↓ Skip to main content
Dev & Platform Engineering Hub
Dev & Platform Engineering Hub

CKA: Certified Kubernetes Administrator

If the CKAD proves you can use a cluster, the CKA proves you can build and fix the cluster itself. You will be expected to SSH directly into worker and master nodes, debug systemd services, and manually restore etcd databases from snapshots. This is Platform Engineering at its core.

1. Exam Overview and Mechanics
#

  • Duration: 2 Hours
  • Format: 100% Performance-Based (Terminal). 15-20 practical tasks.
  • Passing Score: 66%
  • Environment: Proctored online. Browser-based terminal connected to multiple clusters.
  • Allowed Resources: One browser tab open to kubernetes.io/docs.

The CKA requires a deeper level of Linux system administration knowledge than the CKAD. You must be comfortable managing services with systemctl, inspecting logs with journalctl, and navigating the host filesystem.

2. Curriculum Breakdown
#

Domain 1: Cluster Architecture, Installation & Configuration (25%)
#

  • RBAC: You must know how to create Roles, ClusterRoles, RoleBindings, and map them to Users/ServiceAccounts.
  • Kubeadm: You will likely be asked to upgrade a live cluster (Master and Worker nodes) from one Kubernetes version to the next using the kubeadm tool, without causing downtime.
  • ETCD Backup and Restore: This is almost guaranteed to be on the exam. You must know how to use the etcdctl CLI to take a snapshot of the database and restore it to a specific directory.

Domain 2: Workloads & Scheduling (15%)
#

  • Deployments and DaemonSets: Standard workload management.
  • Node Selectors and Taints/Tolerations: You must know how to force a Pod to schedule on a specific node, or prevent Pods from scheduling on a node (using kubectl taint).

Domain 3: Services & Networking (20%)
#

  • Network Policies: Writing complex firewalls to isolate namespaces.
  • Ingress: Configuring Ingress resources and understanding how Ingress Controllers route traffic.
  • CoreDNS: Understanding how Pods resolve DNS names internally.

Domain 4: Storage (10%)
#

  • PVs and PVCs: You must know how to manually provision a Persistent Volume (e.g., using a hostPath on a specific node) and bind a PVC to it.

Domain 5: Troubleshooting (30%)
#

This is the most critical and heavily weighted section.

  • Cluster Failures: You will be given a node that says NotReady. You must SSH into it, discover that the kubelet is crashed, read the journalctl -u kubelet logs, find the misconfiguration in /var/lib/kubelet/config.yaml, fix it, and restart the service.
  • Application Failures: Diagnosing why a Pod is stuck in CrashLoopBackOff.
  • Network Failures: Figuring out why a Service is not routing traffic to its endpoints.

3. Terminal Survival Strategies for the CKA
#

Strategy 1: Context Switching and SSH
#

In the CKA, you are managing multiple different clusters. The exam interface will explicitly tell you to run a command before attempting the question: kubectl config use-context cluster1-admin@cluster1

CRITICAL RULE: Always run the context switching command exactly as provided. If you fix the cluster in the wrong context, you will get 0 points for the question.

Furthermore, when troubleshooting Nodes, you will have to SSH into them:

ssh node01
sudo -i
# Do your repairs...
exit
exit

Do not forget to exit back to the main jumpbox before moving to the next question!

Strategy 2: Mastering ETCD Backup
#

Do not try to memorize the etcdctl command. Instead, memorize the search term to find it in the documentation.

  1. Open kubernetes.io/docs.
  2. Search for “Backing up an etcd cluster”.
  3. Copy the etcdctl snapshot save command.
  4. Note that you MUST provide the --endpoints, --cacert, --cert, and --key flags. The exam will usually provide the file paths to these certificates in the question prompt.

Strategy 3: The kubeadm Upgrade Dance
#

Upgrading a cluster requires a very specific sequence of events. You must memorize this pattern:

  1. kubectl drain node01 --ignore-daemonsets (Evict all workloads safely).
  2. apt update && apt install kubeadm=1.28.0-00 (Upgrade the tool).
  3. kubeadm upgrade apply v1.28.0 (Upgrade the control plane).
  4. apt install kubelet=1.28.0-00 (Upgrade the node agent).
  5. systemctl restart kubelet.
  6. kubectl uncordon node01 (Allow workloads to return).

Strategy 4: Debugging the Kubelet
#

If a Node is NotReady, the kubelet process is almost certainly broken. Use standard Linux commands to find the error:

# Check the service status
systemctl status kubelet

# Read the last 50 lines of logs
journalctl -u kubelet | tail -n 50

Common issues include incorrect paths to certificates in the kubelet config file, or Docker/containerd being stopped.

Next Steps
#

The CKA is a brutal exam, but the reward is immense. Once you pass, you will have the confidence to walk into any enterprise environment and take control of their infrastructure.

If you hunger for the ultimate challenge, the CNCF reserves its hardest exam exclusively for CKA holders: The CKS (Certified Kubernetes Security Specialist).