The Cloud Panda

Kubernetes · course, labs and mock exams

CKNE course and practice labs

Certified Kubernetes Network Engineer: 5 modules of lessons and demos, 80 tasks from 80 lab templates on real kubeadm clusters, and 13 timed mock exams.

  • Intermediate
  • 16 hours
  • Certificate of completion
  • Pass mark 66%
Sign up freeSee the curriculum
Modules
5
Lessons
15
Demos
5
Labs
80
Tasks
80
Mock exams
13

The Linux Foundation · 120 minute exam

What you'll learn

Every domain of the exam, weighted like the exam

All 5 domains in the public curriculum. 5 of them already have labs.

What's included

A full course, not just a question bank

  • 15 lessons

    Short lessons for the exam competencies, with commands to copy and links to the official docs.

  • 5 demos

    Walk through a task step by step before you try it yourself.

  • 80 hands-on labs

    80 tasks with their variants, on a kubeadm cluster, graded check by check.

  • 5 module quizzes

    30 original questions, with an explanation for every answer.

  • 13 mock exams

    8 full mocks and 5 domain mocks. Pass mark 66%.

  • Certificate of completion

    From The Cloud Panda when you finish the course. It is a course certificate, not one from The Linux Foundation.

Curriculum

5 modules

15 lessons and 5 demos: 4 h 5 min of reading and demos, about 16 hours with the practice. The lessons open with a free account.

01Core infrastructure and CNI3 lessons · 1 demo · 49 min · 16 labs · quiz

How the CNI attaches pods, where pod and Service CIDRs come from, and how to tell a selector bug from a broken dataplane. Domain: Core Infrastructure and CNI.

  1. lessonCNI plugins and the two address pools12 min
  2. lessonRoutes, service chains and pod connectivity12 min
  3. lessonA second interface for a pod11 min
  4. demoDemo: a conflist, a route, and a selector14 min
02Service networking and DNS3 lessons · 1 demo · 50 min · 19 labs · quiz

ClusterIP and NodePort, what kube-proxy programs, CoreDNS zones, ready endpoints, and a Gateway plus HTTPRoute. Domain: Service Networking and DNS.

  1. lessonL4 Services and what kube-proxy programs12 min
  2. lessonCoreDNS zones and a broken Service port12 min
  3. lessonReady addresses and the Gateway API12 min
  4. demoDemo: NodePort, a bad targetPort, and a Gateway14 min
03Advanced traffic management3 lessons · 1 demo · 49 min · 16 labs · quiz

Path and timeout splits for model traffic, Ingress to expose a network, an egress gateway policy, and a Service that imports remote addresses. Domain: Advanced Traffic Management.

  1. lessonTimeouts and paths for model traffic12 min
  2. lessonExpose a network, and pin egress to a gateway12 min
  3. lessonA Service that points at another cluster11 min
  4. demoDemo: a model route, an egress policy, a remote Service14 min
04Network security and policy3 lessons · 1 demo · 49 min · 16 labs · quiz

Default-deny NetworkPolicy, node and pod encryption as two layers, Gateway TLS, and a pod identity that can list endpoints and nothing else. Domain: Network Security and Policy.

  1. lessonDefault-deny, then one flow12 min
  2. lessonNode encryption, pod certificates and Gateway TLS12 min
  3. lessonA pod identity that can see endpoints only11 min
  4. demoDemo: deny the namespace, then terminate TLS14 min
05Observability3 lessons · 1 demo · 48 min · 13 labs · quiz

Dataplane health counts, a three-hop trace of a Service path, and an audit policy that records network objects without their bodies. Domain: Observability.

  1. lessonIs the dataplane up11 min
  2. lessonTrace client, Service, pod11 min
  3. lessonAudit who changed a Service12 min
  4. demoDemo: counts, a trace file, an audit policy14 min

How a lab works

The same loop as a hands-on exam

A task, a live cluster, and checks that read the cluster.

  1. We set the scene

    A setup script puts a live environment into a real state, often a broken one: a broken workload, a missing permission, a Service with no endpoints. You get the task and a terminal.

  2. You fix it

    With the real tools and the official documentation, exactly as you will in the exam. Nothing is simulated and there are no multiple-choice shortcuts.

  3. Checks grade it

    Each lab runs checks against the live environment and shows which passed. There is no answer text to match: if a check fails, you know exactly what is left.

Lab library

Every lab, by exam domain

80 hands-on tasks across 5 domains, about 12 hours of practice.

Service Networking and DNS 25% of the exam · 19 labs

Configuring L4 Services

  • SD1Publish a deployment as a NodePort8 min
  • SD7Publish http and stats on one ClusterIP8 min
  • SD8Publish pod IPs with a headless Service10 min
  • SD9Alias a cluster name with ExternalName8 min

Understanding kube-proxy and CNI Alternatives

  • SD2Record kube-proxy mode and the pod dataplane8 min
  • SD10Record kube-proxy mode, metrics bind and cluster CIDR8 min
  • SD11Record the kube-proxy DaemonSet8 min

Customizing coreDNS for Services

  • SD3Add a CoreDNS hosts name10 min
  • SD12Add a CoreDNS hosts alias10 min
  • SD13Publish a short DNS name for a Service10 min

Troubleshooting Service Network Traffic

  • SD4Point a Service at the container port8 min
  • SD14Point the Service at the payments pods8 min
  • SD15Keep a client on one backend for three hours8 min

Configuring Pod Endpoint Availability

  • SD5Make the readiness probe match the container8 min
  • SD16Attach a manual EndpointSlice to a selector-less Service10 min
  • SD17Point the readiness probe at a path that exists8 min

Managing Traffic with the Gateway API (Gateway, HTTPRoutes)

  • SD6Route a host with Gateway and HTTPRoute10 min
  • SD18Send two paths through one Gateway10 min
  • SD19Redirect an old path and serve the new one10 min

Network Security and Policy 25% of the exam · 16 labs

Securing Traffic with Network Policies

  • NP1Default-deny a namespace and allow one flow10 min
  • NP5Allow ingress only from the front namespace12 min
  • NP6Allow egress only to a documentation range12 min
  • NP7Admit only pods that carry the granted label12 min
  • NP8Correct the allow policy selector and port10 min

Implementing Node and Pod Level Encryption

  • NP2Mark node encryption and mount a pod certificate8 min
  • NP9Mark the node for IPsec and mount the peer certificate8 min
  • NP10Mount a WireGuard key and record the tunnel8 min

Managing TLS Certificates for Gateway API

  • NP3Terminate Gateway TLS with a Secret8 min
  • NP11Listen on HTTP and terminate HTTPS10 min
  • NP12Attach a route to the HTTPS listener only10 min
  • NP13Point the Gateway at the Secret that exists8 min

Implementing Pod-level Authentication and Authorization

  • NP4Authenticate a pod and limit what it can read8 min
  • NP14Let the pod read Services and nothing else10 min
  • NP15Stop mounting the ServiceAccount token8 min
  • NP16Grant get on one ConfigMap by name8 min

Advanced Traffic Management 20% of the exam · 16 labs

Optimizing LLM Traffic

  • AT1Split LLM routes by path and timeout10 min
  • AT5Give completions a long timeout and health a short one10 min
  • AT6Rewrite the chat prefix before the decode Service8 min
  • AT7Shift ten percent of chat traffic to overflow8 min
  • AT16Stamp the model header on the embeddings path8 min

Implementing Routing to Expose Networks

  • AT2Expose one host through Ingress8 min
  • AT8Expose two hosts on one Ingress8 min
  • AT9Split one host between the API and the site8 min
  • AT10Point the health Ingress at the live Service8 min

Configuring Egress Gateways for Cluster Exit Traffic

  • AT3Steer egress through a gateway pod10 min
  • AT11Steer egress into the edge namespace12 min
  • AT12Annotate the namespace and allow one external range12 min

Implementing Cross Cluster Service Discovery and Load Balancing

  • AT4Import a remote Service with manual endpoints8 min
  • AT13Import a partner API on port 84438 min
  • AT14Move a local Service onto remote endpoints10 min
  • AT15Weight a local Service against a remote one10 min

Core Infrastructure and CNI 15% of the exam · 16 labs

Installing and Configuring CNI Plugins

  • CI1Configure a bridge CNI conflist8 min
  • CI6Install a host-local IPAM range8 min
  • CI7Repair a bridge conflist8 min
  • CI8Chain portmap and tuning after the bridge10 min

Managing IPAM and Pod CIDR Allocation

  • CI2Record service, cluster and node CIDRs8 min
  • CI9Record whether the two CIDRs overlap8 min
  • CI10Carve a host-local window from the node pod CIDR10 min
  • CI11Keep the network address out of the IPAM window8 min

Using Linux Tools (iptables, ip, tcpdump) for Packet-level Issues

  • CI3Record the default route and the service chain8 min
  • CI12Record the default device and the NodePort chain8 min
  • CI13Record the masquerade chains8 min

Troubleshooting Pod Connectivity (DNS, pod-to-pod)

  • CI4Fix a Service that has no endpoints8 min
  • CI14Point the client back at cluster DNS10 min
  • CI15Restore search-path ndots for short Service names8 min

Configuring Multi-interface Pods

  • CI5Attach a second network definition10 min
  • CI16Request a macvlan attachment on a Deployment10 min

Observability 15% of the exam · 13 labs

Analyzing Network Health Using Metrics

  • OB1Snapshot dataplane health8 min
  • OB4Record dataplane restart counts8 min
  • OB5Count CoreDNS EndpointSlices8 min
  • OB6Record Ready and NetworkUnavailable for every node8 min
  • OB13Record the kube-dns Service and one pod8 min

Troubleshooting End to End Network Performance with Tracing

  • OB2Trace a Service path and fix the port8 min
  • OB7Open the traced port and write the hop file12 min
  • OB8Write the client, Service, endpoint and node8 min
  • OB9Correct the route port and record the hop8 min

Auditing Traffic with Logs

  • OB3Audit network object access without request bodies8 min
  • OB10Audit network writes at Request and the rest at Metadata10 min
  • OB11Index the NetworkPolicies in one namespace8 min
  • OB12Count the network objects in the namespace8 min

Mock exams

13 timed mock exams

Pass mark 66%. A task appears in only one mock.

MockKindTasksTime
CKNE Domain Mock: Core Infrastructure and CNIOne domain4120 min
CKNE Domain Mock: ObservabilityOne domain3120 min
CKNE Domain Mock: Network Security and PolicyOne domain5120 min
CKNE Domain Mock: Service Networking and DNSOne domain6120 min
CKNE Domain Mock: Advanced Traffic ManagementOne domain5120 min
CKNE Full Mock 01Full exam22120 min
CKNE Full Mock 02Full exam5120 min
CKNE Full Mock 03Full exam5120 min
CKNE Full Mock 04Full exam5120 min
CKNE Full Mock 05Full exam5120 min
CKNE Full Mock 06Full exam5120 min
CKNE Full Mock 07Full exam5120 min
CKNE Full Mock 08Full exam5120 min

Start the CKNE course

A free account opens the lessons. The free starter labs on the CKA stay the CKA labs.

Sign up freeAll Kubernetes certifications