Certified Kubernetes Application Developer

Configure your shell as the very first action: alias k=kubectl, source <(kubectl completion bash), complete -F __start_kubectl k, export do='--dry-run=client -o yaml', export now='--force --grace-period=0'. The 30 seconds you spend here saves minutes on every subsequent task.

Never write manifests from scratch when scaffolding works. kubectl create deployment / kubectl run / kubectl expose with --dry-run=client -o yaml > x.yaml then edit beats typing apiVersion / kind / spec.template.spec.containers by hand every time.

kubernetes.io/docs is open in your exam browser - bookmark Pods (lifecycle, multi-container), ConfigMap, Secret, Deployment, Probes, NetworkPolicy, Service, Ingress, Helm, Kustomize before exam day. Almost every objective has copy-pasteable YAML in the docs.

Always run kubectl config use-context <name> as the first command of every task. Tasks span multiple clusters and grading happens on the wrong cluster if you forget. Set the namespace once with kubectl config set-context --current --namespace=<ns> instead of typing -n on every command.

Application Environment, Configuration and Security is the largest domain at 25%. Nail ConfigMap and Secret injection in all three forms (env, envFrom, volume mounts), and know the difference between projected volumes, immutable=true, and using a Secret in imagePullSecrets. This single area returns the most points per study hour.

Multi-container Pod patterns appear on almost every attempt - usually as 'one container produces logs into a shared emptyDir volume, the second container ships them somewhere'. Practice the sidecar + emptyDir pattern until you can write the YAML without thinking. Init containers are tested separately and run sequentially before the main containers, not in parallel.

Probe questions have a trap: liveness probe failures restart the container; readiness probe failures only remove the Pod from Service endpoints. If a question says 'the Pod should be removed from the Service when X is failing but not restarted', the answer is a readiness probe, not a liveness probe.

NetworkPolicy is the highest-leverage topic in Services and Networking. Memorize the default-deny-ingress / default-deny-egress YAML cold (empty podSelector + policyTypes). Also know that NetworkPolicy is additive - multiple policies are OR'd, never AND'd - and that DNS egress to kube-system requires explicit allow when default-deny-egress is on.

Use the bundled killer.sh CKAD simulator twice - it's included free with your exam purchase. The simulator is intentionally harder and broader than the real exam; if you can finish it within the time budget on the second pass, the real exam will feel manageable.

Time budget: ~15-20 hands-on tasks in 120 minutes is roughly 7 minutes per task, but task weights vary. Read the percentage value in each task header, flag anything that looks > 10 minutes for later, and sweep the 2-4% quick wins first.