cka

Certified Kubernetes Administrator

DevOps / Containers

The Certified Kubernetes Administrator exam validates the skills, knowledge and competency to perform the responsibilities of a Kubernetes administrator, including installation and configuration of production-grade clusters, networking, storage, security, maintenance, logging and monitoring, application lifecycle, and troubleshooting.

exam: 17 questions · 120 min

Sign up free — practice 5 questions on this cert without a card.

Kubernetes administrationkubectlPerformance-based120 min exam~17 hands-on tasks66% to pass$445 USD

Difficulty

Hard

Avg study time

80-150h

2-3 months typical

Pass rate

Not published

Community reports cluster around ~60-65% first-attempt; the simulator (killer.sh) is intentionally harder than the real exam

Market demand

Very High

Most-cited Kubernetes credential in DevOps/SRE job postings; salary band $130K-$180K

Exam Domain Breakdown

Cluster Architecture, Installation & Configuration25%
Workloads & Scheduling15%
Services & Networking20%
Storage10%
Troubleshooting30%

Difficulty by Topic

kubectl fluency under time pressure
Imperative commands, --dry-run=client -o yaml, JSONPath, custom-columns - speed matters more than knowledge
Cluster install with kubeadm
kubeadm init, joining nodes, certificates, kubeconfig setup, container runtime configuration
Cluster upgrades
kubeadm upgrade plan/apply, version skew rules, drain/uncordon ordering, kubelet + kubectl bumps
etcd backup and restore
etcdctl snapshot save/restore syntax, certificate flags, restoring to a new data directory
RBAC (Roles, ClusterRoles, ServiceAccounts)
Verbs/resources/apiGroups, distinguishing Role vs ClusterRole, kubectl auth can-i for verification
Pod scheduling (taints, tolerations, affinity)
nodeSelector vs nodeAffinity, taints/tolerations effects (NoSchedule/NoExecute), pod affinity topology keys
Services & Ingress
ClusterIP/NodePort/LoadBalancer differences, Ingress rules, IngressClass, endpoint mapping
NetworkPolicies
Default-deny patterns, ingress/egress rules, podSelector + namespaceSelector composition - widely under-practiced
Persistent storage
PV/PVC binding, StorageClasses, reclaim policies, access modes (RWO/RWX/ROX), volumeBindingMode
Cluster troubleshooting (kubelet, CoreDNS, CNI)
systemctl status kubelet, journalctl -u kubelet, /etc/kubernetes/manifests, CoreDNS logs - troubleshooting is 30% of the exam

Exam Tips

1

First task on the exam: configure your shell. alias k=kubectl, source <(kubectl completion bash), complete -F __start_kubectl k, export do='--dry-run=client -o yaml'. The 30 seconds you spend here saves minutes on every subsequent task.

2

Never write manifests from scratch when you can scaffold them. kubectl run/create/expose with --dry-run=client -o yaml > pod.yaml then edit is faster and less error-prone than typing YAML by hand.

3

kubernetes.io/docs is open in your exam browser - bookmark the pages you reach for repeatedly (Pods, Services, Ingress, NetworkPolicy, StatefulSet, RBAC). The official docs include copy-pasteable examples for every resource.

4

Always run kubectl config use-context <name> as the first command of every task. Tasks span multiple clusters and grading happens on the wrong cluster if you forget. Many candidates lose easy points to this.

5

Set the namespace once per task with kubectl config set-context --current --namespace=<ns> instead of typing -n <ns> on every command. Saves keystrokes and prevents 'wrong namespace' mistakes.

6

Troubleshooting is 30% of the exam - the largest single domain. Practice node-level debugging: systemctl status kubelet, journalctl -u kubelet -f, crictl ps, /etc/kubernetes/manifests, /var/log/pods. Don't only practice kubectl describe.

7

etcd backup and restore is almost guaranteed to appear. Memorize the etcdctl syntax cold, including the --endpoints, --cacert, --cert, --key flags. Practice restoring to a new --data-dir and updating the static pod manifest to point at it.

8

Cluster upgrade tasks follow a strict order: drain the node, upgrade kubeadm, kubeadm upgrade plan/apply (control plane) or kubeadm upgrade node (worker), upgrade kubelet + kubectl, systemctl restart kubelet, uncordon. Skipping drain or restart loses points.

9

Use the bundled killer.sh simulator twice - it's included free with your exam purchase. The simulator is intentionally harder and broader than the real exam; if you can score ~70% on it, the real exam will feel manageable.

10

Time budget: ~17 tasks in 120 minutes is ~7 minutes per task, but task weights vary. Read the task header for the percentage value, flag anything that looks like > 10 minutes, and come back to it after sweeping the easier ones.

Study Resources

Who It's Best Suited For

Platform engineers and SREs

CKA is now a hiring filter for platform/SRE roles - the exam mirrors the day-to-day work of operating production Kubernetes clusters.

DevOps engineers running container workloads

If your team runs Kubernetes (managed or self-hosted), CKA proves you can troubleshoot at the cluster layer when something breaks at 3am, not just deploy via kubectl apply.

Linux sysadmins transitioning to containers

The hands-on, command-line format rewards strong Linux fundamentals (systemd, journald, networking) more than any other cloud-native cert.

Engineers planning to take CKS

CKA is a hard prerequisite for the Certified Kubernetes Security Specialist (CKS) exam. You cannot register for CKS without an active CKA.

Certification Path