- What Is the CKA Certification?
- Exam Format, Fees, and Registration Mechanics
- The Five CKA Exam Domains
- What the Exam Actually Looks Like
- Open-Resource Rules: What You Can and Cannot Use
- Who Hires CKA-Certified Professionals?
- A Domain-Driven Preparation Roadmap
- Certification Validity and Renewal
- Frequently Asked Questions
- The CKA exam costs $445, includes one free retake, and must be scheduled within 12 months of purchase.
- All 15-20 tasks are performance-based, solved entirely from a Linux command line in 2 hours.
- Troubleshooting is the largest domain at 30%-neglecting it is the most common preparation mistake.
- The exam is open-resource, but only to approved documentation inside the exam VM-no external searches.
What Is the CKA Certification?
The Certified Kubernetes Administrator (CKA) is the industry's definitive credential for professionals who deploy, manage, and troubleshoot Kubernetes clusters in production. Created by the Cloud Native Computing Foundation (CNCF) in collaboration with The Linux Foundation, the CKA verifies that a candidate can do real Kubernetes work-not just recall facts about it.
Unlike multiple-choice certifications, the CKA is entirely performance-based. You are placed inside a live Linux environment and asked to complete tasks against real Kubernetes clusters. That distinction is what makes the credential meaningful to hiring managers, and it is why preparing for the CKA demands a fundamentally different approach than studying for a written exam.
If you are still exploring whether this path fits your career goals, our article on Is the CKA Certification Worth It? Complete ROI Analysis 2026 walks through the return on investment in detail. For a broader orientation to the credential, see What Is CKA Certification?
Exam Format, Fees, and Registration Mechanics
Understanding the purchasing and scheduling mechanics before you register saves money and prevents avoidable stress.
Cost and What Is Included
The exam-only fee is $445. That purchase includes:
- Two exam attempts (one free retake if you do not pass on the first try)
- 12 months to schedule from the date of purchase
- Two Killer.sh simulator sessions-unless you purchase through a single-exam SKU that explicitly excludes them
The Killer.sh sessions are genuinely valuable because the simulator's tasks are notoriously harder than the real exam. Treating each session as a full mock exam under timed conditions is one of the highest-leverage preparation moves available. For a complete breakdown of bundling options, discount timing, and total cost-of-preparation, see our CKA Certification Cost 2026: Complete Pricing Breakdown.
Delivery Platform
The exam is delivered online through The Linux Foundation's certification platform using PSI Bridge/Secure Browser remote proctoring. You will need a stable internet connection, a webcam, and a clean workspace. The browser locks down your environment before the exam begins, and a proctor monitors the session throughout.
Kubernetes Version
Version information from The Linux Foundation is currently conflicting: the product page lists Kubernetes v1.34 while the FAQ lists the environment as Kubernetes v1.35. The FAQ also states the environment is updated to align with the latest Kubernetes minor release within approximately 4-8 weeks of its release. Always verify the FAQ directly before scheduling. The specific version matters because API deprecations and feature gates change between minor releases.
The Five CKA Exam Domains
The CKA curriculum is divided into five weighted domains. Mastering these domains-not generic Kubernetes knowledge-is the frame around which all preparation should be organized. Our CKA Exam Domains 2026: Complete Guide to All 5 Content Areas covers every competency in detail.
Domain 1: Cluster Architecture, Installation & Configuration (25%)
The second-largest domain. Candidates must be able to bootstrap clusters with kubeadm, manage RBAC, configure kubeconfig files, and work with etcd-including backups and restores.
- kubeadm init, join, and upgrade workflows
- etcd snapshot backup and restore procedures
- RBAC: ClusterRoles, RoleBindings, ServiceAccounts
- Highly available control plane concepts
Domain 2: Workloads & Scheduling (15%)
Covers how applications run inside the cluster. Candidates must deploy and manage Deployments, understand rollout strategies, and control how the scheduler places Pods.
- Deployments, DaemonSets, StatefulSets, Jobs, CronJobs
- Resource requests and limits
- Node affinity, taints, tolerations, and Pod topology spread
- ConfigMaps and Secrets as environment variables and volume mounts
Domain 3: Services & Networking (20%)
Networking is the domain that surprises candidates most. Understanding how traffic flows inside and outside a cluster is essential, and the exam now includes Gateway API tasks.
- ClusterIP, NodePort, LoadBalancer, and ExternalName services
- Ingress controllers and Ingress resources
- Gateway API (CKA-specific approved documentation is available in-exam)
- NetworkPolicy for Pod-level traffic control
- CoreDNS behavior and service discovery
Domain 4: Storage (10%)
The smallest domain, but storage tasks carry full marks. Candidates must provision and bind persistent storage and understand the StorageClass lifecycle.
- PersistentVolumes (PV) and PersistentVolumeClaims (PVC)
- StorageClasses and dynamic provisioning
- Mounting volumes into Pods (emptyDir, hostPath, PVC-backed)
- Access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany
Domain 5: Troubleshooting (30%)
The largest domain and the one most candidates underinvest in. Real-world debugging skills-not theoretical knowledge-determine the result here. Expect broken clusters, failing nodes, and misconfigured workloads.
- Diagnosing and fixing failing Pods and Deployments
- Node NotReady conditions and kubelet failures
- Control plane component failures (API server, scheduler, controller-manager)
- Networking connectivity issues between Pods and Services
- Log analysis: kubectl logs, journalctl, crictl
Individual deep-dive study guides are available for each domain: Domain 1: Cluster Architecture, Installation & Configuration, Domain 2: Workloads & Scheduling, Domain 3: Services & Networking, and Domain 4: Storage.
What the Exam Actually Looks Like
The CKA contains approximately 15-20 performance-based tasks. Each task is presented as a practical problem statement-something like "create a NetworkPolicy that restricts ingress to Pod X from only Pods in namespace Y" or "restore the etcd cluster from the snapshot located at /data/etcd-snapshot.db." You solve it from a Linux terminal in the exam VM.
Partial Credit and Task Weighting
Tasks are not equally weighted. The exam interface displays the point value of each task, and partial credit is possible within individual tasks. The passing score is 66%. That means you do not need to complete every task perfectly-but you do need to move efficiently, because 2 hours passes faster than most candidates expect when working with real clusters.
Multiple Cluster Contexts
Each task specifies which cluster context to use. The exam environment contains multiple clusters, and every task begins with a kubectl config use-context command pre-populated in the instructions. Forgetting to switch contexts before working is one of the most common-and most costly-execution errors candidates make.
For an honest assessment of where most candidates struggle and why, our How Hard Is the CKA Exam? Complete Difficulty Guide 2026 lays out the specific difficulty factors in detail.
Open-Resource Rules: What You Can and Cannot Use
The CKA is an open-resource exam-but only within specific boundaries that are strictly enforced by the proctor.
What Is Permitted
- Kubernetes documentation at kubernetes.io/docs
- Kubernetes Blog at kubernetes.io/blog
- Helm documentation at helm.sh/docs
- Task-specific documentation identified in task instructions
- CKA Gateway API documentation (specific to CKA tasks)
- Terminal instructions and /usr/share documents and packages within the exam VM
What Is Not Permitted
- External search engines or search results
- Personal notes, bookmarks, or third-party sites
- Any browser tabs not on the approved domains listed above
This structure means preparation must include learning to navigate the official Kubernetes documentation efficiently under pressure. Knowing which page contains the etcd backup procedure or the NetworkPolicy example is just as important as knowing the concepts themselves. Practicing with CKA Exam Prep practice tests helps you internalize which topics require documentation lookups and which you should execute from memory.
Who Hires CKA-Certified Professionals?
The CKA has become a hiring signal across a wide spectrum of organizations-not only cloud-native startups. Enterprise organizations running Kubernetes in regulated environments (finance, healthcare, government) actively recruit CKA holders because the credential verifies hands-on cluster administration capability rather than general cloud knowledge.
Roles that commonly list CKA as a requirement or strong preference include:
- Kubernetes Administrator / Platform Engineer - managing cluster infrastructure, upgrades, and RBAC policies
- Site Reliability Engineer (SRE) - owning uptime and troubleshooting production incidents in containerized environments
- DevOps / Cloud Engineer - building CI/CD pipelines that deploy to Kubernetes clusters
- Solutions Architect - designing Kubernetes-based infrastructure for enterprise clients
For a thorough look at the roles, industries, and compensation ranges associated with this credential, see our CKA Salary Guide 2026: Complete Earnings Analysis and CKA Jobs.
A Domain-Driven Preparation Roadmap
Generic study schedules do not work for the CKA because the exam is skills-based. The structure below sequences domains by dependency and allocates time proportional to exam weight.
Cluster Architecture, Installation & Configuration (Domain 1, 25%)
- Bootstrap a cluster from scratch with kubeadm on two VMs
- Practice etcd backup and restore until the procedure is automatic
- Create ClusterRoles, Roles, and RoleBindings for various scenarios
- Upgrade a cluster from one minor version to the next using kubeadm
Workloads & Scheduling + Storage (Domains 2 & 4, 25% combined)
- Deploy Deployments, StatefulSets, DaemonSets, and CronJobs imperatively
- Configure resource requests/limits and observe scheduler behavior
- Create PVs, PVCs, and StorageClasses; mount them into Pods
- Practice node affinity and taint/toleration scenarios
Services & Networking (Domain 3, 20%)
- Create every Service type and verify connectivity with kubectl exec
- Write NetworkPolicies from scratch; test them with curl from inside Pods
- Deploy an Ingress controller and configure routing rules
- Explore Gateway API resources using the exam-approved documentation
Troubleshooting (Domain 5, 30%) - The Longest Phase
- Intentionally break clusters and practice diagnosing them (stop kubelet, corrupt manifests)
- Practice node NotReady recovery end-to-end under a 10-minute timer
- Use journalctl, crictl, and kubectl describe together on every problem
- Complete both Killer.sh simulator sessions; review every missed task
Because Troubleshooting carries 30% of the exam and draws on every other domain, it benefits from spaced repetition-revisit broken-cluster scenarios from Week 1 scenarios again in Week 5. Allocating two full weeks to Troubleshooting is not excessive; it reflects the actual exam weight.
For a fully detailed week-by-week study plan with resource recommendations, see our CKA Study Guide 2026: How to Pass on Your First Attempt. You can also reinforce your command-line fluency with CKA Exam Prep practice tests, which mirror the task format of the real exam.
Key Takeaway
Domain 5 (Troubleshooting) is worth nearly one-third of your total score. Candidates who treat it as an afterthought-spending 80% of their prep on Domains 1-4-are structurally disadvantaged before they even open the exam terminal.
Certification Validity and Renewal
| Detail | CKA Specifics |
|---|---|
| Validity Period | 2 years (credentials earned after April 1, 2024) |
| Renewal Method | Retake and pass the exam before expiration |
| Issuing Body | CNCF / The Linux Foundation |
| Exam Attempts | 2 (included with $445 purchase) |
| Passing Score | 66% |
| Exam Duration | 2 hours |
| Prerequisites | None (hands-on Kubernetes/Linux experience strongly recommended) |
The two-year validity window is shorter than some professional certifications, which reflects how quickly Kubernetes itself evolves. Kubernetes minor releases arrive approximately every four months, and the exam environment is updated to align with the latest minor release within roughly 4-8 weeks. Staying current with Kubernetes between certification cycles is practical professional development-not just a renewal requirement.
There are no formal prerequisites to register. However, attempting the CKA without hands-on Kubernetes experience, Linux command-line fluency, and comfort reading and writing YAML is a path to a failed first attempt. The free retake is a safety net, not a substitute for preparation.
Frequently Asked Questions
The CKA contains approximately 15-20 performance-based tasks. Each task is a practical problem solved from a Linux terminal against a live Kubernetes cluster. There are no multiple-choice questions.
The passing score is 66%. Tasks are weighted differently, and partial credit is possible within individual tasks. You do not need to complete every task perfectly to pass.
No. The exam is open-resource, but only to approved documentation inside the exam VM-primarily kubernetes.io/docs, kubernetes.io/blog, helm.sh/docs, and task-specific resources. External search engines and results are not permitted.
Troubleshooting (Domain 5) carries 30% of the exam-the largest single domain-and should receive the most preparation time. Cluster Architecture, Installation & Configuration (Domain 5) is second at 25%. Many candidates make the mistake of under-investing in Troubleshooting because its tasks feel less "learnable" than configuration tasks.
CKA credentials earned after April 1, 2024 are valid for 2 years. Renewal requires retaking and passing the exam before the credential expires. There is no continuing education path-only reexamination.