CKA (CNCF) study plan
CKA · Give each week a clear focus.
8 weeks · About 6 hours per week
Cluster Architecture, Installation & Configuration
Provision a three-node cluster with kubeadm (one control plane, two workers) from bare VMs or cloud instances
Inspect each static pod manifest directory and map every control plane component to its binary, manifest path, and log location
Generate a kubeconfig for a second user and switch contexts to confirm it works
Verify cluster health using node status, kube-system pod status, and component logs rather than deprecated status commands
Your checkpoint
A running three-node cluster plus a one-page component map listing each control plane binary, its manifest directory, and where its logs are read from.
Cluster Architecture, Installation & Configuration & Troubleshooting
Take an etcd snapshot and restore it into a deliberately broken control plane
Upgrade the cluster by one minor version using kubeadm upgrade plan/apply with drain and uncordon around each node
Bind a ClusterRole to both a ServiceAccount and a User, then confirm permissions with kubectl auth can-i --as
Repair a node whose kubelet has been stopped and rejoin it to the cluster
Your checkpoint
A restored control plane from an etcd snapshot, with the exact command sequence and before/after kubectl get nodes output saved in a runbook.
Troubleshooting
Diagnose a CrashLoopBackOff pod using logs, describe output, and events to isolate the failing field
Recover a NotReady node by inspecting kubelet service state, journalctl, and container runtime status
Fix a control plane static pod that will not start by reading pod logs on the node and correcting the manifest
Trace a failing Service to its endpoints and identify the labelling or port mismatch behind it
Your checkpoint
A troubleshooting log covering five seeded faults, each with symptom, root cause, the one command that fixed it, and time to resolution.
Troubleshooting & Services & Networking
Configure ClusterIP, NodePort, and LoadBalancer Services and verify reachability from inside and outside the cluster
Resolve a Service by short name and by FQDN from a test pod to confirm CoreDNS behaviour
Write a NetworkPolicy that restricts ingress on a port to a single labelled client
Debug an end-to-end Service-to-pod path by comparing selectors, endpoints, and pod labels
Your checkpoint
A namespace where one app reaches another through a Service under default-deny policy, with curl output proving allowed traffic and a refused connection from an unlabelled pod.
Services & Networking
Expose two applications through a single Ingress with path-based routing
Create a Service with named target ports and confirm the endpoints object matches the pod set
Troubleshoot a NetworkPolicy that accidentally blocks DNS resolution for a namespace
Inspect kube-proxy and CNI behaviour to explain why a NodePort is reachable on one node but not another
Your checkpoint
An Ingress manifest plus a curl transcript showing two distinct paths routing to two different backend Services.
Workloads & Scheduling
Roll out a Deployment update, inspect rollout status and history, then roll back to the previous revision
Place pods using nodeSelector, node affinity, and tolerations against a tainted node
Create a static pod and a DaemonSet and verify their placement with kubectl get pods -o wide
Build a multi-container pod with an init container and a sidecar sharing a volume
Set resource requests and limits and identify a pod left Pending by an unsatisfiable request
Your checkpoint
A manifest set applied in one clean namespace, with kubectl rollout history output and pod listings showing correct placement on the tainted node and correct init/sidecar ordering.
Storage & Troubleshooting
Create a PersistentVolume and matching PersistentVolumeClaim and mount it into a pod
Configure a default StorageClass and confirm dynamic provisioning creates a bound PVC
Migrate a Deployment from emptyDir to a PVC and prove the data survives pod deletion
Debug a pod stuck in Pending because its PVC is unbound or its access mode is wrong
Your checkpoint
Persistence proof: write a file, delete the pod, recreate it, and cat the file, with the before and after pod names captured in the transcript.
Troubleshooting & Cluster Architecture, Installation & Configuration
Complete two timed 120-minute practice exams covering all five domains
Re-run every previously failed lab without notes until each passes on the first attempt
Drill imperative kubectl commands and manifest generation against the clock
Write a one-page command sheet covering only the operations you fumbled
Your checkpoint
Two timed practice exam scores, both above 80 percent, plus a ranked list of remaining weak objectives with one fix action each.
Milestones
Week 2: Rebuild a control plane from an etcd snapshot without consulting notes, with the cluster returning to all-nodes-Ready in under 20 minutes.
Week 4: Diagnose and fix three seeded faults (NotReady node, CrashLoopBackOff pod, broken Service) in under 15 minutes each with no reference material.
Week 6: Apply a complete workload set into an empty namespace from memory: Deployment with rollback, DaemonSet, static pod, and a pod scheduled onto a tainted node.
Week 7: Demonstrate persistent storage surviving pod deletion and explain the PV/PVC/StorageClass binding chain aloud in under 5 minutes.
Week 8: Score above 80 percent on two consecutive timed mocks covering all five domains, with no objective left unaddressed on the curriculum checklist.