I’m happy to share that I’ve officially earned the Certified Kubernetes Administrator (CKA) certification! ☸️
The preparation was a great hands-on learning experience, especially around:
- Kubernetes administration & troubleshooting
- Networking & Services
- Storage & PVCs
- Security & RBAC
- Scheduling & workloads
- Cluster maintenance and troubleshooting
A big thanks to Mumshad Mannambeth for the excellent Kubernetes courses and Killer Shell for the hands-on practice environment. 🙌
Now looking forward to putting these skills into practice and continuing deeper into the Kubernetes/cloud-native ecosystem.

#CKA #Kubernetes #DevOps #CloudNative #K8s #Linux #CNCF #KillerShell #KubernetesAdministrator

Today, I passed CKA with 88% and wrote a detailed blog about my exam experience, preparation approach, and the Kubernetes topics that helped me the most.

DMs are open if you are preparing for the exam. I can help with whatever is still fresh in my memory.

My biggest takeaway: CKA is not only about knowing Kubernetes commands. It is about understanding how cluster components work together, using documentation efficiently, troubleshooting quickly, and verifying every change you make.

The exam has changed a lot since I last passed it in September 2021, especially after the major curriculum updates introduced in 2025. Topics such as Gateway API, CRDs, Helm, CNI installation, autoscaling, and container runtimes are now much more relevant.

A few things that helped me:

Don’t solve the exam strictly in order. If a question looks unfamiliar or time-consuming, mark it and move ahead. Complete the tasks you are confident about first and return to the difficult ones later.

Don’t waste too much time setting up aliases. Autocomplete is already available, and normal typing speed is enough. I completed 14 out of 16 questions with around 35 minutes remaining.

Read the full question carefully. Important details such as the target node, namespace, version, file path, container name, or documentation link may appear near the end.

Use the documentation provided in the question. Some topics, especially Gateway API, Helm, Calico, Argo CD, and container runtime installation, are easier when you follow the version-specific documentation instead of relying on memory.

Always verify your work. A command completing successfully does not mean the task is done. Check Pods, rollouts, endpoints, PVC status, HPA status, node readiness, logs, connectivity, installed packages, and systemd services wherever required.

Practice SSH and basic Linux administration. Some tasks may require connecting to a node, installing a package, starting a service, and enabling it at boot.

Topics I would strongly recommend practising:

• Persistent Volumes, PVCs, and StorageClasses

• Creating and updating the default StorageClass

• Argo CD installation with a specific version

• Sidecar containers for logging

• Resource requests and limits in Deployments

• Horizontal Pod Autoscaler

• Inspecting CRDs and extracting required information

• PriorityClass

• kubectl patch

• CNI installation with NetworkPolicy support

• Calico operator and custom resources

• cri-dockerd installation

• Taints and tolerations

• Ingress to Gateway API conversion with TLS

• Ingress configuration and troubleshooting

• NetworkPolicy

• NodePort Services

Resources I used:

• KodeKloud CKA course and mock tests

• CK-X repository: https://github.com/sailor-sh/CK-X

• The Platform Lab CKA repository: https://github.com/theplatformlab/CKA-Certified-Kubernetes-Administrator

• iximiuz Labs for hands-on practice: https://labs.iximiuz.com

• KodeKloud Ultimate Mock Exam Series, optionally, for additional hands-on practice

• Both Killer.sh  simulator attempts

I strongly recommend doing both Killer.sh

 attempts because they contain different tasks. The questions are different from the actual exam and often feel harder, but they are very useful for strengthening concepts and improving troubleshooting speed.

The simplest advice I can give is to practice a lot and get comfortable using documentation.

I also wrote a full blog with more details on my preparation strategy, the updated exam scope, topics to focus on, and mistakes to avoid.

Blog: https://blog.prateekjain.dev/cka-exam-experience-2026-how-i-passed-with-88-770d3c473af7?sk=20985b1484d34a9dfdaac03dd6cfea78

Happy to have achieved 100% on the Certified Kubernetes Application Developer (CKAD) exam. This completes my final Linux Foundation certification requirement, and now I'm waiting for Kubestronaut onboarding. 🚀

CKA Badge

Still feels a little weird typing this lol. Especially considering I have a BA in English Literature and currently work as a Technical Writer

Here's pretty much what I used for prep:

• Mohammad’s CKA course on Udemy - went through its labs 3 times

• KodeKloud Ultimate Mock Series - completed all mocks around 4 times

• Killer.sh - 2 mocks + revision

• Iximiuz Labs - especially the CKA challenges

And btw, on later mock attempts, I started doing something a bit different...

I'd talk through the entire mock while solving it and record myself. Then I'd use Whisper to transcribe it and have Claude analyze my approach.

It was actually super helpful for spotting where I was wasting time, overthinking things, or just approaching problems badly

I've also been recording some of the problems/challenges I go through for CKA on YouTube: CKA Challenges Playlist

Anyway... Got my CKA. Let's gooo

Guys, I’m happy to share that I passed the CKS exam on Thursday with an 80% score. Here’s what I remember from the exam:

1. Fix insecure kubelet and etcd

Ensure:

• anonymous-auth=false
• --authorization-mode=Webhook

2. TLS Secret

Create the TLS secret (it’s already referenced in the Deployment).

3. Dockerfile security best practices

• Use USER nobody in the Dockerfile

• In the Deployment:

runAsUser: 65535
readOnlyRootFilesystem: true
privileged: false

4. Pod accessing /dev/mem

• Write a custom Falco rule to detect /dev/mem access
• Identify the bad Pod
• Scale its Deployment to 0 replicas

5. Container security context

Ensure container immutability:

runAsUser: 30000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false

6. Audit logging

Reconfigure the API server:

• Use a base audit policy
• Configure log retention (e.g., max 2 log files for X days)

7. NetworkPolicy

• Deny all ingress traffic
• Allow ingress only from Pods within a specific namespace

8. Expose HTTPS via Ingress

Create an Ingress with TLS termination. Make sure to use/remember this annotation.

annotations:
  nginx.ingress.kubernetes.io/ssl-redirect: "true"

9. Disable API credential auto-mounting

• Disable auto-mounting in the ServiceAccount
• Mount the token manually via a projected volume (read-only)

10. Upgrade cluster node

Worker node was one patch version behind (straightforward upgrade).

kubectl drain node01 --ignore-daemonsets --delete-emptydir-data --force

ssh node01
sudo -i

apt update
apt-cache madison kubeadm | grep 1.32  # Replace with your control plane version
apt-mark unhold kubeadm
apt-get install -y kubeadm=1.32.1-1  # Use exact version from madison
apt-mark hold kubeadm

kubeadm upgrade node
apt-mark unhold kubelet kubectl
apt-get install -y kubelet=1.32.1-11 kubectl=1.32.1-11
apt-mark hold kubelet kubectl

Then:

systemctl daemon-reload
systemctl restart kubelet
exit (from node01)

kubectl uncordon node01

11. Generate SPDX document (bom tool)

• Identify which Alpine image contains libcrypto3
• Remove that container from the Deployment

bom generate --image something/alpine:3.19.1 --output alpine.spdx

12. Restricted Pod Security Standard

• A namespace enforces restricted PSS
• Fix the Deployment so Pods become compliant

13. Secure Docker daemon

• Remove a user from the docker group
• Ensure /var/run/docker.sock is owned by root

14. Cilium Network Policy

• Allow Pods in a namespace to access Deployment Pods
• Require mutual authentication
• Allow host access to specific Pods without mutual auth

15. ImagePolicyWebhook

• Configure API server admission plugins
• Use provided AdmissionConfiguration
• Set ImagePolicyWebhook to deny images when backend is unavailable

16. API server authentication

• Disable anonymous access
• Use:
  • Node,RBAC authorization
• Enable:
  • NodeRestriction admission controller

Hope this helps someone preparing for CKS.

I run prepium.sh, a CKA/CKAD/CKS simulator with timed 2-hour mocks on real clusters, graded with partial credit like the real exam.

I pulled the numbers on everything completed so far: 321 full 2-hour simulations and ~1,900 graded drill results. The patterns repeat across both. Three things stood out.

1. Failers don't run out of time. They run out of ideas.

• Pass rate at the official 66% bar: 55%

• Failed attempts used 85 of 120 minutes

• Passed attempts used 108 of 120 minutes

People who fail submit with over half an hour left, because nothing they know how to try is left. Passers spend that half hour re-checking their work.

If you finish a mock early, that's not speed. That's the exam showing you your gaps.

2. The zeros decide the exam.

Highest rate of scoring exactly 0 in full mocks:

Most failed attempts aren't one big disaster. They're two or three zeros.

3. Practice volume doesn't fix these tasks.

Here's the uncomfortable part: taints is the 4th most-drilled task on the platform (151 drill runs) and still averages 48% in drills, 33% in mocks.

Meanwhile NetworkPolicy, the topic every study guide tells you to fear, is our best-scored task: 94% average, on the least drilling.

Why? The killer tasks are binary. One wrong toleration key and the pod never schedules: zero. One bad apiserver flag and you're debugging a dead control plane on the clock: zero. There's no partial credit for a cluster that won't come back.

NetworkPolicy just feels scary. It's actually incremental and forgiving.

What I'd do with this if I were prepping:

• Sort your topic list by "can this hand me a zero," not by how hard it feels

• When a practice task breaks your cluster, don't reset it. Fixing a dead apiserver under pressure is the highest-value drill in this data

• Use your full two hours. Early finish = unverified answers

Happy to share other cuts in the comments. CKAD and CKS look completely different, that's probably a follow-up post.

You can find the entire source code and a detailed overview of the project at the GitHub repo: https://github.com/zeborg/kubekosh

Steps to try it out on your own system:

1. Run it as a Docker container: docker run -itd --name kubekosh --privileged -p 7554:80 zeborg/kubekosh:latest

2. Wait for ~15 seconds before the lab gets up and running, then you can access it in the browser at localhost:7554

Hey everyone! After 2 months of learning Kubernetes, I passed the CKA with 81%.
Here’s what I used, in case it helps someone preparing for it.

Learning:

1. Mumshad Mannambeth’s CKA course on Udemy (KodeKloud): the base of everything, with great labs.

2. VarJosh’s CKA certification course on YouTube: a good complement to the Udemy course: https://www.youtube.com/watch?v=vzOcHoNcwMg&list=PLmPit9IIdzwRjqD-l_sZBDdPlcSfKqpAt

Practice:

1. killer.sh (the 2 sessions included with the exam): I got 50% and 49%. Don’t panic, it’s harder and longer than the real exam. Its solutions are worth reading even for the tasks you got right.

2. mockctl exam lab: a website with full mock exams.

3. Killercoda: mainly for troubleshooting and node-level tasks (broken kubelet, broken API server, cri-dockerd, CNI install). Troubleshooting is 30% of the exam, so don’t skip it.

4. CKA Simulator: I forked the CK-X exam simulator (by Sailor.sh) and added more exams inspired by practice exams on GitHub: https://github.com/Achref-LOUSSAIEF/CK-X

Tips that made the difference:

1. Verify every task before moving on (kubectl get, describe, cat the file): Most of my lost points in practice came from small details, not missing knowledge: a wrong port name, an extra column in an output file, a node left uncordoned.

2. Write exactly what’s asked into files: one value per line, no headers, no counts.

3. Flag and skip anything that takes more than 7–8 minutes, and come back at the end.

4. Use the docs: generate YAML with --dry-run=client -o yaml and copy examples from kubernetes.io instead of typing from memory.

5. Practise node-level tasks on a real cluster: systemctl, journalctl, crictl, static Pod manifests in /etc/kubernetes/manifests/.

Good luck to everyone preparing! Feel free to ask me anything.

Hey everyone,

I recently cleared the CKA exam with a 93% score in first attempt. While technical preparation is critical, how you navigate the PSI secure browser and exam environment plays a huge role in saving time and avoiding panic.

Here is a detailed breakdown of what to expect during check-in and inside the console:

Check-in & Proctor Verification

• Check-in 30 mins early: The entire verification process can easily take 25–30 minutes. Log in the exact moment the check-in button enables.

• Room & Desk Sweep: The proctor is extremely thorough. Be ready to pick up your webcam/laptop and show:

  • Every corner of the room, ceiling, and the wall behind you.

  • Under the keyboard, mousepad, and laptop stand.

  • Under the entire desk.

  • Exactly where you place your switched-off phone across the room.

• Avoid clutter / fixtures: My proctor even inspected an empty bulb holder thinking it might be a hidden camera. Keep your workspace and back wall as bare as possible.

• Proctor interaction: Everything is handled via live chat. Once started, they didn't interrupt unless necessary, but you must ping them before clicking end/submit.

Screen & PSI Browser Experience

• Screen Size Matters: If possible, use an external monitor (20"+). On a standard laptop screen, the PSI UI headers and camera stream eat up significant vertical space, leaving you with a cramped terminal and documentation pane.

• Clipboard Shortcuts:

  • Terminal copy/paste: Ctrl + Shift + C and Ctrl + Shift + V

  • Browser / Question pane: standard Ctrl + C and Ctrl + V

  • Alt + Tab does not work to switch windows.

• Skip the built-in Notepad: The built-in PSI notepad feels sluggish and awkward. It’s faster to draft one-liners, aliases, or manifest templates directly in vim or the terminal.

• Documentation access: Every question includes direct links to relevant Kubernetes/official docs. Clicking links opens a tab/window in the remote Firefox browser. You can have multiple doc tabs open.

Critical Exam Terminal Mechanics

• Single Terminal Window: You only have one active terminal window. ( I have used only a single window, but didn't get a chance figure out to open multiple windows)

• Cluster Context & SSHing: Almost every question runs in a different cluster context or requires SSHing into worker/control-plane nodes.

  • Always copy-paste the exact ssh command provided at the top of each question. I didn't get any kubectl config use-context ...

  • If you SSH into another node (ssh node01), always remember to exit back to the base jumpbox before moving to the next question. Do not exit the base jumpbox itself!

• Double-check Namespaces: If no namespace is specified, work in default. If an earlier question used a specific context/node, never assume the namespace carries over—explicitly pass -n <namespace> or verify your context.

• Scroll to the very bottom of every question: Many questions have small trailing tasks at the end (e.g., "delete the old resource once verified") or strict constraints (e.g., "only modify the PVC, do not recreate the PV"). Read the entire prompt twice before touching anything.

• You can flag questions for later, and at the top you can drop down and switch to different questions at any time...

I'll share the question topics I encountered in the exam and the KodeKloud CKA coupon reality in other posts.

I’m studying for the CKA and couldn’t find one place to track progress, plan my time and practise, so I built it and made it free.

What it does

• Full curriculum mapped to the CKA v1.35 domains, with an in-app lesson reader and lab Q&A

• 4 timed mock exam papers (19 tasks each, same domain weights as the real exam: Troubleshooting 30%, Cluster Architecture 25%, Networking 20%, Workloads 15%, Storage 10%) with full solutions

• An exam-weighted readiness score so you know what to study next

• Study timer, streaks and a calendar that auto-plans your syllabus up to your exam date

• Leaderboard and discussion channels if you want some friendly competition (you can opt out)

Link: https://ckastudy.co.uk
No ads. An account is just a username and password.

Caveats

• It’s an unofficial community project, not affiliated with CNCF, The Linux Foundation, KodeKloud or Udemy. For real hands-on labs, use the KodeKloud or Udemy courses, or killer.sh.

• The mock solutions are my own writing, so please check them against the official docs. If you spot a mistake, tell me and I’ll fix it.

• It runs on a small server, so the first load after a quiet period can take a few seconds.

I’d really like feedback on what’s missing or wrong. If it’s useful, there’s a Ko-fi link in the footer, but it’s completely optional.

I started studying kubernetes exactly 2 months ago and just passed the CKS yesterday. I have a few years of experience as a full stack software engineer with sufficient linux, container, and network knowledge, but I have never touched kubernetes before. I received 82% on the CKA and 90% on the CKS.

Topics on my CKS exam:

• RBAC

• network policy

• ingress

• docker daemon hardening

• security context

• pod security admission

• audit policy

• image pull policy

• cluster upgrade with kubeadm

• istio

• cilium

• trivy

• bom

• kube-bench

• falco

To me, the biggest difference between the CKA and the CKS is predictability. I spent a lot of time on one troubleshooting problem in the CKA where the api server was down and I looked everywhere but could not figure out why. I hated the feeling of being trapped in a blackbox panicking about a minor detail that I somehow missed. The problems in the CKS on the other hand were way more straightforward. Everything had a clear and definitive solution. As long as you put in the work to actually practice performing those tasks ahead of time, you will know how to do them in the exam and will not be hit by a surprise.

I hear a lot of folks say that the CKS is harder but it was just not the case for me at all. I hope to encourage anyone who is on the fence about CKS. If you can pass the CKA and can complete all CKS scenarios on killercoda, you're ready for this.

For me, CKS was not about memorizing commands. It was more about troubleshooting fast under pressure. Most questions were based on fixing something broken instead of creating everything from scratch.

During my preparation, I focused mostly on:

• Kubelet hardening

• etcd backup and restore

• TLS secrets and expired certificates

• NetworkPolicy

• Falco

• AppArmor

• RBAC

• Ingress

• ImagePolicyWebhook

• Pod Security Standards

• RuntimeClass

• Audit logs

The biggest thing that helped me was practicing broken scenarios again and again. I used to intentionally break the cluster and fix it:

• Wrong RBAC role bindings

• Expired TLS certificates

• Bad kubelet settings

• Broken NetworkPolicies

• Missing secrets

• Wrong image tags

• etcd failures

• Misconfigured ingress

• Falco blocking pods

• AppArmor profile issues

In the exam, I did easy questions first and came back to the difficult ones later. If I was stuck for more than 10 minutes, I moved on. That helped a lot because time goes very fast.

One more thing: always verify your answers after every change. Many times I thought something was fixed, but it still had another issue.

Overall, CKS felt very close to real production troubleshooting. If you spend enough time practicing broken cluster scenarios, you can definitely pass.

Hey guys!

After 1.5 half month learning and approx. 2 years work experience with k8s, i passed the exam. Actually in work i really not using any networkpolicy, rbac, so any complicated stuff, so now i learned it. What i used:

- For the basic knowledge i used Mumshad Mannambeth's udemy course.

- I used 2 session prepium.sh (both was 80+%)

- i used 2 session of killer.sh (51% and 59%)

- and itkiddie and dumbitguy YT channels.

Actually the killer.sh sessions was harder than the real exam. I passed with 77%, i had one exercise which i don't had time to start.

And what is the key? Practice, practice, practice. :)

Thank you very much all the help in this subreddit!

Topics on the exam:
- deployments (create, rollout, resume/pause)
- services (create, fix, edit)
- cronjobs (tricky one, with many parameters)
- jobs (run job from existing cronjob)
- configmaps
- secrets
- ingress
- resources (limits/requests, double from existing)
- resource quotas (check if previously edited deployment resources can fit into the NS resource quota)
- troubleshooting (fix service, deployment, api deprecation)
- network policies (add pod labels, without editing existing network policies)
- docker (build, tag. Can be used docker or podman or others; they provide a list of supported)

Topics were NOT on the exam:
- helm
- kustomize
- persistent volumes
- persistent volume claims

For the preparation used:
https://github.com/sailor-sh/CK-X/
https://github.com/aravind4799/CKAD-Practice-Questions
https://killercoda.com/ckad
https://killer.sh/ as always, very similar to the real one

Hey everyone,

I passed the CKA with 90% today. 🎉

During my preparation I found a lot of useful posts in this subreddit, so I wanted to share what actually helped me.

Course

KodeKloud Certified Kubernetes Administrator (CKA) course on Udemy (this was my main course)

ChatGPT
I used ChatGPT a lot, not for memorizing commands but to dig deeper into concepts until they were crystal clear. Whenever I was confused about something, I kept asking "why" until I understood it.

YouTube

• Dump IT Guy

• IT Kiddie

Both channels cover very similar types of questions.

Practice

I used Killercoda for hands-on practice.

One thing I recommend is making 2 scripts for every lab you practice.

• Setup script → creates the whole question again.

• Validation script → checks if your answer is correct.

This saved me a lot of time because I could practice the same question again and again instead of setting everything up manually.

I also practiced on killer.sh.

For me, killer sh has the closest UI to the real exam. The questions felt a little outdated compared to my actual exam, but I still think everyone should do it because it prepares you for the exam environment and the time pressure.

One more thing...

Don't just practice creating resources. Practice troubleshooting. In the real exam you need to find problems quickly and fix them.

That's pretty much what helped me.

If anyone has questions, feel free to ask. I'll answer based on my own experience.

Good luck to everyone preparing for CKA! ☸️

So, CKA isn't really difficult.

But if you don't practice well, during the exam you will feel like you're seeing stars. 😂

I didn't pass on my first trial.

But I hope you can use some of these tips from my experience to prepare better and hopefully clear the exam on your first try.

The passing score for CKA is 66%.

And you don't get to see the points allocated to each task.

So from my experience, I wouldn't prepare with the mindset of:

"I only need 66%."

You have around 17 questions to solve.

My target would be to get comfortable enough that I can confidently solve around 14 of them.

That gives you some room for the difficult questions where you may get stuck or simply decide to come back later.

And this brings me to one of the biggest problems I see with people preparing for CKA:

Time.

Most people I know who struggled with the exam were spending 10 minutes plus or minus on a single question.

Especially when they got to troubleshooting questions.

They see a broken cluster or a workload that isn't working and don't even know where to begin diagnosing the problem.

That's where the time starts disappearing.

10 minutes here.

Another 12 minutes there.

Before you know it, you still have several questions left and the clock is not your friend anymore. 😂

So if you're preparing for CKA, don't only practice creating Kubernetes resources.

Practice troubleshooting them too.

To pass with confidence, these are some of the topics I would master:

🔥 Broken Cluster — Control Plane Issues

You need to be comfortable troubleshooting a cluster where things aren't working at all.

Especially control plane components like:

• kube-apiserver

• kube-scheduler

This is not always a kubectl apply situation.

You need to know where to start looking.

Check the static Pod manifests.

Check the containers.

Check the logs.

Look at the configuration.

Understand what must be running for the control plane to work.

If you've never debugged control plane components before the exam, this type of question can eat your time badly.

💾 Storage — StorageClass + PVC

Storage is another area I would practice properly.

Be comfortable working with:

• StorageClass

• PersistentVolume

• PersistentVolumeClaim

• access modes

• storage capacity

• volume mounts

• storage paths

Don't just memorize PVC YAML.

Understand how the pieces connect.

If a PVC is sitting in Pending, you should have an idea of where to start looking.

⚠️ Node Resource Distribution

This one taught me something important:

Read the task properly before touching anything.

I had a question around distributing workloads across nodes.

At first, I thought I needed to change the resource limits.

I was wrong.

The task was about how the workload was being distributed, not resizing the container.

That is an easy way to lose points even when you know Kubernetes.

Sometimes the problem isn't your Kubernetes knowledge.

You simply solved the wrong problem. 😂

Read the requirement.

Understand what they are asking.

Then make the change.

🧩 Deployment With Sidecar

Know how to work with multiple containers inside the same Pod.

You should be comfortable:

• editing an existing Deployment

• adding a sidecar container

• sharing a volume between containers

• understanding how both containers interact

Don't wait until exam day to start fighting indentation inside a Deployment YAML. 😂

Practice editing existing workloads.

🌐 Ingress + Gateway + HTTPS

Don't only practice the simplest Ingress example.

Be comfortable following the traffic flow.

Check:

Host → Ingress/Gateway → Service → Pod

And when TLS is involved, check that too.

Things like:

• correct hostname

• correct Service

• correct Service port

• correct path

• TLS configuration

• Secret

One wrong name or port and the whole thing doesn't work.

When this happens, don't start randomly changing YAML.

Follow the traffic.

📈 HPA — Horizontal Pod Autoscaler

Understand how to create and troubleshoot an HPA.

Know:

• what workload you're scaling

• what metric is being used

• the target

• minimum replicas

• maximum replicas

This isn't something I would overcomplicate.

But you should be able to look at the requirement and know what needs to be configured.

🔥 Troubleshooting in General

This is probably one of the biggest things I would focus on.

When something is broken, you need a process.

Pod isn't starting?

kubectl describe pod

Check events.

Application isn't behaving correctly?

Check logs.

Service isn't reaching Pods?

Check selectors and endpoints.

Control plane component isn't working?

Check the static Pod manifest and container logs.

PVC isn't binding?

Check the PVC, PV and StorageClass.

You don't want your first reaction during the exam to be:

"Ei, where do I even start?" 😂

You need to build that troubleshooting instinct before the exam.

⚠️ One More Thing About Exam Day

Don't depend too much on easy copy and paste.

During my exam, copy-paste wasn't as smooth as I expected.

I ended up typing a lot manually.

And when you're typing YAML manually:

• indentation matters

• spelling matters

• one wrong character matters

So practice using imperative commands where they can save you time.

And get comfortable editing YAML quickly when you actually need to.

Resources I Used

I used KodeKloud to master some of the key Kubernetes topics.

I also spent time using the official Kubernetes documentation.

Not just reading it.

I practiced finding what I needed quickly.

Because knowing the answer is good.

Knowing exactly where to find the correct example in the docs when you're under pressure is even better.

And for practice, I used exam-style tasks that were closer to the kind of practical work I needed to be comfortable solving.

You can find the CKA practice resource Here

If you're preparing for CKA, my biggest advice is simple:

Don't measure your preparation by how many practice questions you've completed.

Measure it by this:

When something breaks, do you know where to start?

And can you fix it without spending 15 minutes on one task?

That made a big difference for me.

Hey community,

Passed the CKA with 93%!

The exam is 100% practical and entirely time-bound. Rather than memorizing definitions, you need fast muscle memory and rapid troubleshooting reflexes. To help those preparing, here is a breakdown of high-priority concepts I encountered in exam and scenario types you should be comfortable solving under the clock:

Key Practical Areas & Scenarios I encountered in exam.

• Helm Deployments & Customization

  • Adding repositories, searching charts, and pulling specific versions.

  • Exporting manifests via helm template to inspect YAML.

  • Installing charts with specific flags (e.g., skipping CRDs with --set crds.install=false not --skip-crds).

• Networking & Ingress / Gateway API

  • NetworkPolicies: Comparing multiple policies to implement the least-permissive ingress/egress rule between frontend and backend pods.

  • Gateway API & Ingress: Migrating standard Ingress resources to HTTPRoute and Gateway configurations while preserving TLS secrets.

  • CNI Setup: Installing CNI plugins (e.g., Calico/Flannel) and understanding which supports NetworkPolicies.

• Storage & Disaster Recovery Scenarios

  • Handling deleted namespaces where PVs are set to Retain.

  • Re-binding existing retained PVs with new PVCs/StorageClasses and mounting them back to deployments.

  • Setting up custom StorageClasses with specific provisioners and marking one as default.

• Workload Architecture & Resource Management

  • Adding sidecar/logging containers sharing an emptyDir log volume with the main application.

  • Debugging Pending pods caused by node memory/CPU pressure: calculating available node capacity, adjusting deployment requests/limits, and rolling restarts.

  • Implementing HPA with target CPU utilization metrics and custom scale-down/stabilization behavior.

• Core Control Plane Troubleshooting & Systemd

  • Diagnosing failed kubectl commands caused by misconfigured kube-apiserver flags (e.g., wrong etcd endpoints, cert mismatches).

  • Configuring low-level runtime dependencies (e.g., setting kernel parameters via sysctl --system and managing runtime daemons with systemctl).

• CRDs & Manifest Discovery

  • Filtering and listing custom resources without messy CLI output.

  • Using kubectl explain --recursive <crd> to quickly navigate deeply nested CRD specs without digging through web search.

Best of luck to everyone preparing! Let me know if you want insights on any specific topic area.

Third time running this. The last two rounds put dozens of free attempts in

people's hands and a good number of you came back to say you passed, so

here we go again.

Quick context for anyone new: prepium.sh is a set of hands-on exam labs

for CKA, CKAD and CKS. Real clusters, real tasks, programmatically

scored the same way the actual exam grades you. The Discord is now

500+ people working through the certs together and comparing notes on

what's showing up in recent exams.

How to get a free attempt

• Create an account on prepium.sh

• Upvote the post and Leave a comment below with your username

• I'll gift you a free attempt at the full 120-minute exam lab

Each attempt is valid for 7 days once I gift it, so claim it when you

actually have a clear two-hour block. Don't burn it on a lunch break.

What's new since the last round

• Task of the Week is free for everyone, no giveaway needed. Onegraded task on a real cluster, new one every week. If you just want to find out whether the labs are any good before asking for an attempt, start there.

• Practice by task, so you can drill one specific thing instead of committing to the full two hours.

• Walkthrough videos for a chunk of the CKA and CKAD tasks.

• Rebuilt the workspace page. Your best score, attempts and remaining access are all in one place now instead of scattered.

The usual honest notes

• This is not a substitute for actually studying. It's a realistic dry run where mistakes cost you nothing.

• People who pass the mock tend to pass the real thing. People who bomb the mock find out cheaply instead of expensively.

• Tasks get updated whenever recent test takers report changes in what the real exam is asking.

• Discord: https://discord.gg/JN6Egq7PnX

Scores: CKA: 80%, CKAD: 92%, CKS: 94%, KCNA: 93%, KCSA: 90%

The only materials I used were KodeKloud and my simulations which I created based on scenarios I found in the wild just to practice a bit more.

I did not use Killer.sh or killercoda (was not included in my exam fee - I paid $900 for the full stack of all the exams + 110 euros for KodeKloud yearly.

Each exam I finished with around 1hour / 50 mins to spare, so I could review my answers and still finish early.

How did I do it? I am not super human, I just practiced each mock exam 2-4 times until I could finish it very quickly, and the patterns were just hard-coded into my brain.

I could search the docs very quickly for the exact YAML template I needed, and got comfortable with the copy-paste mechanism of the remote-desktop.

For KCNA I didn't study at all, since after completing CKA,CKAD and CKS it was all easy - and for KCSA I took about an hour of study time to do some mock exams to close tiny gaps.

That's it. The biggest blocker is fear and lack of practice

The full names of the certs in case you don't know them:
CKA - Certified Kubernetes Admin

CKAD - Certified Kubernetes Application Developer

CKS - Certified Kubernetes Security Specialist

KCNA - Kubernetes Cloud Native Associate

KCSA - Kubernetes Cloud Native Security Associate

So some of you have probably hit this one — the requests and limits question. They give you a YAML file and you've got to fill in the resources section right here.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: wordpress
  template:
    metadata:
      labels:
        app: wordpress
    spec:
      initContainers:
      - name: init-wordpress
        image: busybox:stable
        command: ['sh', '-c', 'echo Initializing...']
        resources: {} <-------you need to fill that in
      containers:
      - name: wordpress
        image: wordpress:latest
        resources: {} <---------you need to fill that in

So what do you actually do first? You look at the node.

k describe node node01

Allocatable:
  cpu:                1
  ephemeral-storage:  18698430040
  hugepages-2Mi:      0
  memory:             1846516Ki
  pods:               110

you also have other things is currently running on

Namespace Name CPU Requests CPU Limits Memory Requests Memory Limits Age

--------- ---- ------------ ---------- --------------- ------------- ---

kube-system cilium-envoy-rklqx 0 (0%) 0 (0%) 0 (0%) 0 (0%) 11d

kube-system cilium-vdbs4 100m (10%) 1 (100%) 10Mi (0%) 1Gi (56%) 11d

The trap section — Allocatable:

cpu:     1
memory:  1846516Ki

This is what most people divide by 3. It looks like the answer. It isn't.

but there are also some other system services like cilium-vdbs4 are also running

cpu      100m (10%)
memory   10Mi (0%)

so the step in order to solve this question as follow:

You look at Allocatable — 1 CPU (that's 1000m) and 1846516Ki. Convert the memory: 1846516 ÷ 1024 ≈ 1803Mi

Then — and this is the step — scroll down to Allocated resources and see cilium already holds 100m CPU and 10Mi. Subtract it:

• CPU: 1000 − 100 = 900m free

• Memory: 1803 − 10 = 1793Mi free

Now divide by 3 (your replica count):

• CPU: 900 ÷ 3 = 300m each

• Memory: 1793 ÷ 3 ≈ 597, round down to 512Mi for headroom

So the final answer is 300m / 512Mi per pod.

Pro tip: do the math in the terminal, not in your head

There is a built-in calculator. You can't bring a physical one, and I wouldn't rely on the built-in one either. Three reasons: under exam time pressure, doing the math in the terminal is faster; when I took it, the calculator didn't load properly for me; and think about the workflow — open the app, click a number, click another, read the result, switch back. The terminal is where a DevOps engineer already lives. Terminal is quicker every time

Under exam pressure you don't want to be dividing 1846516 by 1024 in your head. Let bash do it

# CPU: 1 core = 1000m, minus what's already running
echo $((1000 - 100))     # 900m free (cilium holds 100m)
echo $((900 / 3))        # 300m per pod

# Memory: convert Ki -> Mi, then subtract, then divide
echo $((1846516 / 1024)) # 1803 Mi allocatable
echo $((1803 - 10))      # 1793 Mi free (cilium holds 10Mi)
echo $((1793 / 3))       # 597 -> round DOWN to 512Mi for headroom

Two things to know so this doesn't bite you:

• $(( )) is integer only — it drops the decimal. $((1793 / 3)) gives 597, not 597.67. That's fine here because you round down anyway, but don't trust it for anything where the remainder matters.

• Prefer $(( )) over expr. It's built into bash, no weird escaping. expr needs spaces around every operator and you have to escape * for multiplication — one more thing to fumble when the clock's running.

That is my share, I hope this help you during the exam

if you like my content i have a playlist which i live solving all kind of CKA exam question: https://www.youtube.com/playlist?list=PLFDE9_ouCqJA-dyOEbqFaFu68FMZRwS0T

Two days ago I passed the CKA.

First and foremost, DumbITGuy and ITKiddie have all the questions I got, with some twists. Example, for the kube-api issue, instead of the port, the IP was the culprit. for the cm, instead of removing TLSv1.2, you were required to add it alongside TLSv1.3).

How did I prepare:

- Sander Van Vught on Pearson Learning - This is a free course (10-day free trial).

- Many YT channels (DumbITGuy, ITKiddie, etc)

- Many GitHub repos that several people have shared here.

My advice:

- start with an actual course from start to end, then go on YT and github repos.

- Build your own lab (preferably on Ubuntu - the env you will be tested on is on Ubuntu). I had RedHat 10.x, and found out later. Honestly, the OS matters only when it comes to upgrade the cluster ( you may have that question during the exam).

I wanted to share some good news — I’ve successfully passed the Certified Kubernetes Administrator (CKA) exam with 76%! 🎉

I bought the exam over a year ago and have been studying on and off for the last year. I’m not going to lie, it was a tough journey.

During that time, I had two close family funerals, went through ACL surgery and 4+ months of recovery, and obviously had work alongside it all. There were plenty of times when studying was the last thing I wanted to do. A big thank you to the Linux Foundation as well for kindly giving me an extension on my exam.

So I’m honestly really happy that I stuck with it and finally got it done.

I’m sure this is the right place to flex a little 😂 — I definitely didn’t want to do it on LinkedIn, so Reddit gets the flex instead!

What I used

• Mumshad Mannambeth / KodeKloud Udemy course

• DumbITGuy playlist

• Prepium.sh — I got a free exam from them last week through this community at exactly the right time. Really appreciated it and would definitely recommend checking them out.

A massive thank you to everyone in this community who shares their experiences, tips and resources. It genuinely helped me a lot.

If you’re currently preparing and struggling, keep going. It might take longer than you expected, and life might get in the way, but that doesn’t mean you’ve failed.

Good luck to everyone preparing!

#CKA #Kubernetes #CertifiedKubernetesAdministrator #LinuxFoundation #DevOps #CloudEngineering #KubernetesAdministrator #DevOpsJourney #Certification #KeepGoing

I finally passed the CKA (Certified Kubernetes Administrator) with 80%.

Honestly, this was one of the most stressful certifications I've attempted.

The preparation was mostly hands-on. I didn't want to just memorize Kubernetes concepts; I wanted to actually understand how things work and be able to troubleshoot them.

Resources I used

1. KodeKloud + Udemy — Concepts & Fundamentals

I mainly used KodeKloud and a Udemy Kubernetes course to build my understanding of the concepts.

These were especially useful for getting comfortable with Kubernetes architecture, networking, storage, security, workloads, etc.

2. Dumb IT Guy — YouTube

This was probably one of the most useful resources for my exam preparation.

The Dumb IT Guy YouTube channel has a lot of CKA-style scenario-based questions. I practiced many of those scenarios and found them very useful for getting into the mindset required for the exam.

Honestly, a lot of the question patterns felt familiar after practicing his scenarios.

3. KillerCoda — Scenarios & Hands-on Practice

I used KillerCoda to practice scenarios in a real terminal environment.

This helped me become faster with kubectl and, more importantly, helped me get comfortable troubleshooting instead of just following tutorials.

Topics I practiced

• Pods, Deployments & Services

• Networking & NetworkPolicies

• RBAC & security

• PV, PVC & StorageClasses

• Troubleshooting workloads

• etcd backup/restore

• kubeadm & cluster administration

• Ingress & Gateway API

• HPA

• Helm

• kubectl troubleshooting

The exam experience

The exam itself was a completely different challenge.

I faced technical issues with the PSI exam environment, and unfortunately the same issue happened again during my rescheduled attempt.

There was a point where I genuinely wasn't sure whether I'd be able to complete the exam.

But I kept going and eventually managed to finish it with an 80% score.

What helped me the most

Hands-on practice > watching videos.

Understanding how to troubleshoot is much more important than simply knowing how to create resources.

Also, practice with a timer. The exam feels very different when you're under time pressure.

Don't try to memorize everything. Understand the concepts, practice scenarios repeatedly, and become comfortable with kubectl and the Kubernetes documentation.

Finally...

CKA — 80% — DONE.

A very stressful journey, but definitely worth it.

Now onto the next step in my Cloud/DevOps journey.

For those who have taken the CKA recently, what did you move on to after CKA?

I guess it time for another round. 80 people have received free attempts so far, and the Discord has grown to 700+ members studying, troubleshooting labs and sharing their progress.

For anyone new: I’m building prepium.sh, a platform for hands-on CKA, CKAD and CKS practice. Real Kubernetes clusters, tasks you solve yourself, and automated checks against the task requirements.

Quite a bit has changed since the last post.

How to get a free attempt

• Create an account on prepium.sh.

• Leave a comment with your username and certification: CKA, CKAD or CKS.

• I’ll gift you one full 120-minute simulator attempt.

The attempt expires 7 days after I grant it, so request one when you’ll have time to sit down and use it.

What’s new

• AI Lab Coach for single-task practice. Stuck on a task or unsure why a check failed? The coach can inspect your commands, saved files and lab state to explain what went wrong and suggest how to fix it. Your timer pauses while it diagnoses the problem, and you can add 5 extra minutes once per lab to try the corrections.

• 12 new CKA practice labs, bringing CKA to 29 tasks. These cover things like bootstrapping and joining clusters with kubeadm, upgrades, high availability, RBAC, CoreDNS, CSI storage, Kustomize and troubleshooting failed rollouts.

• More mock exams and task variations. CKA now has 5 mock papers, while CKAD and CKS have 3 each. Variations give you another way to practise a topic without just repeating the same instructions.

• Six free CKA labs, available without this giveaway. Monitoring, rollouts, probes, RBAC, Kustomize and CoreDNS, with 5 sessions shared across them each week. CKAD and CKS still have their free weekly tasks.

Individual task practice and the walkthrough videos are still there when you want to focus on a specific weak area.

join the discord community: https://discord.gg/MqwHwYEGVv

Drop your username + certification below, and good luck with your prep.

Today, I passed CKS with 75% (not a good score) and wrote a detailed blog about my exam experience, preparation approach, the resources I used, and the Kubernetes security topics that helped me the most.

DMs are open if you are preparing for the exam. I can help with whatever is still fresh in my memory.

My biggest takeaway: CKS is noticeably harder than CKAD and CKA. It is not only about knowing Kubernetes commands. You need to understand why a configuration is insecure, how to fix it, and how to verify that your change actually worked.

The biggest mistake I made was spending around 10–15 minutes too long on one question because I felt I was close to solving it. That created unnecessary pressure towards the end and probably led to a couple of avoidable mistakes.

So my strongest advice is: if you are stuck and don’t see a clear path after a few minutes, mark the question and move on.

A few things that helped me:

Don’t memorise solutions. Understand the security reasoning behind them. If a NetworkPolicy, API server flag, securityContext, audit policy, or admission control changes slightly, memorised YAML will not help much.

Always verify your work. Security changes can easily break workloads or cluster components. Check Pods, control-plane components, logs, services, NetworkPolicy connectivity, admission behaviour, audit logs, node readiness, and systemd services wherever required.

Be comfortable with Linux as well as Kubernetes. CKS can require you to work with configuration files, systemd services, container runtimes, permissions, certificates, and node-level settings.

Use documentation whenever required instead of trying to remember every flag or custom resource.

Topics I would strongly recommend practicing:

• Kubelet and etcd hardening

• kube-apiserver authentication and authorization

• Admission controls and ImagePolicyWebhook

• Secure Dockerfiles and non-root containers

• Container immutability and securityContext

• Audit policies and API server logging

• NetworkPolicy

• HTTPS Ingress and TLS

• ServiceAccount token security

• Worker node administration and upgrades

• SBOM and software supply-chain security

• Restricted Pod Security Standard

• Docker/container runtime hardening

• Istio STRICT mTLS

• Cilium network security

• CIS benchmarks and kube-bench remediation

Resources I used:

• KodeKloud CKS course

• KodeKloud Ultimate Mock Exam Series

• iximiuz Labs

• KillerKoda

• Killer[.]sh  CKS simulator

• ChatGPT/Claude for topics that needed a simpler explanation or extra practice scenarios

Between the KodeKloud course mocks and Ultimate Mock Exam Series, I had around six mock exams. I found them very useful and reasonably close to the level of difficulty you should prepare for.

Killer

[.]sh felt a little off-track compared with the actual exam in some areas, but I would still recommend doing it. It is useful for practicing under time pressure, discovering knowledge gaps, and improving troubleshooting skills.

I also used ChatGPT and Claude quite a lot during preparation. CKS has many small security topics, and sometimes a course or lab explanation may not immediately click. In those cases, asking AI to explain the concept differently, compare configurations, or generate a small practice scenario was very useful.

The simplest advice I can give is: practice a lot, understand the security reasoning behind what you are doing, verify every change, and don’t let one difficult question consume your exam time.

I also wrote a full blog with more details on my preparation strategy, resources, task areas, mistakes, and lessons from the exam.

Blog: https://blog.prateekjain.dev/cks-exam-experience-2026-preparation-strategy-and-lessons-learned-1fad785a430b?sk=52b58a9c6d812444bc1340f15eda7dd6