KCNA Deep Guide: Cloud Native Architecture & Exam Mastery

The Kubernetes and Cloud Native Associate (KCNA) certification tests your foundational understanding of the Cloud Native ecosystem, CNCF project landscape, and Kubernetes control plane mechanics.

TL;DR (Quick Summary)
#

Exam Format: 60 multiple-choice questions in 90 minutes. Minimum passing score: 75%.
Curriculum Weight Distribution:
- Kubernetes Fundamentals (32%)
- Container Orchestration (28%)
- Cloud Native Architecture (16%)
- Cloud Native Observability (10%)
- Cloud Native Application Delivery (14%)
Core CNCF Landscape: Prometheus (Monitoring), OpenTelemetry (Tracing), ArgoCD/Flux (GitOps), Jaeger, Helm, Harbor.
Key Focus: Distinguishing between CNCF Graduated, Incubating, and Sandbox projects.

1. KCNA Curriculum Domain Breakdown
#


pie title KCNA Exam Domain Weightage (%)
    "Kubernetes Fundamentals" : 32
    "Container Orchestration" : 28
    "Cloud Native Architecture" : 16
    "Cloud Native Application Delivery" : 14
    "Cloud Native Observability" : 10

2. CNCF Project Status Matrix
#

To score high on the KCNA exam, you must understand the graduation criteria of CNCF projects.

CNCF Tier	Maturity Criteria	Example Projects
Graduated	Production hardened, stable governance, high adoption, independent security audits.	Kubernetes, Prometheus, Envoy, Helm, Harbor, containerd, CoreDNS, ArgoCD, Jaeger.
Incubating	Production ready, growing adoption, documented security process.	OpenTelemetry, Flux, KubeVirt, Falco, Trivy, Kyverno, Dapr.
Sandbox	Experimental phase, innovative ideas, early adoption.	Telepresence, Backstage (previously), Wasmer ecosystem stubs.

3. Deep Dive: Cloud Native Observability (10%)
#

Observability in Cloud Native environments relies on the three pillars: Metrics, Logs, and Traces.

Prometheus Architecture (Metrics)
#

Prometheus uses a Pull model to scrape metrics HTTP endpoints (/metrics) formatted in OpenMetrics TSDB format.


graph LR
    AppPod["App Pod / Exporter (:9100)"] <--|Pull /metrics| PrometheusServer["Prometheus Server"]
    PrometheusServer --> TSDB["(TSDB Storage)"]
    PrometheusServer -->|Alert Rules| Alertmanager["Alertmanager"]
    Grafana["Grafana Dashboard"] -->|PromQL| PrometheusServer

Essential PromQL Exam Cheat Sheet
#

# 1. Total HTTP Requests per second over a 5m window
rate(http_requests_total[5m])

# 2. CPU Usage percentage per node
sum(rate(node_cpu_seconds_total{mode!="idle"}[5m])) by (instance) * 100

# 3. Pod Memory usage over 90% quota
(container_memory_working_set_bytes / container_spec_memory_limit_bytes) > 0.90

4. Deep Dive: Cloud Native Application Delivery (14%)
#

GitOps Workflow (ArgoCD vs Flux)
#

GitOps is a declarative operational framework where Git is the single source of truth for infrastructure and application code.


graph TD
    GitRepo["Git Repository / Main Branch"] -->|Commit Webhook| ArgoCD["ArgoCD Controller"]
    ArgoCD -->|Reconcile Loop| K8sCluster["Kubernetes API Server"]
    K8sCluster -->|Drift Detection| ArgoCD

Reconcile Loop: ArgoCD continuously compares the Desired State in Git with the Actual State in the Cluster. If drift occurs, ArgoCD auto-syncs the cluster back to the Git commit.

5. Lab Hands-On: Simulating a KCNA Architecture Check
#

Verify CoreDNS and API Server endpoints using kubectl:

# 1. Verify CoreDNS resolution
kubectl get endpoints kube-dns -n kube-system

# 2. Check cluster API endpoints
kubectl get --raw=/healthz

Expected Terminal Output:

ok

6. Exam Troubleshooting & Common Pitfalls
#

Pitfall 1: Confusing CNI with CRI
#

CRI (Container Runtime Interface): Connects kubelet to containerd / CRI-O.
CNI (Container Network Interface): Connects Pods to cluster overlay networks (Calico, Cilium, Flannel).

Pitfall 2: Confusing Ingress Controller with Ingress Resource
#

Ingress Resource: The YAML manifest defining rules (host: api.work.com).
Ingress Controller: The actual proxy pod running NGINX or Envoy that executes the rules.