CKA Exam Preparation Checklist

You are ready for the Certified Kubernetes Administrator (CKA) exam when you can complete realistic cluster-administration tasks from a bare terminal, under time pressure, without pausing to think about syntax. This checklist exists to test exactly that. Work through it honestly: every unticked box is a task the exam can hand you, and the CKA — a two-hour, performance-based exam run by the Cloud Native Computing Foundation (CNCF) and the Linux Foundation — gives you no multiple-choice questions to hide behind.

This article is deliberately narrow. It is a readiness audit, not a study plan — if you still need a week-by-week route to this point, follow the step-by-step guide on how to prepare for the CKA exam. And if you are still weighing up whether the exam suits your role at all, the full Certified Kubernetes Administrator guide covers format, cost and registration in one sentence more than we will here.

First, confirm you are preparing for the right exam version

As of 2026, the CKA runs on Kubernetes v1.35, and the Linux Foundation updates the exam environment to the newest minor version within four to eight weeks of each Kubernetes release. Check the version listed on the official exam page before your final fortnight, because a version bump can shift small behaviours you have memorised.

More importantly, confirm your study materials post-date 18 February 2025. The curriculum was revised on that date: the five domains stayed, but the competencies changed. If your course or notes are older, tick these gaps off explicitly:

• [ ] Gateway API tasks, alongside (not instead of) Ingress
• [ ] Helm and Kustomize for installing and templating workloads
• [ ] Configuring and troubleshooting CRI, CSI and CNI integrations
• [ ] Dynamic volume provisioning with StorageClasses
• [ ] Pod Security Standards (Pod Security Policies are gone — they were removed from Kubernetes itself)

Anything teaching PSPs as exam content is a red flag that the material is stale.

The hands-on skills checklist, domain by domain

The domain weights below are the provider's own as of 2026. Audit yourself in weight order — troubleshooting alone is worth almost a third of your score, so weakness there costs more than weakness anywhere else.

Troubleshooting (30%)

• [ ] Diagnose a Pod stuck in Pending, CrashLoopBackOff or ImagePullBackOff using kubectl describe and kubectl logs, and fix the underlying cause
• [ ] Bring a NotReady node back: check kubelet status and logs with systemctl and journalctl, restart the service, verify the node rejoins
• [ ] Troubleshoot a control-plane failure by inspecting static Pod manifests under /etc/kubernetes/manifests/
• [ ] Trace a Service that is not routing traffic: endpoints, selectors, targetPort mismatches, NetworkPolicy interference
• [ ] Investigate CRI, CSI and CNI faults — for example, a node whose container runtime socket is misconfigured or whose CNI plugin has not deployed
• [ ] Read resource metrics (kubectl top) to find a starved workload

Cluster architecture, installation and configuration (25%)

• [ ] Initialise a cluster with kubeadm init, join a worker with kubeadm join, and explain what each step created
• [ ] Perform a kubeadm version upgrade on a control-plane node and a worker, in the right order, with drain and uncordon
• [ ] Back up and restore etcd with etcdctl, supplying the correct certificates from memory of where they live
• [ ] Create Roles, ClusterRoles and their bindings, and verify access with kubectl auth can-i
• [ ] Install a workload with Helm and customise one with Kustomize
• [ ] Manage certificates and kubeconfig contexts without hesitation

Services and networking (20%)

• [ ] Create ClusterIP, NodePort and headless Services and predict how each resolves in DNS
• [ ] Expose an application through Ingress with host- and path-based rules
• [ ] Configure a Gateway API Gateway and HTTPRoute — the post-2025 addition candidates most often skip
• [ ] Write a NetworkPolicy that permits only named traffic, and test that it actually blocks the rest
• [ ] Debug CoreDNS when Pods cannot resolve Service names

Workloads and scheduling (15%)

• [ ] Create and roll back Deployment revisions; pause and resume a rollout
• [ ] Scale manually and configure resource requests and limits that make scheduling behave as intended
• [ ] Steer Pods with nodeSelectors, affinity rules, taints and tolerations
• [ ] Use ConfigMaps and Secrets as environment variables and mounted volumes
• [ ] Apply Pod Security Standards at namespace level

Storage (10%)

• [ ] Create a PersistentVolume and PersistentVolumeClaim and bind them deliberately (access modes, capacity, StorageClass)
• [ ] Configure dynamic provisioning via a StorageClass
• [ ] Mount a claim into a Pod and prove data survives a Pod restart

If you ticked fewer than roughly nine in every ten boxes, stop here and return to the prep plan before booking anything.

Speed and workflow: the checklist most candidates skip

Knowing how to do a task is half of readiness; doing it fast enough is the other half. The exam lasts two hours, and while the Linux Foundation does not publish the live exam's task count, its included killer.sh simulator presents 17 questions per attempt — a fair signal of the pace expected. Time pressure, not difficulty, is what the exam is really testing, as the honest assessment in how hard the CKA exam is explains.

• [ ] You generate YAML imperatively (kubectl run, kubectl create deployment ... --dry-run=client -o yaml) instead of writing manifests from scratch
• [ ] You use kubectl explain to recall field names rather than guessing
• [ ] Aliases and shell completion are second nature (the exam terminal typically has completion available; practise as if it does and can cope if it does not)
• [ ] You switch contexts and namespaces at the start of every task, every time — wrong-cluster answers score zero
• [ ] You can navigate the official Kubernetes documentation quickly, because the exam's allowed-resources rule permits specified official docs inside the exam environment; read the candidate handbook for the current list rather than assuming
• [ ] You skip and flag a task that is eating time, and return to it — no single task is worth ten minutes of paralysis
• [ ] In a full timed practice run you finish with at least ten minutes to spare

A useful benchmark: run a timed, exam-length session and score it as the exam would — the pass mark is 66%, per the Linux Foundation's candidate FAQ. Scoring comfortably above that on unfamiliar tasks, twice in a row, is a stronger readiness signal than any number of tutorial completions. A structured way to do this is a timed CKA practice test, reviewed afterwards for which domain produced the dropped marks.