Six-week CKA study plan
About an hour a day for six weeks, if you already use Linux and containers. Each week ends with hands-on practice, because the exam has no multiple choice.
Last reviewed . Lab lists come from our current CKA catalogue. You can follow the plan with any course or book.
Week 1: Workloads and scheduling
Workloads & Scheduling 15%
Start with the objects every other task uses. Speed here pays off in every later domain.
Study
- Pods, Deployments and rolling updates
- ConfigMaps, Secrets and how Pods consume them
- Probes, resource requests and limits
- Taints, tolerations, node affinity and PriorityClasses
- HorizontalPodAutoscaler
Practise: 18 labs, about 110 minutes
- W1Rolling update and rollback5 min
- W9Tune a rolling update strategy6 min
- W2ConfigMap and Secret in a pod7 min
- W10Pods stuck on missing configuration6 min
- W18Roll out a ConfigMap change6 min
- W7HorizontalPodAutoscaler (v2)6 min
- W12Autoscaling on two metrics with scaling policies7 min
- W3Native sidecar container7 min
- W11PodDisruptionBudget for safe maintenance5 min
- W13Batch Job that runs out of time7 min
- W14Tame a CronJob7 min
- W17Slow starter killed by its liveness probe7 min
- W4Taints, tolerations, nodeSelector6 min
- W5Required node affinity5 min
- W6ResourceQuota and LimitRange7 min
- W8PriorityClass4 min
- W15DaemonSet on every node, control plane included7 min
- W16Spread replicas evenly across nodes7 min
Week 2: Services, networking and storage
Services & Networking 20%, Storage 10%
How Pods find and talk to each other, and how data outlives them.
Study
- Service types, selectors and EndpointSlices
- NetworkPolicy: default deny, then allow
- Ingress and the Gateway API
- CoreDNS and service discovery
- PersistentVolumes, claims, StorageClasses and access modes
Practise: 44 labs, about 320 minutes
- N7Pod networking facts5 min
- N21Host networking: hostNetwork pods and a hostPort7 min
- N2NetworkPolicy: allow only from one app7 min
- N3NetworkPolicy: default-deny egress, keep DNS8 min
- N13NetworkPolicy: namespace AND pod selector8 min
- N14NetworkPolicy egress allow-list with an ipBlock8 min
- N15NetworkPolicy: default deny and named ports9 min
- N1NodePort Service5 min
- N8Headless Service and stable pod DNS7 min
- N16Multi-port Service with a broken target port6 min
- N17Service without a selector and a manual EndpointSlice8 min
- N18Keep an old Service name working with ExternalName6 min
- N19LoadBalancer Service with externalTrafficPolicy Local7 min
- N20Sticky sessions with Service sessionAffinity6 min
- N5Gateway API: Gateway + HTTPRoute8 min
- N10HTTPRoute with header matching and traffic weights8 min
- N11Migrate an Ingress to the Gateway API9 min
- N22Gateway HTTPS listener with a TLS certificate9 min
- N23Cross-namespace HTTPRoute with a ReferenceGrant10 min
- N24HTTPRoute filters: rewrite, headers and redirect9 min
- N4Ingress with path routing5 min
- N9Ingress with TLS and a default backend7 min
- N25Default IngressClass and a multi-host Ingress9 min
- N6Service and pod DNS4 min
- N12Custom DNS records in CoreDNS7 min
- N26CoreDNS stub domain: forward one zone9 min
- N27Pod DNS settings: dnsPolicy and dnsConfig7 min
- S2Default StorageClass5 min
- S4Dynamic provisioning with a provisioner8 min
- S7Local PersistentVolume with delayed binding8 min
- S12StatefulSet volume claim templates and retention9 min
- S14Rework a StorageClass that is in use7 min
- S16Per-pod scratch space with generic ephemeral volumes7 min
- S3Troubleshoot a Pending PVC5 min
- S6Projected volume and in-memory scratch space7 min
- S9Raw block and single-pod volume claims7 min
- S10Retain the volumes of a running StatefulSet8 min
- S13Share one volume with subPath and subPathExpr8 min
- S1PV + PVC + pod7 min
- S5Recover data from a Released PersistentVolume8 min
- S8Bind a claim to a PersistentVolume by label6 min
- S11Claim and volume stuck in Terminating7 min
- S15Move an application's data to a bigger claim10 min
- S17Report which pods use which claims6 min
Week 3: Cluster architecture: access, kubeadm and lifecycle
Cluster Architecture, Installation & Configuration 25%
25% of the exam is about the cluster itself. Learn it on a cluster you're allowed to break.
Study
- Roles, ClusterRoles and bindings; kubectl auth can-i
- Users through CertificateSigningRequests
- Static Pods and the kubelet
- Upgrading control plane and workers with kubeadm
- etcd snapshot and restore, drain and cordon
Practise: 18 labs, about 130 minutes
- C5RBAC for a ServiceAccount5 min
- C6New user via CertificateSigningRequest10 min
- C17Reuse a ClusterRole in selected namespaces6 min
- C18Aggregated ClusterRoles6 min
- C19RBAC audit with kubectl auth can-i7 min
- C20A kubeconfig for a new user7 min
- C21A ServiceAccount for a CronJob7 min
- C3Upgrade the control plane with kubeadm12 min
- C4Upgrade the worker node8 min
- C10Static pod on a worker4 min
- C22Bootstrap tokens and the worker join command5 min
- C23A kubeadm JoinConfiguration file9 min
- C24Check and renew kubeadm certificates8 min
- C1Back up etcd6 min
- C2Restore etcd10 min
- C11Drain and cordon a node4 min
- C25etcd snapshot: save, check and report6 min
- C26Node maintenance with a PodDisruptionBudget9 min
Week 4: Cluster architecture: installing and extending
Cluster Architecture, Installation & Configuration 25%
The newer parts of the curriculum: package managers, extension points and operators.
Study
- Preparing a node: container runtime, kernel modules, sysctl, swap
- Helm install, upgrade and rollback; Kustomize overlays
- CNI, CSI and CRI: what each one does
- CRDs, custom resources and operators
- What a highly-available control plane needs
Practise: 20 labs, about 155 minutes
- C13Prepare a node for kubeadm7 min
- C27containerd and the systemd cgroup driver8 min
- C14Prepare a highly-available control plane join8 min
- C36etcd membership and control-plane topology7 min
- C37Add load-balancer SANs to the API server certificate12 min
- C7Helm: install, upgrade, roll back7 min
- C8Kustomize overlay6 min
- C15Helm: inspect values and install with a values file8 min
- C16Kustomize: images, generators and patches8 min
- C33Helm: install from a chart repository8 min
- C34Find and fix a failed Helm release7 min
- C35Kustomize: a reusable component in two overlays9 min
- C38Migrate a Helm release to plain manifests8 min
- C12Extension interfaces: CNI, CRI, CSI5 min
- C28Inspect the container runtime with crictl6 min
- C29RuntimeClass with scheduling and overhead6 min
- C30Investigate the CNI setup6 min
- C9CRDs and custom resources6 min
- C31Harden a CRD: validation, printer columns, status10 min
- C32Install an operator: cert-manager12 min
Week 5: Troubleshooting
Troubleshooting 30%
The biggest domain at 30%. Everything from weeks 1 to 4 comes back here, broken.
Study
- Nodes NotReady: kubelet, runtime, certificates
- Control-plane components that won't start
- Pods that are Pending, crashing or OOMKilled
- Services without endpoints and broken DNS
- Logs, events and resource usage
Practise: 34 labs, about 215 minutes
- T1Worker NotReady: broken kubelet config7 min
- T2Worker NotReady: kubelet not running5 min
- T9Pods stuck Pending: scheduling constraints5 min
- T19Worker NotReady: container runtime problem7 min
- T20Static pod missing on node016 min
- T21Pods can't get their image5 min
- T31A CronJob never runs5 min
- T34DaemonSet doesn't cover every node6 min
- T3API server down: broken etcd connection8 min
- T4API server down: invalid flag or value6 min
- T5Pods stuck Pending: scheduler broken6 min
- T6Deployment creates no pods: controller-manager broken6 min
- T32kubectl fails with a team's kubeconfig6 min
- T33API server down because etcd is broken8 min
- T12Resource usage: metrics-server and top8 min
- T15Container killed for running out of memory6 min
- T16ResourceQuota blocks a Deployment's pods6 min
- T28Find the heaviest workload with kubectl top6 min
- T29Which pods go first under memory pressure? QoS classes5 min
- T8CrashLoopBackOff and a failing probe7 min
- T11Logs, events, and top5 min
- T22Pods stuck initializing7 min
- T26Why did the container crash? Previous logs5 min
- T27Investigate a namespace with events5 min
- T30A Job never completes7 min
- T7Service with no endpoints5 min
- T10Cluster DNS broken6 min
- T13Readiness probe keeps pods out of a Service6 min
- T14NetworkPolicy selects the wrong client7 min
- T17New Services unreachable: kube-proxy is down8 min
- T18Pods can't start on node01: CNI broken8 min
- T23Service port doesn't reach the pods6 min
- T24Egress policy breaks name resolution8 min
- T25Pod can't resolve Service names6 min
Week 6: Mock exams and weak spots
All domains
Sit a full two-hour mock under exam conditions early in the week. Spend the next days on the domains where you scored lowest, then sit a second mock you haven't seen.
Study
- Re-read the exam environment tips
- Redo every lab you needed the solution for, without it
- Time yourself: aim for under seven minutes on routine tasks
- Book the exam for the end of the week while it's fresh
Practise: 15 mock exams of 120 minutes
- MockCKA Domain Mock: Cluster Architecture, Installation & Configuration16 tasks
- MockCKA Domain Mock: Services & Networking16 tasks
- MockCKA Domain Mock: Storage16 tasks
- MockCKA Domain Mock: Troubleshooting16 tasks
- MockCKA Domain Mock: Workloads & Scheduling16 tasks
- MockCKA Full Mock 0119 tasks
- MockCKA Full Mock 0219 tasks
- MockCKA Full Mock 0317 tasks
- MockCKA Full Mock 0417 tasks
- MockCKA Full Mock 0517 tasks
- MockCKA Full Mock 0617 tasks
- MockCKA Full Mock 0717 tasks
- MockCKA Full Mock 0817 tasks
- MockCKA Full Mock 0917 tasks
- MockCKA Full Mock 1017 tasks
Follow the plan in the labs
Every lab listed above is built for a real kubeadm cluster and graded automatically.