The Certified Kubernetes Administrator is a performance-based exam from the Linux Foundation and CNCF. It's one of the few major certifications where you work entirely in a live environment rather than answering multiple choice questions. That format fundamentally changes what preparation looks like and what makes it hard.
The Short Answer
The CKA is hard. Not because the Kubernetes concepts are impossibly complex, but because the performance-based format under time pressure exposes gaps that multiple choice exams don't. You need to solve real problems in a live cluster within a tight time limit, using only the Kubernetes documentation as a reference. Candidates who can describe Kubernetes concepts but haven't practised working at speed in a real cluster consistently underperform their expected level.
What the Exam Actually Tests
There are no multiple choice questions. Every task involves working in a live Kubernetes cluster: creating resources, modifying configurations, troubleshooting broken setups, and managing cluster components. You're given a set of tasks with point values and work through them in two hours.
Typical tasks include:
- Create a deployment with specific resource requests and limits, then expose it as a service
- Troubleshoot a node that is not ready and fix the underlying issue
- Upgrade a cluster control plane and worker node from one Kubernetes version to another
- Configure a NetworkPolicy to restrict pod-to-pod communication
- Create a PersistentVolume and bind it to a PersistentVolumeClaim
- Back up the etcd cluster and restore it from the backup
- Configure RBAC: create a role and role binding for a specific service account
- Schedule a pod on a specific node using node affinity or a node selector
Exam Format
- 15–20 tasks in a live Kubernetes environment
- 2 hours (120 minutes)
- Passing score: 66 / 100
- Open browser access to the official Kubernetes documentation (docs.kubernetes.io only)
- Delivered via PSI Secure Browser with a remote proctor
- One free retake included
The Five Domains
| Domain | Weight |
|---|---|
| Troubleshooting | 30% |
| Cluster Architecture, Installation & Configuration | 25% |
| Services & Networking | 20% |
| Workloads & Scheduling | 15% |
| Storage | 10% |
Troubleshooting is the largest domain and the area where time pressure hits hardest. A broken cluster component that takes 20 minutes to diagnose instead of 5 can cost you the exam.
What Makes It Challenging
The Performance-Based Format
This is the biggest differentiator. There is no process of elimination, no educated guessing, no re-reading the question and ruling out wrong answers. You either know how to do the task or you don't, and you need to do it quickly under pressure in a terminal. Candidates who study by reading documentation without practising in real clusters find the format brutally exposing.
Time Pressure
Two hours for 15–20 tasks sounds reasonable until you factor in troubleshooting tasks where the problem isn't immediately obvious. If you spend 20 minutes on a tricky networking task that's worth 4 points, you may run out of time on easier tasks worth more. Time management and knowing when to skip and come back is a skill that needs to be practised, not just planned.
Cluster Upgrades
The kubeadm upgrade workflow appears in almost every exam. It requires precise command sequencing: draining nodes, upgrading the control plane, upgrading kubelet and kubectl, then doing the same on worker nodes. A mistake in the sequence breaks the cluster. Candidates need to be able to run through this process fluently and quickly.
etcd Backup and Restore
Another common high-value task. Using etcdctl to snapshot the etcd database and then restore from that snapshot. Getting the flags right (endpoints, certs, cacert, key) and pointing the restore at the correct data directory is error-prone under pressure if you haven't done it repeatedly in practice.
Troubleshooting Broken Clusters
30% of the exam is troubleshooting. Broken kubelets, misconfigured static pod manifests, broken CNI plugins, failing API server, unavailable nodes. These tasks require you to know where to look: systemctl status kubelet, journalctl -u kubelet, /etc/kubernetes/manifests/, kubectl describe node. Diagnostic fluency is built through practice, not reading.
What Makes It Manageable
66% Passing Score
You need 66 out of 100 to pass. That means you can skip several tasks entirely and still pass if you're solid on the core material. Skipping tasks you're unsure about and returning at the end is a valid strategy.
Documentation Is Available
You can have docs.kubernetes.io open during the exam. Bookmarking key pages before the exam (kubeadm upgrade, etcdctl usage, NetworkPolicy examples, PersistentVolume spec) means you don't need to memorise exact syntax. You need to know where to look and be fast about it.
Free Retake
Every CKA exam comes with one free retake. Treat the first attempt as a high-pressure practice run if needed, though most candidates who have prepared thoroughly pass on the first attempt.
Logical, Real-World Content
The CKA tests what Kubernetes administrators actually do. If you manage Kubernetes clusters in your job, the exam tasks will feel familiar. The certification validates genuine operational ability rather than the ability to recall vendor terminology.
Pass Rate
The CKA has one of the lower first-attempt pass rates among widely-taken technical certifications. Community estimates put it around 50–65% for candidates who have prepared, lower for those who haven't done hands-on practice. The performance-based format reveals gaps that candidates don't notice when studying.
How Long to Prepare
| Background | Estimated Prep Time |
|---|---|
| No Kubernetes experience | 16–20 weeks |
| Familiar with Kubernetes concepts, limited hands-on | 10–14 weeks |
| Regular Kubernetes user (application deployment) | 6–10 weeks |
| Kubernetes administrator with cluster management experience | 4–6 weeks focused prep |
Recommended Study Approach
- Get hands-on immediately. Use killer.sh (included with exam registration) for realistic practice environments. Use KillerCoda for free browser-based Kubernetes labs. Do not spend more than 20% of your prep time reading and 80% in terminals.
- Practice the high-value tasks until they're automatic. kubeadm upgrade, etcd backup/restore, RBAC setup, NetworkPolicy creation, PV/PVC binding. These appear in almost every exam and need to be fast and accurate.
- Bookmark the documentation. Before the exam, set up bookmarks in the allowed browser for kubeadm upgrade steps, etcdctl syntax, NetworkPolicy examples, and any other pages you regularly need to reference.
- Practise troubleshooting deliberately. Break your cluster and fix it. Misconfigure a kubelet, break a static pod manifest, disable a CNI plugin, then diagnose and repair. Troubleshooting fluency is only built by doing.
- Practise time management. Set a 2-hour timer and work through 15 tasks. Know your skip/return strategy before the exam.
Bottom Line
The CKA is genuinely hard and the pass rate reflects it. The performance-based format means there is no shortcut: you need real hands-on fluency with Kubernetes cluster administration under time pressure. Candidates who spend the majority of their prep time working in live clusters, practising the high-frequency tasks to the point of automation, consistently pass. Candidates who study primarily through reading and videos consistently struggle.
Build things. Break things. Fix them. That's the preparation.