. The score report is emailed within 24 hours.
Which Kubernetes version does the exam use?
Kubernetes v1.37 today. The environment is updated within roughly four to eight weeks of each minor release, so check the CKA page and the curriculum repository before you book.
What can I open during the exam?
The Kubernetes documentation and blog, the Helm documentation and the Gateway API documentation (CKA only), plus the links in each task's Quick Reference box. Searching inside kubernetes.io/docs is allowed, but you may not open external search results. No notes, phones or other devices.
Is there a free retake and how long does the exam stay valid?
One free retake is included in the standard USD 445 price. The certification is valid for 2 years; earning or renewing CKS on or after 18 June 2026 extends your CKA to match it. Booking and any retake must happen within 12 months of purchase.
What is killer.sh and should I use it?
A simulator included with your registration: two sessions, each with 17 tasks and 36 hours of access from activation. Many candidates find it harder than the real exam, which is useful practice, but that is a community view, not an official one. Use it after the lessons and a few mock exams, and read the solutions afterwards.
How long should I study?
Plan 14 days at 1.5 to 3 hours a day if you already know Kubernetes basics, or 21 days if you are newer. The 7-day plan is for working administrators. Spend time at a terminal: type the lab commands instead of copying them.
Which topics weigh most?
Troubleshooting 30%, Cluster Architecture, Installation and Configuration 25%, Services and Networking 20%, Workloads and Scheduling 15%, Storage 10%. Troubleshooting and cluster setup together are 55% of the score.
Do I need to memorise YAML?
No, but you must be fast. Use imperative commands (kubectl create, run, expose, set image, autoscale) and --dry-run=client -o yaml to start a manifest, copy examples from the allowed docs, and use kubectl explain for field names.
Are Helm, Kustomize and the Gateway API on the exam?
Yes. The curriculum lists Helm and Kustomize for installing cluster components and the Gateway API next to Ingress controllers and resources, and the Helm and Gateway API docs are on the allowed list.
See where you stand in 8 minutes
Ten questions from this course, weighted like the real exam, with your score by section and a rough chance of passing.