Kubernetes · course, labs and mock exams
CNPE course and practice labs
Certified Cloud Native Platform Engineer: 5 modules of lessons and demos, 54 tasks from 36 lab templates on real kubeadm clusters, and 9 timed mock exams.
- Modules
- 5
- Lessons
- 15
- Demos
- 5
- Labs
- 36
- Tasks
- 54
- Mock exams
- 9
The Linux Foundation · 120 minute exam
What you'll learn
Every domain of the exam, weighted like the exam
All 5 domains in the public curriculum. 5 of them already have labs.
GitOps and Continuous Delivery
25%of the exam
3 competencies · 6 labs
Platform APIs and Self-Service Capabilities
25%of the exam
4 competencies · 8 labs
Observability and Operations
20%of the exam
3 competencies · 6 labs
Platform Architecture and Infrastructure
15%of the exam
3 competencies · 6 labs
Security and Policy Enforcement
15%of the exam
5 competencies · 10 labs
What's included
A full course, not just a question bank
15 lessons
Short lessons for the exam competencies, with commands to copy and links to the official docs.
5 demos
Walk through a task step by step before you try it yourself.
36 hands-on labs
54 tasks with their variants, on a kubeadm cluster, graded check by check.
5 module quizzes
30 original questions, with an explanation for every answer.
9 mock exams
4 full mocks and 5 domain mocks. Pass mark 66%.
Certificate of completion
From The Cloud Panda when you finish the course. It is a course certificate, not one from The Linux Foundation.
Curriculum
5 modules
15 lessons and 5 demos: 4 h 4 min of reading and demos, about 6 hours with the practice. The lessons open with a free account.
01Platform architecture
Requests, quotas, storage classes and per-tenant budgets: the defaults a platform sets before the first team arrives. Domain: Platform Architecture and Infrastructure.
- lessonCompute, storage and network defaults12 min
- lessonRequests, limits and the HPA12 min
- lessonA budget per tenant11 min
- demoDemo: build the platform namespace14 min
02GitOps and delivery
Desired state in a Kustomize overlay, a pipeline account that cannot read Secrets, and a Service selector that switches blue to green. Domain: GitOps and Continuous Delivery.
- lessonDesired state is the overlay11 min
- lessonA pipeline account that cannot read Secrets12 min
- lessonBlue/green is a Service selector11 min
- demoDemo: apply the overlay, then switch to green14 min
03Platform APIs
A CRD with a schema, a request object a developer can file, an operator's RBAC, and a Kustomize overlay as the self-service path. Domain: Platform APIs and Self-Service Capabilities.
- lessonA CRD is an API13 min
- lessonThe custom resource is the request11 min
- lessonOperators and the overlay they ship12 min
- demoDemo: publish the Database API and file a request14 min
04Observability and operations
A readiness probe, an alert rule and a tracing annotation, a written record of requests and limits, and a crash loop whose command is the bug. Domain: Observability and Operations.
- lessonProbes, an alert rule and a tracing mark12 min
- lessonWrite the numbers down before you change them10 min
- lessonThe image is fine. The command is not.11 min
- demoDemo: from crash loop to available13 min
05Security and policy
Default-deny between services, namespace RBAC with baseline Pod Security, an audit policy, a ValidatingAdmissionPolicy, and a scan gate. Domain: Security and Policy Enforcement.
- lessonOnly the next hop12 min
- lessonBaseline Pod Security and a portal Role12 min
- lessonAudit, admission and the scan gate13 min
- demoDemo: write the audit policy and the admission rule14 min
How a lab works
The same loop as a hands-on exam
A task, a live cluster, and checks that read the cluster.
We set the scene
A setup script puts a live environment into a real state, often a broken one: a broken workload, a missing permission, a Service with no endpoints. You get the task and a terminal.
You fix it
With the real tools and the official documentation, exactly as you will in the exam. Nothing is simulated and there are no multiple-choice shortcuts.
Checks grade it
Each lab runs checks against the live environment and shows which passed. There is no answer text to match: if a check fails, you know exactly what is left.
Lab library
Every lab, by exam domain
54 hands-on tasks across 5 domains, about 7 hours of practice.
- GitOps and Continuous Delivery25%
- Platform APIs and Self-Service Capabilities25%
- Observability and Operations20%
- Platform Architecture and Infrastructure15%
- Security and Policy Enforcement15%
GitOps and Continuous Delivery 25% of the exam · 6 labs
Implementing GitOps Workflows for Application and Infrastructure Deployment
- GO1Apply the Git overlay8 min
- GO4Apply the revision overlay (2 variants)8 min
Building and Configuring CI/CD Pipelines Integrated with Kubernetes
- GO2RBAC for a pipeline account6 min
- GO5A pipeline account and a release Job (2 variants)10 min
Deploying Applications Using Progressive Delivery Strategies (e.g., Blue/Green or Canary)
- GO3Shift a Service from blue to green6 min
- GO6Move a canary step by replica count (2 variants)8 min
Platform APIs and Self-Service Capabilities 25% of the exam · 8 labs
Designing and Creating Custom Resource Definitions (CRDs) for Platform Services
- AP1A Database CRD with a schema8 min
- AP5A Topic CRD for the platform bus (2 variants)10 min
Implementing Workflows for Self-Service Provisioning Using Platform APIs
- AP2Request a bucket through the platform API6 min
- AP6File a namespace request (2 variants)8 min
Using Kubernetes Operators for Platform Automation and Integration
- AP3Install the database operator workload8 min
- AP7Install the cache operator workload (2 variants)10 min
Using Automation Frameworks for Self-Service Provisioning
- AP4Apply the self-service overlay6 min
- AP8Apply the quota component (2 variants)8 min
Observability and Operations 20% of the exam · 6 labs
Implementing Monitoring, Alerting, Logging, and Tracing Solutions
- OB1Readiness, a Service and an alert rule6 min
- OB4Liveness, a scrape annotation and an alert (2 variants)10 min
Measuring and Improving Platform Efficiency Using Deployment Metrics and Performance Indicators
- OB2Record the requests and limits6 min
- OB5Write the efficiency numbers (2 variants)8 min
Diagnosing and Remediating Platform Issue and Incident Scenarios
- OB3Restore a storefront Deployment6 min
- OB6Clear a bad image and a missing volume (2 variants)10 min
Platform Architecture and Infrastructure 15% of the exam · 6 labs
Applying Platform Architecture Best Practices for Networking, Storage, and Compute
- PA1Platform defaults for compute, storage and network8 min
- PA4Spread replicas and keep a minimum available (2 variants)10 min
Using Cost Management Solutions for Right-Sizing and Scaling
- PA2Right-size a deployment and add an HPA6 min
- PA5Shrink a worker to fit its budget (2 variants)10 min
Optimizing Multi-Tenancy Resource Usage
- PA3Separate tenant quotas6 min
- PA6Give a batch tenant a low priority budget (2 variants)10 min
Security and Policy Enforcement 15% of the exam · 10 labs
Configuring Secure Service-to-Service Communication
- SE1Allow only the next hop8 min
- SE6Allow DNS and one next hop out (2 variants)10 min
Applying RBAC and Security Controls Across Platform Resources
- SE2Portal RBAC and a baseline namespace6 min
- SE7Break-glass delete on pods only (2 variants)8 min
Generating Audit Trails and Enforcing Policy Compliance (SBOM, Compliance Reports, etc.)
- SE3An audit policy that skips health checks6 min
- SE8Publish the SBOM record (2 variants)8 min
Using Policy Engines and Admission Controllers for Governance
- SE4Require a CPU request in one namespace8 min
- SE9Deny privileged pods in one namespace (2 variants)10 min
Integrating Security Scanning and Compliance Checks into Deployment Pipelines
- SE5Record a clean image scan6 min
- SE10Record a passed image signature (2 variants)8 min
Mock exams
9 timed mock exams
Pass mark 66%. A task appears in only one mock.
| Mock | Kind | Tasks | Time |
|---|---|---|---|
| CNPE Domain Mock: Platform APIs and Self-Service Capabilities | One domain | 4 | 120 min |
| CNPE Domain Mock: Platform Architecture and Infrastructure | One domain | 3 | 120 min |
| CNPE Domain Mock: GitOps and Continuous Delivery | One domain | 3 | 120 min |
| CNPE Domain Mock: Observability and Operations | One domain | 3 | 120 min |
| CNPE Domain Mock: Security and Policy Enforcement | One domain | 5 | 120 min |
| CNPE Full Mock 01 | Full exam | 18 | 120 min |
| CNPE Full Mock 02 | Full exam | 5 | 120 min |
| CNPE Full Mock 03 | Full exam | 5 | 120 min |
| CNPE Full Mock 04 | Full exam | 5 | 120 min |
Start the CNPE course
A free account opens the lessons. The free starter labs on the CKA stay the CKA labs.