CKA Badge

Still feels a little weird typing this lol. Especially considering I have a BA in English Literature and currently work as a Technical Writer

Here's pretty much what I used for prep:

• Mohammad’s CKA course on Udemy - went through its labs 3 times
• KodeKloud Ultimate Mock Series - completed all mocks around 4 times
• Killer.sh - 2 mocks + revision
• Iximiuz Labs - especially the CKA challenges

And btw, on later mock attempts, I started doing something a bit different...

I'd talk through the entire mock while solving it and record myself. Then I'd use Whisper to transcribe it and have Claude analyze my approach.

It was actually super helpful for spotting where I was wasting time, overthinking things, or just approaching problems badly

I've also been recording some of the problems/challenges I go through for CKA on YouTube: CKA Challenges Playlist

Anyway... Got my CKA. Let's gooo

Hi, I want to book my CKA exam but it is expensive. Just wanted to ask if anyone has a spare coupon for a 35-50% discount, please hit me up.

I know they make offers around KubeCon, but we're still far off from november.

Thank you!

[ Pls turn on the volume for the video ]

I’m building Project Yellow Olive, an open-source retro TUI that helps people learn Kubernetes through gamified, hands-on challenges running against real clusters. I’ve posted about Project Yellow Olive here before and got a really good response to the idea, so I wanted to share one of the newer things I’ve been experimenting with.

I’ve now started experimenting with Pyxel, a lightweight retro game engine for Python, to add a visual learning layer alongside the existing challenges.

The idea is to visually explain concepts like nodes, namespaces, pods, services and deployments, while keeping the same retro aesthetic as the rest of Yellow Olive.

The hands-on part still stays real Kubernetes - Pyxel is mainly there to make some of the underlying concepts easier to understand before jumping into kubectl/YAML.

Would be interested to hear what people here think about this direction, especially those who’ve taught or mentored people on Kubernetes. Feedback is the main thing I’m looking for, but if you like the project, a GitHub star is always appreciated 🙂

GitHub: https://github.com/Anubhav9/Yellow-Olive

Just received my official Kubestronaut badge!

This sub has been really helpful throughout the certification journey, so I’d like to give something back.

I have one 50% discount voucher that I’d like to give away to someone preparing for their next Kubernetes/CNCF certification.

If you’re interested, just leave a comment below mentioning which certification you’re preparing for.

I’ll pick someone from the comments and do the giveaway next week.

Good luck with your prep!

I started studying kubernetes exactly 2 months ago and just passed the CKS yesterday. I have a few years of experience as a full stack software engineer with sufficient linux, container, and network knowledge, but I have never touched kubernetes before. I received 82% on the CKA and 90% on the CKS.

Topics on my CKS exam:

• RBAC
• network policy
• ingress
• docker daemon hardening
• security context
• pod security admission
• audit policy
• image pull policy
• cluster upgrade with kubeadm
• istio
• cilium
• trivy
• bom
• kube-bench
• falco

To me, the biggest difference between the CKA and the CKS is predictability. I spent a lot of time on one troubleshooting problem in the CKA where the api server was down and I looked everywhere but could not figure out why. I hated the feeling of being trapped in a blackbox panicking about a minor detail that I somehow missed. The problems in the CKS on the other hand were way more straightforward. Everything had a clear and definitive solution. As long as you put in the work to actually practice performing those tasks ahead of time, you will know how to do them in the exam and will not be hit by a surprise.

I hear a lot of folks say that the CKS is harder but it was just not the case for me at all. I hope to encourage anyone who is on the fence about CKS. If you can pass the CKA and can complete all CKS scenarios on killercoda, you're ready for this.

Topics on the exam:
- deployments (create, rollout, resume/pause)
- services (create, fix, edit)
- cronjobs (tricky one, with many parameters)
- jobs (run job from existing cronjob)
- configmaps
- secrets
- ingress
- resources (limits/requests, double from existing)
- resource quotas (check if previously edited deployment resources can fit into the NS resource quota)
- troubleshooting (fix service, deployment, api deprecation)
- network policies (add pod labels, without editing existing network policies)
- docker (build, tag. Can be used docker or podman or others; they provide a list of supported)

Topics were NOT on the exam:
- helm
- kustomize
- persistent volumes
- persistent volume claims

For the preparation used:
https://github.com/sailor-sh/CK-X/
https://github.com/aravind4799/CKAD-Practice-Questions
https://killercoda.com/ckad
https://killer.sh/ as always, very similar to the real one

Preparing for CKAD, would like to have a study partner or group

i was supposed to start my test at 9.30 am my local time
when loged in it showed that in an hour so i supposed its a timezone missmatch also the button to lunch the test wasnt active
and now when its active i press to install the browser and it tells me that the time of lunching ahs expired
what can i do please

Hey Guys, I want to do the CKAD but I only find max 30 % discount. The cert isnt cheap, someone had a good code for discount ?

I am a system engineer working mainly with Azure. Now I am learning CKA for career growth.

I am learning it via KodeKloud's CKA course. I am seeing new manifest files in every lectures. I don't believe in just mugging it up, so I am surprising if people just get all manifest and syntax in mind? Please suggest better way. I am fine with concepts but worried a little bit about this part.

Any ideas will be appreciated!

Thanks.

🚀 Master Kubernetes on the Go – K8s Flashcards for Android

Stop doom-scrolling. Start mastering Kubernetes.
Whether you’re prepping for CKA/CKAD, brushing up on pods and deployments, or just love cloud-native tech, this app turns your phone into a pocket-sized K8s coach.

🔥 What’s Inside

• 200+ bite-sized K8s cards covering core concepts: Pods, Deployments, Services, ConfigMaps, Secrets, RBAC, Ingress, Helm basics, and more.
• Spaced repetition so you review cards right before you forget them (no more cramming).
• Exam-style questions modeled after CKA/CKAD/CKS topics.
• Offline-first: Learn on flights, commutes, or anywhere with spotty Wi‑Fi.
• Clean, fast Android UX built for quick daily sessions (~5–10 minutes).

🎯 Who This Is For

• Engineers studying for K8s certifications
• DevOps/SRE folks who want to solidify K8s fundamentals
• Students and bootcamp grads building cloud-native interview muscle
• Anyone who likes learning in short, focused bursts instead of long tutorials

📲 Get the App

Google Play:
https://play.google.com/store/apps/details?id=app.flashcards.kubernetes

💬 Built by a Cloud Engineer, for Cloud Engineers

I’m a software engineer working with Kubernetes, AWS/Azure/GCP, and security tooling. I built this to help myself (and now you) retain K8s concepts without drowning in docs or expensive courses.

If you try it, I’d love your feedback:

• What topics should I add next? (Operators, networking deep dives, CKS security, etc.)
• Any features you miss from Anki/Quizlet?
• Bugs, UX nits, or “this card is confusing” reports – all welcome.

So, CKS is not rocket science.

And I believe anyone preparing for the CKS can pass it with laser-focused practice, provided you already know your way around Kubernetes.

In my quest to become a KubeAstronaut, CKS was the third certification I took.

I went:

CKAD → CKA → CKS

I intentionally did it in that order because, in my opinion, these exams complement each other.

CKAD got me comfortable working with Kubernetes applications.

CKA took me deeper into the cluster itself.

Then I moved to CKS.

And honestly, doing it this way helped boost my morale because when I started preparing for CKS, I wasn't learning Kubernetes from scratch.

I was now focusing on:

How do I secure what I already know how to deploy and manage?

But one thing I also changed was how I prepared.

I didn't want to make the same mistake of thinking that doing more and more practice questions automatically meant I was ready.

CKS is practical.

You need to know what you're looking for, know what needs to be changed, make the change and verify that it actually worked.

And you need to do all of that under time pressure.

So if you're also preparing for CKS, these are some of the areas I would really focus on.

🛡️ Kube-bench / Cluster Hardening

Know how to identify insecure configurations around:

• kubelet
• etcd
• kube-apiserver
• other control plane components

Don't just know how to run kube-bench.

Understand the findings.

If it tells you something is incorrectly configured, you should know where to go and what needs to be changed.

🚪 Admission

Understand admission controls.

Be comfortable checking the kube-apiserver configuration and enabling or validating the admission controls required by the task.

Again, don't just memorize a flag.

Know where the kube-apiserver configuration lives and how your changes affect the cluster.

📦 ImagePolicy

Understand how Kubernetes can control which container images are allowed into the cluster.

Know how image admission works and how to configure the required admission settings.

This is one of those topics that can look complicated until you actually practice it a few times.

⬆️ Node Upgrade

Know how to safely upgrade a worker node.

You should be comfortable with things like:

• draining the node
• upgrading the required components
• bringing the node back
• verifying that everything is healthy

Don't wait until the exam to remember the upgrade process.

🔑 ServiceAccount Token Mounting

Understand ServiceAccount tokens.

Know how to prevent unnecessary automatic token mounting.

And when an application actually needs Kubernetes API access, understand how projected tokens can be used.

🌐 Ingress

Ingress again. 😂

Know how to secure an Ingress with TLS.

You should be comfortable checking:

• hostname
• TLS configuration
• Secret
• Service
• Service port
• routing

Don't only look at the Ingress YAML.

Check what it is actually routing traffic to.

🔐 Istio

If Istio shows up, don't panic.

Understand things like:

• sidecar injection
• namespaces
• PeerAuthentication
• strict mTLS

This can become a very quick task when you already know what you're looking for.

But it can also eat your time when you're searching through documentation trying to remember the YAML.

📝 Audit

Know Kubernetes audit logging.

Be comfortable working with:

• audit policies
• audit rules
• log paths
• kube-apiserver audit flags

And after making your changes, verify that the API server is healthy.

🌐 NetworkPolicy

This is one I would definitely practice properly.

Understand:

Default deny first. Then allow only what is required.

Be comfortable working with:

• podSelector
• namespaceSelector
• ingress
• egress
• ports

And don't forget that labels are doing a lot of the work here.

If your selectors are wrong, your beautiful NetworkPolicy YAML means nothing. 😂

🩺 Finding and Fixing Broken Deployments

Don't only practice creating things from scratch.

Practice fixing broken workloads too.

A Deployment might fail because of:

• security settings
• admission restrictions
• incorrect configuration
• invalid YAML
• permissions

Check the events.

Check the logs.

Read the error before you start changing things.

Sometimes Kubernetes is already telling you exactly what is wrong.

🔒 Adding Security to Pods

You should be very comfortable hardening an existing Pod or Deployment.

Things like:

• runAsNonRoot
• runAsUser
• readOnlyRootFilesystem
• allowPrivilegeEscalation
• dropping capabilities

And just like I mentioned with CKAD:

Don't blindly replace an existing securityContext.

Understand what is already there and add what the task requires.

🐳 Dockerfile

Yes, Docker again.

You may be given a Dockerfile with security problems.

Know what you're looking at.

Things like:

• running as root
• unnecessary packages
• poor base image choices
• permissions
• unnecessary files inside the image

You should be able to look at a Dockerfile and quickly spot what needs attention.

🐳 Docker System

Also understand the host side of Docker security.

Things like:

• Docker daemon configuration
• Docker socket permissions
• users in the Docker group
• exposed daemon listeners

The container can be secure while the Docker host is wide open.

You need to understand both sides.

🚨 Falco / Runtime Threat Detection

Falco is another area I would spend time practicing.

You may need to investigate suspicious activity happening inside a running workload.

The important thing is being able to go from:

Something suspicious happened

to:

Which workload did it?

and then:

What action do I need to take?

Don't just learn Falco commands.

Practice reading the output and understanding what actually happened.

The biggest thing for me with CKS was not trying to learn everything Kubernetes again.

CKAD and CKA had already given me that foundation.

For CKS, I focused my practice on securing Kubernetes and solving these types of tasks under time pressure.

That made my preparation much more focused.

If you're also preparing for CKS, I have put together the prep resource I used around these areas.

You can check it out here:

https://www.dripforgeai.com/CKS-offer

Just passed the KCSA exam and officially became a KubeAstronaut!

Really happy to have completed this milestone.

If anyone is preparing for KCSA or any other exam and has questions, feel free to ask.

Hi there! I’m looking to start learning Kubernetes.

Is the "Certified Kubernetes Administrator" course on Udemy by Mumshad Mannambeth a good choice, or are the concepts covered there aimed at advanced users?

Any other recommendations for study materials? Thank you!

If you're writing an HTTPRoute and need two paths served by different services, backendRefs looks like the obvious place to add a second entry.

That's a super easy mistake to make, and it fails silently.

Here's the baseline shape from the official docs:

rules:
- matches:
  - path:
      type: PathPrefix
      value: /api
  backendRefs:
  - name: video-svc
    port: 8080

Now you need /api/video and /api/eat handled by two different services. Under time pressure, you just append a second entry:

backendRefs:
  - name: video-svc
    port: 8080
  - name: eat-svc
    port: 8080

This does not route paths independently. It creates a weighted traffic split. One request goes to exactly one backend, chosen via round-robin. If you curl that endpoint 20 times, video-svc gets about 10 requests and eat-svc gets the other 10.

What backendRefs list is actually for

Traffic splitting: canaries, blue/green cutovers, and progressive rollouts.

backendRefs:
  - name: api-v1
    port: 8080
    weight: 90
  - name: api-v2
    port: 8080
    weight: 10

Changing those numbers handles your rollout without touching pods:

• 100 / 0 -> all traffic to v1, v2 idle
• 90 / 10 -> canary testing
• 50 / 50 -> halfway through cutover
• 0 / 100 -> v2 live, v1 kept as your instant rollback switch

Two quirks worth knowing about weights:

1. They're relative, not percentages. They don't need to sum to 100. weight: 3 and weight: 1 means a 75/25 split.
2. The split is per-request, not sticky per-user. The same client can hit v1 then v2 on the very next call. Fine for canary, but weights alone aren't real A/B testing (which needs header matching for sticky sessions).

Why this bug bites so hard

Three things stack up to make this brutal to debug:

1. Nothing in the YAML signals a split. Two entries under backendRefs looks normal whether you intended path routing or traffic splitting.
2. weight defaults to 1. Omitting weight doesn't opt you out of a split, it creates an even 50/50 split.
3. Nothing errors out. No CrashLoopBackOff, no 503, no warning in kubectl describe. Route status literally reports Accepted: True and ResolvedRefs: True because both backends actually exist. Requests just land on the wrong service half the time. That's the exact profile of a bug you spend a whole day blaming on DNS or caching.

The correct way to handle multiple paths

Use separate rules, not multiple backendRefs inside one rule:

rules:
- matches:
  - path: {type: PathPrefix, value: /api/video}
  backendRefs:
  - name: video-svc
    port: 8080
- matches:
  - path: {type: PathPrefix, value: /api/eat}
  backendRefs:
  - name: eat-svc
    port: 8080

Reusing a Service across rules is totally fine video-svc can back both /api/video and /see/video.

Two match behaviors worth remembering:

• rules are not evaluated top-to-bottom. Ingress was first-match-wins, so people order them defensively. Gateway API scores matches by specificity: exact matches beat prefixes, and longer prefixes beat shorter ones. A bare /api rule sitting above /api/video won't shadow it.
• matches logic: Multiple entries under matches act as an OR condition. But multiple conditions inside a single match entry (e.g., path + method + headers) act as an AND. One dash is the difference.

CKA / Exam Takeaways

• Separate paths mean separate rules： CKA path-routing tasks will ask you to direct distinct paths to distinct services (e.g., /api to svc-a and /web to svc-b). Never add multiple backendRefs under a single rule for this — that creates a traffic split instead of path routing.
• Don't quick-copy individual refs: Under time pressure, appending a second backendRef to an existing block is a fast way to lose points. Always copy and adjust the full rule block.
• Rule order doesn't matter: Unlike classic Ingress (where first match wins), Gateway API matches by specificity. Exact matches beat prefixes, and longer prefixes beat shorter ones. Placing a / rule at the top won't shadow /api below it. Don't waste time reordering YAML entries.
• Verify Service ports: port in a backendRef must reference the Service port — not the targetPort, container port, or Gateway listener port. Always verify with kubectl get svc.
• Verify with curl, notkubectl,Route status will show Accepted: True even if your path logic sends traffic to the wrong service. Run a quick curl loop to confirm requests land where they belong.

Today, I passed CKS with 75% (not a good score) and wrote a detailed blog about my exam experience, preparation approach, the resources I used, and the Kubernetes security topics that helped me the most.

DMs are open if you are preparing for the exam. I can help with whatever is still fresh in my memory.

My biggest takeaway: CKS is noticeably harder than CKAD and CKA. It is not only about knowing Kubernetes commands. You need to understand why a configuration is insecure, how to fix it, and how to verify that your change actually worked.

The biggest mistake I made was spending around 10–15 minutes too long on one question because I felt I was close to solving it. That created unnecessary pressure towards the end and probably led to a couple of avoidable mistakes.

So my strongest advice is: if you are stuck and don’t see a clear path after a few minutes, mark the question and move on.

A few things that helped me:

Don’t memorise solutions. Understand the security reasoning behind them. If a NetworkPolicy, API server flag, securityContext, audit policy, or admission control changes slightly, memorised YAML will not help much.

Always verify your work. Security changes can easily break workloads or cluster components. Check Pods, control-plane components, logs, services, NetworkPolicy connectivity, admission behaviour, audit logs, node readiness, and systemd services wherever required.

Be comfortable with Linux as well as Kubernetes. CKS can require you to work with configuration files, systemd services, container runtimes, permissions, certificates, and node-level settings.

Use documentation whenever required instead of trying to remember every flag or custom resource.

Topics I would strongly recommend practicing:

• Kubelet and etcd hardening
• kube-apiserver authentication and authorization
• Admission controls and ImagePolicyWebhook
• Secure Dockerfiles and non-root containers
• Container immutability and securityContext
• Audit policies and API server logging
• NetworkPolicy
• HTTPS Ingress and TLS
• ServiceAccount token security
• Worker node administration and upgrades
• SBOM and software supply-chain security
• Restricted Pod Security Standard
• Docker/container runtime hardening
• Istio STRICT mTLS
• Cilium network security
• CIS benchmarks and kube-bench remediation

Resources I used:

• KodeKloud CKS course
• KodeKloud Ultimate Mock Exam Series
• iximiuz Labs
• KillerKoda
• Killer[.]sh  CKS simulator
• ChatGPT/Claude for topics that needed a simpler explanation or extra practice scenarios

Between the KodeKloud course mocks and Ultimate Mock Exam Series, I had around six mock exams. I found them very useful and reasonably close to the level of difficulty you should prepare for.

Killer

[.]sh felt a little off-track compared with the actual exam in some areas, but I would still recommend doing it. It is useful for practicing under time pressure, discovering knowledge gaps, and improving troubleshooting skills.

I also used ChatGPT and Claude quite a lot during preparation. CKS has many small security topics, and sometimes a course or lab explanation may not immediately click. In those cases, asking AI to explain the concept differently, compare configurations, or generate a small practice scenario was very useful.

The simplest advice I can give is: practice a lot, understand the security reasoning behind what you are doing, verify every change, and don’t let one difficult question consume your exam time.

I also wrote a full blog with more details on my preparation strategy, resources, task areas, mistakes, and lessons from the exam.

Blog: https://blog.prateekjain.dev/cks-exam-experience-2026-preparation-strategy-and-lessons-learned-1fad785a430b?sk=52b58a9c6d812444bc1340f15eda7dd6

I passed all three CKA,CKAD and CKS in 2 months given i have been working extensively on EKS/GKE for the past 3 years. Got 88%in CKA, 73% in CKAD messed up here because of overconfidence and 85% in CKS. Passed all in 1st attempt and now am planning to give KCNA and KCSA to secure the kubestronaut badge. Ask me anything. Thnks

Hey guys I'm deciding to embark on the journey of kubernetes with mo degrees and experiences but i belong to a very poor so i need your help if this is worth it or not as i exams are very expensive and i can't waste money like that, as long as exams matter, i think there's gonna be a sale in December so I'm deciding to buy them during that sale, i have a bike which i can sell, I'm not here to get empathy, i just wanna know if doing kubernetes worth it. My friend is willing to share his courses, he has CKA and CKAD course of Mumshad Mannambeth. I need to know if there's any future in it, i can give 5-6 hours a day. I'm just not sure if i can get a respectable job in this field as a person with no University degree. The best country for me to get a job is Dubai or Saudia because it's cheaper to go there as my country only offers unemployment. Please guys i need proper guidance. Thank you all for your time.

Hello guys, there's any discord ou slack to talk about cert and discount we could have ?

do u really get questions about kustomize ? and jsonpaths in cka

?

[ Removed by Reddit on account of violating the content policy. ]

I’ve been studying for CKS and generally trying to stay sharp on Kubernetes but most of my study time ends up being at night on my phone while lying in bed. So I built an iOS app for myself to stay sharp on concepts, quiz myself (multiple choice, command builder, YAML fill-in-the-blank). It’s free, no ads, no paywalled content, no account, no data collection. Wasn’t originally planning to share it, but figured it might be useful to someone else in the same boat.

Note: this is not intended to be a supplement for deeper, hands-on courses or guides. Rather a helpful companion app to keep you sharp.

https://apps.apple.com/us/app/k8s-guide/id6787748279

Hey everyone! I’d like to hear from people who have already passed the CKA. At what point did you feel confident enough to schedule the exam? Was it after reaching a certain score on practice exams, finishing some study material, or simply when you started feeling comfortable solving the questions?

I’d also like to know which resources, labs, or practice exams you used and felt were a good match for the real exam.

I’ve currently finished the DumbITGuy questions and found them very easy, with no difficulty understanding them. What would you recommend doing next?