KCA study guide
KCA · Work through your exam, one topic at a time.
The KCA is a hands-on certification for Kubernetes practitioners who want independent, third-party evidence of their ability to operate clusters day to day. It suits platform engineers, DevOps and SRE staff, and developers who already deploy workloads and now need to prove they can install, secure, network, and repair a cluster under time pressure. The KCA study guide has 7 sections and about 2,068 words.
01Kubernetes Core Concepts
This domain tests the control loop and the API objects that express it: control-plane and node components, namespaces, labels and selectors, and declarative versus imperative operations. The API server is the only component that talks to etcd; it validates and persists objects.
307 words, about 2 min02Installation
This domain tests building and validating a cluster: node prerequisites, container runtime setup, kubeadm init and join, CNI installation, and upgrade mechanics. Questions often hinge on why a node is NotReady or why kubeadm preflight fails.
298 words, about 1 min03Configuration and Validation
This domain tests how configuration is injected and how Kubernetes validates it: ConfigMaps, Secrets, environment variables, volumes, probes, resource requests and limits, and dry-run validation. The exam favors real failure signatures over theory.
303 words, about 2 min04Security
This domain tests cluster access control and workload isolation: authentication, RBAC authorization, service accounts, Pod Security Admission, NetworkPolicies, and Secret handling. Expect scenario questions about who can do what and why a Pod is rejected.
289 words, about 1 min05Networking
This domain tests Service discovery and traffic flow: ClusterIP, NodePort, LoadBalancer, headless Services, DNS, Ingress, CNI, and NetworkPolicy interaction. The exam asks you to trace a connection and identify the layer that drops it.
306 words, about 2 min06Troubleshooting
This domain tests a layered method: inspect object status, events, logs, and node conditions before changing anything. The exam presents symptoms such as Pending, CrashLoopBackOff, ImagePullBackOff, NotReady, and failing Service calls.
289 words, about 1 min07Workloads and Scheduling
This domain tests choosing the right controller and controlling placement: Deployments, ReplicaSets, StatefulSets, DaemonSets, Jobs, CronJobs, taints and tolerations, affinity, topology spread, and disruption budgets. Deployments manage ReplicaSets for stateless rolling updates.
276 words, about 1 min