Skip to content

Kubernetes Certification Preparation

The CNCF offers several certifications to validate your Kubernetes knowledge. This section has full written guides for the three performance-based exams:

The two entry-level, multiple-choice exams - KCNA (Kubernetes and Cloud Native Associate) and KCSA (Kubernetes and Cloud Native Security Associate) - are covered in the K8s Guide mobile app as app-only question banks and lessons. There are no written guides for them on this site yet.

Each guide includes:

  • Core topics you need to master
  • Trusted resources and courses
  • Practical exam tips and environment setup

Exam Overview

Cert Duration Format Focus Area
CKA 2 hours Hands-on lab Cluster operations, admin
CKAD 2 hours Hands-on lab App design, deployment
CKS 2 hours Hands-on lab Security and hardening

General Advice

  • Practice in a real cluster - don't rely only on theory (see Build a practice cluster below)
  • Learn to navigate kubectl quickly - alias everything
  • Master vim, tmux, and kubectl explain
  • Use tab-complete and kubectl -h constantly
  • Use --dry-run=client -o yaml for rapid manifest generation (the full list is in the kubectl cheat sheet)

Build a Practice Cluster

Every piece of advice on this page assumes you have a cluster to break. Build one locally before you buy an exam voucher. Three options, in increasing order of realism:

kind (fastest, multi-node, best default)

A multi-node cluster is not optional - CKA drain, cordon, taint, and node-troubleshooting tasks need somewhere for pods to go.

# kind-3node.yaml
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker

kind create cluster --name cka --config kind-3node.yaml
kubectl get nodes
kind delete cluster --name cka        # rebuild in ~60 seconds when you break it

minikube

minikube start --nodes=2 --cpus=2 --memory=4g
minikube addons enable metrics-server
minikube addons enable ingress

Install metrics-server (needed for kubectl top and HPA tasks)

kind does not ship it, and it needs one flag to work with kind's self-signed kubelet certs:

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
kubectl patch deployment metrics-server -n kube-system --type=json \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'
kubectl top nodes

kubeadm in VMs (required for CKA control-plane work)

kind and minikube hide the control plane, so they cannot teach you etcd backup and restore, certificate renewal, static pod repair, or kubeadm upgrade - and those are guaranteed CKA topics. Build at least one throwaway kubeadm cluster: two or three Linux VMs (multipass, Vagrant, or the cheapest cloud instances you can rent by the hour), swap off, a container runtime installed, then:

# On the control plane node
kubeadm init --pod-network-cidr=10.244.0.0/16
mkdir -p $HOME/.kube && cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

# On each worker
kubeadm join <cp-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>

Then deliberately break it: stop the kubelet, corrupt /etc/kubernetes/manifests/kube-apiserver.yaml, restore etcd from a snapshot. Snapshot the VMs first so you can roll back.

Resources

Disclosure: the Amazon links in the three book tables immediately below are affiliate links - I may earn a small commission on purchases, at no extra cost to you. I only link books I'd actually recommend, and each link opens an Amazon search for that exact title rather than a fixed product page, so check the edition before you buy. The rows explicitly labelled "Amazon search" are unfiltered results I have not vetted. The documentation, course, and lab links further down are not affiliate links and I have no commercial relationship with those providers.

Kubernetes and Cloud-Native Books

Resource Why it is useful
Kubernetes: Up and Running (3rd ed.) Practical foundation for architecture and operations
Kubernetes in Action (2nd ed.) Deep walkthrough of real-world platform usage
Production Kubernetes Reliability and production operations patterns
Cloud Native DevOps with Kubernetes CI/CD and platform workflows on Kubernetes

Security and Reliability Books

Resource Why it is useful
Kubernetes Security and Observability Security and telemetry tradeoffs in production
Practical Cloud Native Security with Falco Runtime detection and Kubernetes threat response
Seeking SRE Modern reliability practices and operating models
Fundamentals of Software Architecture Better platform design and tradeoff analysis

Certification Study Books

Resource Why it is useful
Amazon search: CKA study guides Unfiltered search results, not individually vetted - the written CKA guide on this site is the curated version
Amazon search: CKAD study guides Unfiltered search results, not individually vetted - see the CKAD guide
Amazon search: CKS study guides Unfiltered search results, not individually vetted - see the CKS guide

Documentation

Description Link
Official Kubernetes documentation Kubernetes Documentation

Online Courses

Course Link
CKA Course on KodeKloud CKA Course on KodeKloud
CKAD Design & Build on Pluralsight CKAD Design & Build on Pluralsight

Practice Labs

Description Link
Killercoda Killercoda
Play with Kubernetes Play with Kubernetes
Killer Shell killer.sh

Note: CKA and CKAD are open book against kubernetes.io/docs, kubernetes.io/blog and their subdomains. CKS allows the same list plus a handful of security-tool docs (Falco, Trivy, Tracee) - see the CKS guide. The allowed list changes, so the exam's own Important Instructions page, linked from your Linux Foundation portal, is the authoritative source. Read it the week before you sit.

Ready to Dive In?

Choose your path: