New The CKA course: 17 modules, 177 labs, 15 mock exams

Break real infrastructure. Fix it. Get certified.

Hands-on prep for cloud and DevOps certifications: live clusters, labs graded against what you built, and timed mock exams.

Start learning free Find your learning path

No card needed
Real kubeadm clusters
5 starter labs free

1 / 198% · Troubleshooting

Use context kubectl config use-context k8s-t7

In namespace default, Service frontend-svc is meant to expose the pods of Deployment frontend on port 80, but requests to it fail.

Fix the Service so that requests to http://frontend-svc return the pods' web page. Don't change the Deployment or its pods. The Service has two problems.

All checks passed

Deployment frontend still labels its pods app=frontend
frontend-svc selects app=frontend
frontend-svc forwards to container port 80
frontend-svc serves nginx

FlagNext

2 / 197% · Troubleshooting

Use context kubectl config use-context k8s-t8

In namespace default, pods crashy and probey keep restarting.

Fix both pods so that they run without restarting, and keep their names. crashy must run nginx with its default configuration. probey must keep an HTTP liveness probe that checks its nginx web server.

All checks passed

crashy Ready
crashy serves the nginx welcome page
probey Ready
probey has an HTTP liveness probe
probey stays up (no restarts, no failed probes for 20s)

FlagNext

3 / 195% · Troubleshooting

Use context kubectl config use-context k8s-t9

In namespace default, pods hungry and picky stay Pending. Find the reason for each.

Fix hungry by changing its cpu request to 100m; keep the rest of the pod as it is. Fix picky by adding the label it needs to node node01; don't change picky itself. Both pods must end up Running.

All checks passed

hungry Ready
hungry requests 100m cpu
picky still selects gpu=true
node01 is labelled gpu=true
picky Ready

FlagNext

4 / 195% · Troubleshooting

Use context kubectl config use-context k8s-t11

1. Write only the lines that contain ERROR from the logs of pod noisy (namespace default) to /opt/noisy-errors.txt. 2. Write the events of all namespaces, sorted by their creation time, to /opt/events.txt in kubectl's default table format. 3. Write the name of the pod in namespace kube-system that uses the most memory to /opt/top-mem.txt (the name only). This step needs metrics-server; skip it if metrics-server isn't installed.

All checks passed

errors file has ERROR lines
errors file has no INFO lines
events file holds the events of all namespaces
top memory pod

FlagNext

5 / 195% · Troubleshooting

Use context kubectl config use-context k8s-t3

kubectl commands on controlplane fail: the cluster's API server is not working.

Find the cause and fix it, so that the API server is running and healthy again. A copy of the API server's manifest from before the problem is in /root/; use it only if you're stuck.

All checks passed

API server answers
kube-apiserver.yaml no longer has --etcd-servers=https://127.0.0.1:2380

FlagNext

6 / 197% · Cluster architecture

Use context kubectl config use-context k8s-c1

The cluster's etcd runs as a static pod on controlplane and serves clients at https://127.0.0.1:2379. It only accepts TLS clients; the CA certificate, a client certificate and its key are in /etc/kubernetes/pki/etcd (ca.crt, server.crt, server.key).

On controlplane, create a snapshot of the running etcd and save it to /opt/etcd-backup.db.

Don't stop etcd and don't change its static pod manifest.

All checks passed

snapshot file /opt/etcd-backup.db exists
snapshot is a valid etcd snapshot

FlagNext

7 / 196% · Cluster architecture

Use context kubectl config use-context k8s-c6

A new administrator, jane, will authenticate to the API server with an X.509 client certificate signed by the cluster's CA. Work on controlplane:

1. Generate a private key /opt/jane.key and, from it, a certificate signing request /opt/jane.csr with the subject /CN=jane. 2. Submit it to Kubernetes as the CertificateSigningRequest jane for client authentication against the API server (signer kubernetes.io/kube-apiserver-client), approve it, and save the issued certificate, PEM-encoded, to /opt/jane.crt. 3. Create the ClusterRole node-reader that allows get, list, watch on nodes, and bind it cluster-wide with the ClusterRoleBinding jane-node-reader to the user jane.

All checks passed

csr jane is Approved
/opt/jane.crt is a cert for /CN=jane
/opt/jane.crt is signed by the cluster CA
/opt/jane.crt matches the key /opt/jane.key
csr jane uses the kube-apiserver-client signer
clusterrole node-reader exists
jane-node-reader binds a User
jane can list nodes
jane cannot delete nodes

FlagNext

8 / 195% · Cluster architecture

Use context kubectl config use-context k8s-c5

An automation tool in namespace ops needs its own identity with narrowly scoped permissions.

1. Create the ServiceAccount deploy-bot in namespace ops. 2. Create the Role deploy-role in ops that allows only the verbs get, list, create, update on Deployments. 3. Bind the Role to the ServiceAccount with the RoleBinding deploy-role-binding in ops.

deploy-bot must not get any other permission, and none outside ops.

All checks passed

serviceaccount ops/deploy-bot exists
role ops/deploy-role exists
rolebinding deploy-role-binding refers to Role deploy-role
rolebinding deploy-role-binding binds ServiceAccount deploy-bot
can get deployments in ops
can update deployments in ops
cannot delete deployments in ops
cannot update deployments in default
cannot list pods in ops

FlagNext

9 / 194% · Cluster architecture

Use context kubectl config use-context k8s-c7

A Helm chart is available in the local directory /opt/webapp.

1. Install it as the release web in the namespace web, which doesn't exist yet, with the value replicaCount=3. 2. Upgrade the release so the image tag is set with image.tag=1.27, keeping replicaCount=3. 3. The new tag turned out to be wrong: roll the release back to revision 1. 4. Save the release history, as helm history prints it after the rollback, to /opt/helm-history.txt.

All checks passed

release web is deployed in ns web
release has at least 3 revisions
revision 2 set image.tag=1.27 and kept replicaCount=3
latest revision is a rollback to 1
deployment runs 3 replicas
image tag 1.27 is not active
/opt/helm-history.txt saved

FlagNext

10 / 193% · Cluster architecture

Use context kubectl config use-context k8s-c8

/opt/kz/base is a Kustomize base with the Deployment api. Deploy it to the environment prod through an overlay, without changing the base.

1. Write /opt/kz/overlays/prod/kustomization.yaml. Applied, it must create the api Deployment from the base in namespace prod, with 3 replicas and the label env=prod on the Deployment. 2. Apply the overlay with kubectl.

Don't edit any file in /opt/kz/base.

All checks passed

overlay kustomization.yaml exists
overlay builds
base is unchanged
prod/api has 3 replicas
prod/api has label env=prod

FlagNext

11 / 197% · Services & networking

Use context kubectl config use-context k8s-n2

Namespace secure runs pod db (label app=db, behind Service db on port 80), pod api (label app=api) and pod other (label app=other).

Create NetworkPolicy db-allow in secure so that the db pods accept incoming traffic only from pods labelled app=api in the same namespace, on TCP port 80. Any other ingress to db, for example from other, must be denied. Don't change the pods.

The CNI must enforce NetworkPolicy (Calico, Canal and Cilium do; plain Flannel doesn't).

All checks passed

policy db-allow exists
api can reach db
other is blocked from db

FlagNext

12 / 195% · Services & networking

Use context kubectl config use-context k8s-n1

Deployment shop runs in namespace default. Expose it with Service shop-svc:

- type NodePort; - Service port 80, forwarding to the containers' port 80; - node port 30080.

The application must answer on http://node01:30080 when you curl it from controlplane.

All checks passed

type NodePort
port 80
targetPort 80
nodePort 30080
selects app=shop
curl node01:30080 returns nginx

FlagNext

13 / 194% · Services & networking

Use context kubectl config use-context k8s-n4

In namespace default, Services cart and pay listen on port 80.

Create Ingress shop in default with ingressClassName: nginx and one rule for host shop.local:

- path /cart goes to Service cart on port 80; - path /pay goes to Service pay on port 80.

Both paths use pathType Prefix.

No Ingress controller runs in this cluster, so nothing serves traffic. You're practising the API object.

All checks passed

ingressClassName nginx
host shop.local
/cart -> cart:80
/pay -> pay:80
both paths Prefix

FlagNext

14 / 194% · Services & networking

Use context kubectl config use-context k8s-n5

In namespace default, create Gateway main-gw (gatewayClassName: nginx, one HTTP listener on port 80).

Create HTTPRoute shop-route in default, attached to it, for hostname shop.local:

- /api (match type PathPrefix) goes to Service gw-api:80 - everything else goes to Service gw-web:80

Without a Gateway controller the Gateway won't become Programmed. You're practising the API objects.

All checks passed

gateway class nginx
listener HTTP:80
route attached to main-gw
hostname shop.local
PathPrefix /api goes to gw-api
a rule sends traffic to gw-web

FlagNext

15 / 195% · Workloads & scheduling

Use context kubectl config use-context k8s-w1

Work in namespace default.

1. Create Deployment web with 3 replicas of image nginx:1.27. 2. Update the Deployment to image nginx:1.28 and let the rollout finish. 3. Update it again, to image nginx:9.99. That tag does not exist, so this rollout never finishes. 4. Roll the Deployment back to the revision that runs nginx:1.28, with all 3 replicas ready. 5. After the rollback, save the Deployment's rollout history, as kubectl lists it, to /opt/web-history.txt.

All checks passed

web runs nginx:1.28
3 replicas ready
nginx:1.27 was the first revision
nginx:9.99 was rolled out
rolled back (revision 4 or later)
history saved to /opt/web-history.txt after the rollback

FlagNext

16 / 195% · Workloads & scheduling

Use context kubectl config use-context k8s-w3

In namespace default, create pod logger. Every container uses image busybox:1.36.

- The main container app appends the output of date to /var/log/app.log every 5 seconds. - Container log-tail runs tail -f /var/log/app.log. Implement it as a Kubernetes native sidecar container: it starts before app and keeps running for the life of the pod. - Both containers mount the same emptyDir volume logs at /var/log.

All checks passed

logger is Ready
log-tail is a native sidecar (init container, restartPolicy Always)
app is the only regular container
every container uses busybox:1.36
logs is an emptyDir
both containers mount logs at /var/log
log-tail is streaming the app's log

FlagNext

17 / 195% · Workloads & scheduling

Use context kubectl config use-context k8s-w6

Work in namespace limited.

1. Create ResourceQuota team-quota that allows at most 3 pods and at most 1 CPU of requests in total (requests.cpu). 2. Create LimitRange defaults so that every container that doesn't set its own values gets a CPU request of 100m, a memory request of 64Mi, a CPU limit of 200m and a memory limit of 128Mi. 3. Create Deployment q with image nginx and 5 replicas. Don't change the quota: only 3 of its pods can be created. Find the reason in the events.

All checks passed

quota allows 3 pods
quota requests.cpu=1
LimitRange defaults: default requests cpu 100m, memory 64Mi
LimitRange defaults: default limits cpu 200m, memory 128Mi
deployment q wants 5 replicas
exactly 3 pods exist (the quota stops the rest)

FlagNext

18 / 196% · Storage

Use context kubectl config use-context k8s-s1

Work in namespace default.

1. Create PersistentVolume pv-log: capacity 1Gi, access mode ReadWriteOnce, hostPath /pv/log, storageClassName: manual, reclaim policy Retain. 2. Create PersistentVolumeClaim pvc-log: request 500Mi, access mode ReadWriteOnce, storageClassName: manual. It must bind to pv-log. 3. Create pod log-pod (image nginx) that mounts the claim at /usr/share/nginx/html.

All checks passed

pv-log capacity 1Gi
pv-log reclaim Retain
pv-log class manual
pv-log access mode ReadWriteOnce
pv-log hostPath /pv/log
log-pod Ready
pvc-log requests 500Mi ReadWriteOnce in class manual
pvc-log Bound to pv-log
log-pod uses claim pvc-log
log-pod mounts a volume at /usr/share/nginx/html

FlagNext

19 / 194% · Storage

Use context kubectl config use-context k8s-s3

PVC pvc-data in namespace default is stuck in Pending. Find out why and make it bind to PV pv-data without changing the PV. Keep the claim's name.

All checks passed

pvc-data is Bound
bound to pv-data
pv-data unchanged (1Gi ReadWriteOnce manual)

FlagNext

19 / 19Complete

Every question is done. Each one stayed in the task pane, and its fix was in the terminal before the next question opened.

Terminal 1+End exam

kubectl config use-context k8s-t7Switched to context "k8s-t7".kubectl get pod -l app=frontend --show-labelskubectl patch svc frontend-svc --type=json -p '[  {"op":"replace","path":"/spec/selector","value":{"app":"frontend"}},  {"op":"replace","path":"/spec/ports/0/targetPort","value":80}]'

kubectl config use-context k8s-t8Switched to context "k8s-t8".kubectl describe pod crashy | tail -5kubectl logs crashy --tail=5 || truekubectl delete pod crashy probey --nowcat <<'YAML' | kubectl apply -f -apiVersion: v1kind: Podmetadata: {name: crashy}spec:  containers:  - name: app    image: nginx---apiVersion: v1kind: Podmetadata: {name: probey}spec:  containers:  - name: app    image: nginx    livenessProbe:      httpGet: {path: /, port: 80}      initialDelaySeconds: 3      periodSeconds: 3YAML

kubectl config use-context k8s-t9Switched to context "k8s-t9".kubectl describe pod hungry | tail -3kubectl get pod hungry -o yaml | sed -E 's/^( +cpu: )"?50"?$/\1100m/' > /tmp/hungry.yamlkubectl replace --force -f /tmp/hungry.yamlkubectl label node node01 gpu=true --overwrite

kubectl config use-context k8s-t11Switched to context "k8s-t11".kubectl logs noisy | grep ERROR > /opt/noisy-errors.txtkubectl get events -A --sort-by=.metadata.creationTimestamp > /opt/events.txtif kubectl top pod -n kube-system >/dev/null 2>&1; then  kubectl top pod -n kube-system --sort-by=memory --no-headers | head -1 | cut -d' ' -f1 > /opt/top-mem.txtfi

kubectl config use-context k8s-t3Switched to context "k8s-t3".crictl ps -a --name kube-apiserver || truesed -i 's#--etcd-servers=https://127.0.0.1:2380#--etcd-servers=https://127.0.0.1:2379#' /etc/kubernetes/manifests/kube-apiserver.yamlsystemctl restart kubelet

kubectl config use-context k8s-c1Switched to context "k8s-c1".grep -E -- '--(listen-client-urls|trusted-ca-file|cert-file|key-file)=' /etc/kubernetes/manifests/etcd.yamlETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \  --cacert=/etc/kubernetes/pki/etcd/ca.crt \  --cert=/etc/kubernetes/pki/etcd/server.crt \  --key=/etc/kubernetes/pki/etcd/server.key \  snapshot save /opt/etcd-backup.dbif command -v etcdutl >/dev/null; then  etcdutl snapshot status /opt/etcd-backup.db -w tableelse  ETCDCTL_API=3 etcdctl snapshot status /opt/etcd-backup.db -w tablefi

kubectl config use-context k8s-c6Switched to context "k8s-c6".openssl genrsa -out /opt/jane.key 2048openssl req -new -key /opt/jane.key -subj "/CN=jane" -out /opt/jane.csrcat <<EOF | kubectl apply -f -apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata:  name: janespec:  request: $(base64 -w0 < /opt/jane.csr)  signerName: kubernetes.io/kube-apiserver-client  usages: ["client auth"]EOFkubectl certificate approve janekubectl get csr jane -o jsonpath='{.status.certificate}' | base64 -d > /opt/jane.crtkubectl create clusterrole node-reader --verb=get,list,watch --resource=nodeskubectl create clusterrolebinding jane-node-reader --clusterrole=node-reader --user=jane

kubectl config use-context k8s-c5Switched to context "k8s-c5".kubectl -n ops create sa deploy-botkubectl -n ops create role deploy-role --verb=get,list,create,update --resource=deploymentskubectl -n ops create rolebinding deploy-role-binding --role=deploy-role --serviceaccount=ops:deploy-botkubectl auth can-i update deployments -n ops --as=system:serviceaccount:ops:deploy-bot || truekubectl auth can-i delete deployments -n ops --as=system:serviceaccount:ops:deploy-bot || true

kubectl config use-context k8s-c7Switched to context "k8s-c7".helm install web /opt/webapp -n web --create-namespace --set replicaCount=3helm upgrade web /opt/webapp -n web --reuse-values --set image.tag=1.27helm rollback web 1 -n webhelm history web -n web > /opt/helm-history.txtcat /opt/helm-history.txt

kubectl config use-context k8s-c8Switched to context "k8s-c8".cat > /opt/kz/overlays/prod/kustomization.yaml <<'YAML'resources:- ../../basenamespace: prodreplicas:- name: api  count: 3labels:- pairs:    env: prodYAMLkubectl kustomize /opt/kz/overlays/prodkubectl apply -k /opt/kz/overlays/prod

kubectl config use-context k8s-n2Switched to context "k8s-n2".cat <<'EOF' | kubectl apply -f -apiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: db-allow  namespace: securespec:  podSelector:    matchLabels: {app: db}  policyTypes: [Ingress]  ingress:  - from:    - podSelector:        matchLabels: {app: api}    ports:    - {protocol: TCP, port: 80}EOF

kubectl config use-context k8s-n1Switched to context "k8s-n1".kubectl expose deploy shop --name=shop-svc --port=80 --target-port=80 --type=NodePortkubectl patch svc shop-svc --type=json -p '[{"op":"replace","path":"/spec/ports/0/nodePort","value":30080}]'

kubectl config use-context k8s-n4Switched to context "k8s-n4".cat <<'YAML' | kubectl apply -f -apiVersion: networking.k8s.io/v1kind: Ingressmetadata: {name: shop, namespace: default}spec:  ingressClassName: nginx  rules:  - host: shop.local    http:      paths:      - path: /cart        pathType: Prefix        backend: {service: {name: cart, port: {number: 80}}}      - path: /pay        pathType: Prefix        backend: {service: {name: pay, port: {number: 80}}}YAML

kubectl config use-context k8s-n5Switched to context "k8s-n5".cat <<'YAML' | kubectl apply -f -apiVersion: gateway.networking.k8s.io/v1kind: Gatewaymetadata: {name: main-gw, namespace: default}spec:  gatewayClassName: nginx  listeners:  - {name: http, protocol: HTTP, port: 80}---apiVersion: gateway.networking.k8s.io/v1kind: HTTPRoutemetadata: {name: shop-route, namespace: default}spec:  parentRefs:  - name: main-gw  hostnames: ["shop.local"]  rules:  - matches:    - path: {type: PathPrefix, value: /api}    backendRefs:    - {name: gw-api, port: 80}  - backendRefs:    - {name: gw-web, port: 80}YAML

kubectl config use-context k8s-w1Switched to context "k8s-w1".kubectl create deployment web --image=nginx:1.27 --replicas=3kubectl rollout status deployment/web --timeout=120skubectl set image deployment/web nginx=nginx:1.28kubectl rollout status deployment/web --timeout=120skubectl set image deployment/web nginx=nginx:9.99kubectl rollout history deployment/webkubectl rollout undo deployment/web --to-revision=2kubectl rollout status deployment/web --timeout=120skubectl rollout history deployment/web > /opt/web-history.txt

kubectl config use-context k8s-w3Switched to context "k8s-w3".cat <<'YAML' | kubectl apply -f -apiVersion: v1kind: Podmetadata:  name: logger  namespace: defaultspec:  volumes:  - name: logs    emptyDir: {}  initContainers:  - name: log-tail    image: busybox:1.36    restartPolicy: Always    command: ["sh", "-c", "touch /var/log/app.log; tail -f /var/log/app.log"]    volumeMounts:    - {name: logs, mountPath: /var/log}  containers:  - name: app    image: busybox:1.36    command: ["sh", "-c", "while true; do date >> /var/log/app.log; sleep 5; done"]    volumeMounts:    - {name: logs, mountPath: /var/log}YAMLkubectl -n default wait --for=condition=Ready pod/logger --timeout=90s

kubectl config use-context k8s-w6Switched to context "k8s-w6".kubectl -n limited create quota team-quota --hard=pods=3,requests.cpu=1cat <<'YAML' | kubectl apply -n limited -f -apiVersion: v1kind: LimitRangemetadata:  name: defaultsspec:  limits:  - type: Container    defaultRequest: {cpu: 100m, memory: 64Mi}    default: {cpu: 200m, memory: 128Mi}YAMLkubectl -n limited create deployment q --image=nginx --replicas=5sleep 5kubectl -n limited get events --field-selector reason=FailedCreatekubectl -n limited describe quota team-quota

kubectl config use-context k8s-s1Switched to context "k8s-s1".cat <<'EOF' | kubectl apply -f -apiVersion: v1kind: PersistentVolumemetadata: {name: pv-log}spec:  capacity: {storage: 1Gi}  accessModes: [ReadWriteOnce]  persistentVolumeReclaimPolicy: Retain  storageClassName: manual  hostPath: {path: /pv/log}---apiVersion: v1kind: PersistentVolumeClaimmetadata: {name: pvc-log}spec:  accessModes: [ReadWriteOnce]  storageClassName: manual  resources: {requests: {storage: 500Mi}}---apiVersion: v1kind: Podmetadata: {name: log-pod}spec:  containers:  - name: web    image: nginx    volumeMounts:    - {name: data, mountPath: /usr/share/nginx/html}  volumes:  - name: data    persistentVolumeClaim: {claimName: pvc-log}EOF

kubectl config use-context k8s-s3Switched to context "k8s-s3".kubectl -n default delete pvc pvc-datacat <<'YAML' | kubectl apply -f -apiVersion: v1kind: PersistentVolumeClaimmetadata: {name: pvc-data, namespace: default}spec:  accessModes: [ReadWriteOnce]  storageClassName: manual  volumeName: pv-data  resources: {requests: {storage: 1Gi}}YAML

Exam complete.19 questions checked, in order.

Hands-on labs: 177
Graded tasks: 391
Mock exams: 15
Course modules: 17
Lessons and demos: 116
Hours of course: 38.5

The CKA is the first full track: 391 CKA tasks across all 5 exam domains. The other Kubernetes courses and the AWS courses sit in their own groups below.

How it works

From first lesson to exam-ready

The same loop as a hands-on exam: a task, a live environment and a terminal. You learn by fixing real things, not by recognising answers.

Learn the concept
Short lessons and step-by-step demos for every competency, with links to the official docs.
Fix a live cluster
A lab puts a real environment into a broken state. You get a task and a terminal.
Get graded
Checks read the live state and show what passed, so you know exactly what is left.
Prove it, timed
Mock exams weighted like the real one, with a score per domain to show where to focus.

See a lab in 30 seconds

From a broken node to a passed check

Still from the video: the automatic checks show node01 is Ready, the kubelet uses the real CA, 2 of 2 checks passed. — What the 29-second video shows, without sound: a cluster node, node01, turns NotReady. In a terminal, the learner reads the kubelet log, finds a missing CA file, fixes the kubelet config and restarts it, and the node is Ready again. The automatic checks then pass, 2 of 2. A timed mock exam counts down and an example score lands above the 66% pass mark. The certification families follow (Kubernetes, AWS, Azure, Google Cloud, HashiCorp and Linux), with the CKA course: 391 tasks, 177 labs and 15 mock exams. It ends on The Cloud Panda: break real infrastructure, fix it, get certified. Play the video (MP4, no sound)

Courses

A course page for every track in the catalog

Each card uses the real module, lesson, quiz and lab counts from that track. The CKA is the one with free starter labs. AWS courses are lessons and practice questions.

Kubernetes 16

Course and labs · Free starter labs
Certified Kubernetes Administrator
Install, run, secure and troubleshoot kubeadm clusters: lessons, demos, hands-on labs and timed mock exams.
- Intermediate
- 38.5 hours
Modules
17
Lessons
90
Demos
26
Labs
177
Mock exams
15
- 90 lessons with commands to copy
- 26 step-by-step demos
- 391 graded tasks on real clusters
- A quiz for each of the 17 modules
- 15 timed mock exams
- Certificate of completion
Details
CKAD course
Certified Kubernetes Application Developer
Design, build and deploy applications on Kubernetes, with kubeadm labs and timed mock exams.
- Intermediate
- 28.5 hours
Modules
16
Lessons
79
Demos
18
Labs
132
Mock exams
15
Details
CKS course
Certified Kubernetes Security Specialist
Cluster hardening, supply chain and runtime security, with kubeadm labs and timed mock exams. The exam requires a passed CKA.
- Advanced
- 6.5 hours
Modules
6
Lessons
18
Labs
80
Mock exams
14
Details
CKNE course
Certified Kubernetes Network Engineer
Cluster networking: CNI, services, traffic, policy and observability, with kubeadm labs and timed mock exams.
- Intermediate
- 16 hours
Modules
5
Lessons
15
Demos
5
Labs
80
Mock exams
13
Details
CNPE course
Certified Cloud Native Platform Engineer
Platform engineering: infrastructure, GitOps, self-service APIs, operations and policy, with kubeadm labs and timed mock exams.
- Intermediate
- 6 hours
Modules
5
Lessons
15
Demos
5
Labs
36
Mock exams
9
Details
ICA course
Istio Certified Associate
Istio traffic, security and troubleshooting, with kubectl labs that store Istio objects. The labs do not install Istio.
- Intermediate
- 5.5 hours
Modules
4
Lessons
12
Demos
4
Labs
34
Mock exams
8
Details
KCNA course
Kubernetes and Cloud Native Associate
Cloud-native fundamentals: a course, original practice questions, one kubeadm lab per competency and a full mock.
- Beginner
- 4 hours
Modules
4
Lessons
15
Labs
13
Mock exams
1
Details
KCSA course
Kubernetes and Cloud Native Security Associate
Cloud-native security: a course, original practice questions, kubeadm labs and a full mock. The published exam is multiple choice.
- Beginner
- 8.5 hours
Modules
6
Lessons
18
Labs
42
Mock exams
1
Details
CNPA course
Certified Cloud Native Platform Engineering Associate
Platform engineering for the multiple-choice exam: a course, practice questions, kubeadm labs and one full mock.
- Intermediate
- 6 hours
Modules
6
Lessons
27
Labs
18
Mock exams
1
Details
PCA course
Prometheus Certified Associate
Prometheus concepts, PromQL and alerting, as a course and original practice questions.
- Intermediate
- 3.5 hours
Modules
5
Lessons
26
Quizzes
5
Questions
34
Details
OTCA course
OpenTelemetry Certified Associate
OpenTelemetry signals, the API and the Collector, as a course and original practice questions.
- Intermediate
- 3 hours
Modules
4
Lessons
20
Quizzes
4
Questions
27
Details
CGOA course
Certified GitOps Associate
GitOps terminology, principles and patterns, as a course and original practice questions.
- Intermediate
- 1.5 hours
Modules
5
Lessons
12
Quizzes
5
Questions
30
Details
CAPA course
Certified Argo Project Associate
Argo Workflows, CD, Rollouts and Events, as a course and original practice questions.
- Intermediate
- 2 hours
Modules
4
Lessons
12
Quizzes
4
Questions
26
Details
CCA course
Cilium Certified Associate
Cilium networking as a course, practice questions, and kubectl labs that store policy objects. The labs do not install Cilium.
- Intermediate
- 3 hours
Modules
8
Lessons
16
Labs
5
Mock exams
1
Details
CBA course
Certified Backstage Associate
Backstage catalogs, templates and plugins, as a course and original practice questions.
- Intermediate
- 1.5 hours
Modules
4
Lessons
11
Quizzes
4
Questions
24
Details
KCA course
Kyverno Certified Associate
Kyverno policies as a course, practice questions, and kubectl labs that store policy objects. The labs do not install Kyverno.
- Intermediate
- 3.5 hours
Modules
6
Lessons
14
Labs
8
Mock exams
1
Details

AWS 12

Cloud Practitioner course
AWS Certified Cloud Practitioner
Cloud concepts, security, technology and billing, as a course and original practice questions.
- Beginner
- 2.5 hours
Modules
4
Lessons
18
Quizzes
4
Questions
26
Details
Solutions Architect course
AWS Certified Solutions Architect – Associate
Resilient, secure and cost-aware architectures, as a course and original practice questions.
- Intermediate
- 2.5 hours
Modules
4
Lessons
12
Quizzes
4
Questions
24
Details
AI Practitioner course
AWS Certified AI Practitioner
AI and generative AI concepts, applications and responsible use, as a course and original practice questions.
- Beginner
- 2 hours
Modules
5
Lessons
15
Quizzes
5
Questions
40
Details
Developer course
AWS Certified Developer – Associate
Developing, securing, deploying and troubleshooting applications on AWS, as a course and original practice questions.
- Intermediate
- 2 hours
Modules
4
Lessons
12
Quizzes
4
Questions
32
Details
CloudOps Engineer course
AWS Certified CloudOps Engineer – Associate
Monitoring, reliability, automation, security and networking, as a course and original practice questions.
- Intermediate
- 2 hours
Modules
5
Lessons
15
Quizzes
5
Questions
40
Details
Data Engineer course
AWS Certified Data Engineer – Associate
Ingestion, storage, pipeline operations and data governance, as a course and original practice questions.
- Intermediate
- 1.5 hours
Modules
4
Lessons
12
Quizzes
4
Questions
32
Details
Machine Learning Engineer course
AWS Certified Machine Learning Engineer – Associate
Data preparation, model development, deployment and operations, as a course and original practice questions.
- Intermediate
- 2.5 hours
Modules
4
Lessons
12
Quizzes
4
Questions
32
Details
Security course
AWS Certified Security – Specialty
Detection, incident response, infrastructure security and governance, as a course and original practice questions.
- Advanced
- 3 hours
Modules
6
Lessons
16
Quizzes
6
Questions
48
Details
DevOps Engineer course
AWS Certified DevOps Engineer – Professional
Pipelines, infrastructure as code, resilience and incident response, as a course and original practice questions.
- Advanced
- 3 hours
Modules
6
Lessons
18
Quizzes
6
Questions
48
Details
Solutions Architect Pro course
AWS Certified Solutions Architect – Professional
Follows the SAP-C03 guide, which starts 17 November 2026. A course and original practice questions.
- Advanced
- 3 hours
Modules
5
Lessons
15
Quizzes
5
Questions
40
Details
Generative AI Developer course
AWS Certified Generative AI Developer – Professional
Foundation models, implementation, safety and operations, as a course and original practice questions.
- Advanced
- 2.5 hours
Modules
5
Lessons
15
Quizzes
5
Questions
40
Details
AI Business Strategist course
AWS Certified AI Business Strategist
AI strategy, governance and readiness for a business exam, as a course and original practice questions.
- Beginner
- 2 hours
Modules
4
Lessons
12
Quizzes
4
Questions
32
Details

Learning paths

Pick a role, follow the path

Each path lines up the certifications for one job, in the order to take them. New to all this? Start here.

Path
Kubernetes Administrator
Run production clusters: install and upgrade with kubeadm, manage access, storage and networking, and fix what breaks.
1. CKA
1 course · 38.5 h · 177 labs
Path
Kubernetes Developer
Ship applications to Kubernetes with the CKAD course, kubeadm labs and timed mock exams.
1. CKAD
1 course · 28.5 h · 132 labs
Path
Kubernetes Security Specialist
The CKA course, then the CKS course. The CKS exam requires a passed CKA.
1. CKA
2. CKS
2 courses · 45 h · 257 labs
Path
Cloud Engineer
Cloud Practitioner and Solutions Architect – Associate courses are in the catalog. Terraform is a separate track.
1. Cloud Practitioner
2. Solutions Architect
2 courses · 5 h · 0 labs

All learning paths

63 certifications, one place

Every certification family

A track that exists has a course page with its real counts. Pick a family to open one.

Available
Kubernetes
16 certifications
All 16 certifications are in the catalog
- CKA
- CKAD
- CKS
- CKNE
- CNPE
- +11 more
Available
AWS
12 certifications
All 12 certifications are in the catalog
- Cloud Practitioner
- AI Practitioner
- Solutions Architect
- Developer
- CloudOps Engineer
- +7 more
Planned
Azure
10 certifications
- AZ-900
- AI-900
- DP-900
- SC-900
- AZ-104
- +5 more
Planned
Google Cloud
12 certifications
- Cloud Digital Leader
- Generative AI Leader
- Associate Cloud Engineer
- Workspace Administrator
- Cloud Architect
- +7 more
Planned
HashiCorp
5 certifications
- Terraform Associate
- Terraform Professional
- Terraform Advanced
- Vault Associate
- Vault Advanced
Planned
Linux
8 certifications
- LFCS
- LFCA
- RHCSA
- RHCE
- Linux Essentials
- +3 more
More coming
Open a family to see each certification and the counts from its track.

Browse all certifications

In every track

Practice that works like the real thing

Live environments
Real machines and clusters with root access, so you can stop a service, edit a manifest or restore a backup.
Graded, not guessed
Checks read the live state. You see every check as passed or failed, so you know what is left to fix.
Retries are new problems
Many labs come in variants, so a second attempt tests your skill, not your memory of the first one.
Timed mock exams
Weighted by domain like the real exam, with one score at the end and a breakdown per domain.
Isolated per student
Every lab runs in its own microVMs with its own kernel and network, so nobody else's mistakes reach yours. How labs are isolated.
Original tasks only
Written from the public curricula and official docs. We never use or reconstruct real exam questions.

Mock exams

Know you are ready before exam day

10 full mock exams of 17 to 19 tasks each, and 5 domain mocks of 16 tasks that drill one domain at a time. Every mock is timed at 120 minutes and scored per domain. Pass mark: 66%.

Timed like the examSeveral clusters, each task naming the context to use.
A score per domainSee which domain costs you points and drill it.
No repeatsEach mock uses tasks that appear in no other mock.

See every CKA mock

An example of the report every mock ends with. Your scores are your own.

Free, no account needed

Free study resources

Written by us from the public curriculum and the official documentation. Use them with any study material.

CKA exam environment tips
How to work fast and safely in the remote exam desktop.
kubectl cheat sheet
The commands you'll type most, grouped by task.
Six-week CKA study plan
Weighted by the exam domains, with a lab for every week.
Troubleshooting checklist
What to check first when a node, Pod or Service misbehaves.

Training a team?

We are planning a Teams plan: seats managed by one admin, progress reports per engineer, and one invoice for your company.

Labs for teams

FAQ

Common questions

What is The Cloud Panda?

Hands-on practice for cloud and DevOps certifications, starting with the CKA. Each lab gives you a live environment (for the CKA, a real kubeadm cluster with a control plane and a worker node), puts it into a specific state, often a broken one, and gives you a task. You solve it in a terminal, and an automatic check grades the live environment and shows which parts passed.

Which certifications do you cover?

CKA, CKAD, CKS, KCNA, KCSA, CKNE, CNPE, ICA, CNPA, CCA and KCA have courses and hands-on labs on real kubeadm clusters, with timed mock exams. CCA and KCA labs store policy objects and read them with kubectl. They do not install Cilium or Kyverno. CBA, PCA, OTCA, CGOA, CAPA and the AWS courses have lessons and original practice questions. Azure and Google Cloud are listed from the public exam catalogs. The lab runtime is kubeadm clusters only, so those pages do not include a cloud account.

Are these real exam questions?

No. Every task is original and written from the public curriculum and the official Kubernetes documentation. Candidates agree not to share exam content, and we never use or reconstruct it.

How are labs graded?

Each lab has a set of checks that read the state of the live cluster: is the node Ready, does the Service have endpoints, does the Role allow exactly what was asked. You see every check as passed or failed, so you know what is left to fix. There is no answer text to match.

How much do the labs cost?

The starter CKA labs are free, with no card needed. We plan paid plans too: a monthly or yearly subscription, a one-time pass for a single certification, and a Teams plan. They are not on sale yet; their prices go on our pricing page before they are, and we take no payments or pre-orders until then.

All questions

Start today

Start with the free CKA labs

A free account includes 5 starter CKA labs, one in each exam domain, on real kubeadm clusters with the same automatic grading as every other lab. No card needed.

Break real infrastructure. Fix it. Get certified.

The CKA track in numbers

From first lesson to exam-ready

Learn the concept

Fix a live cluster

Get graded

Prove it, timed

From a broken node to a passed check

A course page for every track in the catalog

Kubernetes 16

AWS 12

Pick a role, follow the path

Every certification family

Practice that works like the real thing

Live environments

Graded, not guessed

Retries are new problems

Timed mock exams

Isolated per student

Original tasks only

Know you are ready before exam day

Free study resources

Training a team?

Common questions

Start with the free CKA labs