CKA Study Guide 2026: Pass Certified Kubernetes Administrator in 6 Weeks

The CKA is the cert that opens Kubernetes job doors. Not Kubernetes-curious, not Kubernetes-comfortable — Kubernetes-employable. This guide is the plan I wish I had: 6 weeks, real lab work, the exact kubectl muscle memory, and the exam-day decisions that protect your score.

Why CKA Is Still the #1 Kubernetes Cert in 2026

Three years after the cloud-native gold rush slowed, the CKA still sits at the top of Kubernetes hiring filters. Two reasons: it is performance-based (you cannot fake it), and it is owned by the Linux Foundation / CNCF (the same body that owns Kubernetes itself). When a hiring manager sees CKA on a CV, they trust it.

The numbers in 2026 are flattering. Median total compensation for a CKA-holding Kubernetes engineer in the US sits around $125,000-$165,000 depending on region and seniority — about 18-25% above an equivalent generalist SRE without the cert. The exam costs $445 with one free retake, which makes it the cheapest credential-to-salary uplift in the cloud-native space.

Validity is two years. Renewal is via re-exam (no CEU treadmill), which most engineers consider a feature — you stay sharp, the cert stays trustworthy. The 2026 curriculum tracks Kubernetes v1.30+, with kustomize, Gateway API, and modern CNI choices like Cilium now first-class topics.

If you want the broader picture of how CKA fits with CKAD and CKS, see our Kubernetes Certifications Guide. If you are deciding CKA vs the developer-focused track, our CKA vs CKAD comparison covers the trade-offs.

CKA Exam Format

The CKA is a 2-hour, performance-based exam delivered through PSI's online proctoring platform. You connect to a live cluster (or sometimes 6-8 small clusters) and complete 15-20 tasks by typing real kubectl commands and editing YAML in a remote Linux terminal. There is no multiple choice. There are no fill-in-the-blank questions. You either fix the broken thing, or you do not.

The pass mark is 66%. Linux Foundation does not publish per-task scoring, but task weights are listed at the start of each item (typically 4-13%). Skip a hard 4% task, do not skip a 13% task — that is the strategy in one sentence.

Allowed during the exam: a single tab to kubernetes.io/docs, kubernetes.io/blog, and github.com/kubernetes. Local notes, second monitors, smartwatches, and even a glass of water with a label are forbidden. Read the candidate handbook before exam day — the proctor will fail you for room-setup issues, not for kubectl mistakes.

Two huge perks are included in the $445: one free exam retake within 12 months, and two killer.sh simulator attempts (worth about $25 standalone). Both move the effective pass rate well above the first-attempt number.

The 5 CKA Domains, Weighted

The 2026 curriculum is split across five domains. Memorise the weights — they tell you exactly where to invest your study hours.

1. Cluster Architecture, Installation, and Configuration — 25%

The heaviest "knowledge" domain. Covers RBAC (roles, cluster-roles, role-bindings, service accounts), kubeadm cluster installation, etcd backup and restore (high-stakes, high-frequency exam topic), cluster upgrades (one minor version at a time), High Availability control plane patterns, and packaging tools (kustomize, Helm).

2. Workloads and Scheduling — 15%

Deployments, ConfigMaps, Secrets, scaling (manual and HPA basics), declarative manifests, rolling updates, self-healing primitives (probes, restarts), node affinity, taints and tolerations, and resource limits / requests.

3. Services and Networking — 20%

Pod-to-pod, pod-to-service, and ingress traffic patterns. ClusterIP / NodePort / LoadBalancer / ExternalName service types. Ingress controllers (nginx is the exam default). CoreDNS configuration. CNI plugin selection (you do not install one in the exam — but you should know what is already there). NetworkPolicies appear as a small but tricky topic.

4. Storage — 10%

StorageClasses, PersistentVolumes, PersistentVolumeClaims, dynamic provisioning, access modes (ReadWriteOnce vs ReadWriteMany vs ReadOnlyMany), and reclaim policies (Retain vs Delete vs Recycle). Smallest domain, but easy points if you have practiced the YAML.

5. Troubleshooting — 30%

The largest domain and the one that decides pass/fail for most candidates. Cluster-level logging, node failure investigation, monitoring cluster components and applications, services / networking troubleshooting (DNS, endpoints, kube-proxy). Expect to run journalctl -u kubelet, crictl ps, kubectl describe pod, and kubectl logs --previous from muscle memory.

The 6-Week Study Plan

Six weeks at roughly 12-15 hours per week. Adjust to your background: senior Linux admins can compress to 4 weeks; total Kubernetes newcomers should stretch to 8.

Week 1: Lab Setup + kubectl Fluency

The non-negotiable first week. You need a real cluster on your machine. Two options:

• minikube — single-node, easiest start, supports add-ons (Ingress, metrics-server).
• kind (Kubernetes IN Docker) — multi-node clusters in seconds, closer to exam topology.

Set up your shell: alias k=kubectl, source <(kubectl completion bash), complete -F __start_kubectl k, and export do='--dry-run=client -o yaml'. By Friday you should be running k run nginx --image=nginx $do > pod.yaml without thinking. If you still type kubectl get pods --all-namespaces in full, you will run out of time on the real exam.

Week 2: Cluster Architecture (25%)

Install a real cluster with kubeadm in 3 Vagrant or multipass VMs. Practice kubeadm init, kubeadm join, and a full kubeadm upgrade. Do at least 5 etcd backup-and-restore cycles — this is the most common high-weight task and the one candidates fumble under pressure. Build a complete RBAC chain: ServiceAccount → Role → RoleBinding, then verify with kubectl auth can-i.

Week 3: Workloads & Scheduling (15%)

Deployments, rolling updates, rollbacks. ConfigMaps and Secrets injected as env vars and as mounted volumes. Manual scaling and HPA. Liveness, readiness, and startup probes. Node affinity, taints, and tolerations — especially the difference between NoSchedule and NoExecute. Write every manifest from scratch using --dry-run=client -o yaml; do not copy-paste from the web.

Week 4: Networking & Storage (30%)

Services of every type. Ingress with the nginx controller in your lab. CoreDNS troubleshooting (edit the Corefile, restart, verify with kubectl run -i --rm --restart=Never dnsutils --image=nicolaka/netshoot -- nslookup kubernetes). NetworkPolicies with default-deny then explicit allow rules. PersistentVolumes / PersistentVolumeClaims with three different access modes. StorageClass with volumeBindingMode: WaitForFirstConsumer.

Week 5: Troubleshooting (30%) — The Big One

Spend a full week here. Deliberately break your lab cluster and fix it: kill the kubelet, corrupt kubeconfig, wrong image tag, mis-typed selector, OOMKilled pod, CrashLoopBackOff, FailedScheduling on a tainted node. Drill the troubleshooting toolkit: kubectl describe, kubectl logs --previous, kubectl events --watch, kubectl debug node/<name> -it --image=ubuntu, journalctl -u kubelet --since "5 minutes ago", crictl ps, crictl logs.

Week 6: Killer.sh + Full Mock + Weak-Area Polish

Burn one killer.sh attempt early in the week under exam conditions: 2 hours, single monitor, no notes. Score honestly. The simulator runs 15-20% harder than the real exam, so even a 55% suggests you are within striking distance. Spend the rest of the week patching the weakest 3 topics. Burn the second killer.sh attempt 48 hours before the exam — you want the muscle memory hot, not cold.

Killer kubectl Shortcuts Every CKA Needs

The exam is won or lost on terminal speed. Learn these cold:

• alias k=kubectl + complete -F __start_kubectl k — the single biggest time-saver. Set it in the first 30 seconds of the exam.
• export do='--dry-run=client -o yaml' — generates valid YAML for any resource. k create deploy web --image=nginx $do > deploy.yaml beats writing the apiVersion / kind / spec block by hand.
• export now='--grace-period=0 --force' — for fast pod deletion when you need a redo.
• kubectl explain deployment.spec.strategy — the in-cluster documentation. Faster than tabbing to the docs site for a field name.
• kubectl debug — k debug node/node01 -it --image=ubuntu for node-level investigation; k debug pod/web -it --copy-to=web-debug --image=busybox for ephemeral debug containers.
• kubectl events --watch — the replacement for kubectl get events -w with better defaults.
• vim setup — add to ~/.vimrc on day one: set nu et ts=2 sw=2 ai. Line numbers, expand tabs, 2-space indent, auto-indent. Editing YAML without these is painful.
• kubectl config use-context — every task lists the cluster context. Switch before you start typing. Working in the wrong cluster is the silent killer.
• k get po -A -o wide --show-labels — the troubleshooting one-liner. Namespace, node, IP, and labels in one view.
• kubectl run tmp --rm -it --image=busybox --restart=Never -- sh — the disposable pod for quick network / DNS tests.

Exam-Day Strategy

Tactics matter as much as knowledge. Here is the playbook:

• Read all 17 tasks first (5 minutes). Note the weight of each. Flag any task that looks like a 15-minute time-sink for the end.
• Always run kubectl config use-context first. The proctor environment switches you between multiple clusters. One mis-targeted k delete and you have broken something graded.
• Set alias k=kubectl and the $do alias in task 1. Once. They carry across the whole exam.
• Open kubernetes.io/docs in the allowed tab and pin the four most-used pages: Concepts → Workloads, Concepts → Services / Networking / Ingress, Tasks → Configure RBAC, Reference → kubectl cheatsheet.
• Never debug a task for more than 10 minutes. If you are stuck, mark it, move on, come back. A 4% task is not worth losing a 13% one to the timer.
• Verify after every change. k get, k describe, k logs. If the task said "deploy nginx with 3 replicas," running k get deploy takes 2 seconds and saves a wrong-answer bullet.
• Save 15 minutes at the end for the flagged tasks and a final verification pass.

Most-Failed CKA Topics

From thousands of post-exam debriefs, these are the topics that bite even prepared candidates:

• etcd backup & restore — the command syntax is unforgiving. Drill the exact flags: --endpoints, --cacert, --cert, --key, and the difference between snapshot save and snapshot restore --data-dir.
• ServiceAccount + RBAC chain — many candidates can write a Role but forget the RoleBinding subject must reference the ServiceAccount namespace.
• Kustomize — kubectl apply -k with overlays. New to the CKA in recent updates; lots of candidates skip it in study and pay on exam day.
• Taints and tolerations — especially the syntax inside a Pod spec; easy to miss the operator: "Exists" form.
• Ingress setup — getting the controller running, the path rules right, and verifying with curl all under time pressure.

Recommended Resources & Next Steps

The shortlist that actually works in 2026:

• KodeKloud CKA course — Mumshad Mannambeth's course is the gold standard. Pair it with the in-browser KodeKloud labs.
• killer.sh simulator — two attempts ship with your exam fee. Use them.
• kubernetes.io/docs — read it during study, not just on exam day. Knowing the navigation saves real time.
• ExamCert CKA practice — our free AI-generated CKA scenario questions reinforce concepts between lab sessions.
• The CKS path — once you pass, the Certified Kubernetes Security Specialist is the natural next step. See our CKS exam tips.

Frequently Asked Questions

How hard is the CKA exam?

Moderate. 15-20 hands-on tasks in 2 hours with 30% weighted on troubleshooting. The challenge is time, not knowledge. Pass rate ~65-70%.

How much does CKA cost in 2026?

$445 USD via Linux Foundation including one free retake within 12 months. Bundle pricing sometimes available.

Do I need CKAD before CKA?

No. They are independent. Many start with CKA because cluster admin questions are broader. If you build apps for K8s, CKAD may feel more natural first.

Is killer.sh worth it for CKA?

Yes — two free attempts come with your $445 exam. Killer.sh scores typically run 15-20% lower than the real exam, so 65% on killer.sh ≈ pass.

What kubectl version is on the CKA exam?

v1.30 in 2026. Linux Foundation updates each cycle — verify on the official handbook before booking.