I’ve been studying for CKS and generally trying to stay sharp on Kubernetes but most of my study time ends up being at night on my phone while lying in bed. So I built an iOS app for myself to stay sharp on concepts, quiz myself (multiple choice, command builder, YAML fill-in-the-blank). It’s free, no ads, no paywalled content, no account, no data collection. Wasn’t originally planning to share it, but figured it might be useful to someone else in the same boat.

Note: this is not intended to be a supplement for deeper, hands-on courses or guides. Rather a helpful companion app to keep you sharp.

https://apps.apple.com/us/app/k8s-guide/id6787748279

I wanted to share some good news — I’ve successfully passed the Certified Kubernetes Administrator (CKA) exam with 76%! 🎉

I bought the exam over a year ago and have been studying on and off for the last year. I’m not going to lie, it was a tough journey.

During that time, I had two close family funerals, went through ACL surgery and 4+ months of recovery, and obviously had work alongside it all. There were plenty of times when studying was the last thing I wanted to do. A big thank you to the Linux Foundation as well for kindly giving me an extension on my exam.

So I’m honestly really happy that I stuck with it and finally got it done.

I’m sure this is the right place to flex a little 😂 — I definitely didn’t want to do it on LinkedIn, so Reddit gets the flex instead!

What I used

• Mumshad Mannambeth / KodeKloud Udemy course
• DumbITGuy playlist
• Prepium.sh — I got a free exam from them last week through this community at exactly the right time. Really appreciated it and would definitely recommend checking them out.

A massive thank you to everyone in this community who shares their experiences, tips and resources. It genuinely helped me a lot.

If you’re currently preparing and struggling, keep going. It might take longer than you expected, and life might get in the way, but that doesn’t mean you’ve failed.

Good luck to everyone preparing!

#CKA #Kubernetes #CertifiedKubernetesAdministrator #LinuxFoundation #DevOps #CloudEngineering #KubernetesAdministrator #DevOpsJourney #Certification #KeepGoing

So, CKAD is not rocket science.

And I believe anyone preparing for the CKAD can clear the exam with laser-focused practice.

But maybe you're doing what I did before my first attempt.

And that got me to fail smart.

I used almost every practice set I could find.

KodeKloud. Killer.sh. Practice exams.

I love KodeKloud, especially if you don't have much Kubernetes experience. I believe it's one of the best places to start.

I even subscribed to an exam prep for around $25.

Worth it?

Yes.

Did it help me pass on my first attempt?

No.

The problem wasn't that I didn't practice.

I was scoring above 90% in practice exams.

So naturally, I was puffed up 😂

I thought I had the exam at my fingertips.

Then the real exam humbled me.

And that's when I noticed something.

The exam wasn't trying to test how smart I was.

It wasn't trying to trick me either.

A lot of it came down to whether I could actually deploy, configure, troubleshoot and maintain applications in a Kubernetes environment — under time pressure.

That changed how I prepared for my retry.

Instead of trying to do more and more practice exams, I became very intentional about the areas I needed to master.

And I passed.

So if you're preparing for CKAD, learn from my mistake instead of making the same one.

A wise man learns from the mistakes of others instead of making them himself.

If you're going to sit the exam, bro, master these topics:

🔐 Secrets & Environment Variables

You should be comfortable taking hardcoded environment variables and moving them into Secrets.

Know how to use secretKeyRef.

These can be easy points when you're calm and know exactly what you're doing.

🌐 Ingress

Be comfortable with both sides of this:

Fixing a broken Ingress

• Wrong Service name
• Wrong port
• Missing or incorrect pathType

Creating an Ingress

• Add the hostname
• Route / or /app correctly
• Point it to the correct Service and port

This was one of my weak points initially.

One thing that helped me:

Read the Service first. Then work on the Ingress.

🔒 NetworkPolicy

You need to understand this beyond memorizing YAML.

For example, you may have multiple NetworkPolicies already created and you're not allowed to modify them.

Your job could simply be to understand their selectors and label the correct Pods so that the required communication works.

If you understand labels and selectors properly, this becomes much easier.

📦 Resources

Know how to:

• Set resource requests and limits
• Update them on existing workloads
• Work with ResourceQuota
• Understand the relationship between requests and limits

Don't just memorize where resources: goes in the YAML.

Understand what you're changing.

🐳 Docker

Don't forget Docker.

Know how to:

• Build an image
• Tag the image correctly
• Save/export the image

Nothing exotic.

But you don't want to be figuring out basic Docker commands during the exam.

🐦 Canary Deployment

Understand how to create a second version of an application while keeping the stable version running.

Think:

Stable:

version=v1

Canary:

version=v2

Then understand how replicas, labels and the Service selector work together.

🔁 Service Selectors

Service exists.

Pods exist.

But traffic isn't flowing.

What do you check?

Selectors.

Get comfortable checking endpoints too:

kubectl get endpoints

Sometimes the problem is much simpler than it looks.

⏰ CronJobs

Know how to create and troubleshoot CronJobs.

And understand something important:

The Job needs to finish.

If your container keeps running forever, you have a problem.

Understand things like activeDeadlineSeconds and how Jobs actually terminate.

This one tripped me before.

It won't again.

🔐 SecurityContext

Be comfortable editing an existing Deployment and adding something like:

runAsUser: 10000

But here's the important part:

There may already be a securityContext there.

Don't blindly delete what already exists.

Merge your changes intelligently.

🧑‍💼 RBAC

This is where many people lose time.

You might see something like this in the logs:

forbidden: User cannot list pods

Don't panic.

The error is already giving you a clue.

You may need to:

• Create a ServiceAccount
• Create or reuse the correct Role
• Create the RoleBinding
• Assign the ServiceAccount to the Deployment
• Check the logs again

Read the logs.

They often tell you exactly which permission is missing.

🩺 Probes

Know how to add a readinessProbe.

Understand the basic HTTP probe structure and where it belongs in the container spec.

🔄 Deployment Rollback

Know how to:

• Make/update a Deployment
• Identify when something has gone wrong
• Check rollout history
• Roll back
• Verify that the application recovered

⚠️ Deprecated APIs

You may come across manifests using deprecated API versions or fields.

You should be comfortable identifying the problem, fixing the manifest and applying it successfully.

The biggest thing I changed for my retry wasn't the number of practice exams I did.

It was how I practiced.

I stopped using a high practice score as proof that I was ready.

Instead, I focused on whether I could solve these tasks quickly, troubleshoot when something didn't work, and move on without wasting time.

If you're preparing for CKAD, I hope my first failure can save you from making some of the same mistakes.

I've also recorded a free YouTube series where I go through these CKAD topics and practice them.

You can watch the full series here:

https://www.youtube.com/playlist?list=PLszh7fnNwdwjjhX1Wxw8flmXMQk4O6SNw

I’m happy to share that I’ve officially earned the Certified Kubernetes Administrator (CKA) certification! ☸️
The preparation was a great hands-on learning experience, especially around:
- Kubernetes administration & troubleshooting
- Networking & Services
- Storage & PVCs
- Security & RBAC
- Scheduling & workloads
- Cluster maintenance and troubleshooting
A big thanks to Mumshad Mannambeth for the excellent Kubernetes courses and Killer Shell for the hands-on practice environment. 🙌
Now looking forward to putting these skills into practice and continuing deeper into the Kubernetes/cloud-native ecosystem.

#CKA #Kubernetes #DevOps #CloudNative #K8s #Linux #CNCF #KillerShell #KubernetesAdministrator

You might get a question of this during the exam:

Install a CNI plugin. Choose one of the following: Flannel (v0.26.1) or Calico (v3.28.2)

with a requirement about network policy enforcement.

Flannel doesn't do network policy. That's not something you work out during the exam, it's something you know before you sit down. You see Flannel, you pick the other one, you move on.

That's the easy part. Everybody gets that part right. Then you run the right command, you watch it say created, and you still lose the marks. So here's what to actually look out for.

Step 1 — get the podSubnet before you install anything

k get cm kubeadm-config -n kube-system -o yaml | grep podSubnet

Depends on the cluster config, but you'll get something like:

podSubnet: 10.244.0.0/16

podSubnet is what the cluster hands out. The Calico manifest ships with its own default and it has never seen your cluster. This value got set when somebody ran kubeadm init, probably months ago, probably not by you. It's the range every pod IP on this cluster comes from, and the CNI you're about to install has to agree with it. Read the number now, before you install anything.

Step 2 — install the operator

you don't need those urls memorized. the exam gives you what you need in the question itself.

k create -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml

Notice I used create here, not apply. The CRDs bundled inside that operator file are massive. If you use apply, kubectl tries to shove the whole file into a last-applied-configuration annotation, blows past the 256k limit, and throws an error right in your face. Use create and keep moving.

Don't believe me? Here's the output:

root@controlplane:~$ kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/tigera-operator.yaml
namespace/tigera-operator created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgpfilters.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/caliconodestatuses.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipreservations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/apiservers.operator.tigera.io created
customresourcedefinition.apiextensions.k8s.io/imagesets.operator.tigera.io created
customresourcedefinition.apiextensions.k8s.io/tigerastatuses.operator.tigera.io created
serviceaccount/tigera-operator created
clusterrole.rbac.authorization.k8s.io/tigera-operator created
clusterrolebinding.rbac.authorization.k8s.io/tigera-operator created
deployment.apps/tigera-operator created
The CustomResourceDefinition "installations.operator.tigera.io" is invalid: metadata.annotations: Too long: may not be more than 262144 bytes

Step 3 — the operator is not the CNI

This is the one that got me. The operator is the thing that installs the CNI. It is not the CNI. It's just a controller sitting there waiting to be told what to build, and nothing has told it anything yet. No Calico, no CNI binary on disk, and your nodes are still NotReady.

You can check it yourself:

k get pods -n tigera-operator    # No resoucrce found
k get pods -n calico-system      # No resources found

That's what a half-finished install looks like.

Step 4 — download the custom resources and check the CIDR

you don't need those urls memorized. the exam gives you what you need in the question itself.

curl -sLO https://raw.githubusercontent.com/projectcalico/calico/v3.28.2/manifests/custom-resources.yaml

This is the file that actually tells the operator what to install. Don't pipe it straight into kubectl create. Download it, because you want to look at it first.

# This section includes base Calico installation configuration.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  # Configures Calico networking.
  calicoNetwork:
    ipPools:
    - name: default-ipv4-ippool
      blockSize: 26
      cidr: 192.168.0.0/16   <-------------Here is what u need to change
      encapsulation: VXLANCrossSubnet
      natOutgoing: Enabled
      nodeSelector: all()

---

# This section configures the Calico API server.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
  name: default
spec: {}

Final Step:

k create -f custom-resources.yaml

And now the operator actually has its instructions.

Step 5 — verify

k get tigerastatus
k get pod test-pod -o wide

There you go that is the whole process, I hope that will help you guys