🎯 Intermediate Level | Software Developer / DevOps Engineer / Platform Engineer

What is the CKAD Certification?

The Certified Kubernetes Application Developer (CKAD) is a performance-based, hands-on certification from the Cloud Native Computing Foundation (CNCF) and the Linux Foundation. Unlike the CKA (which focuses on cluster administration), CKAD targets developers and DevOps engineers who need to design, build, configure, and deploy cloud-native applications on Kubernetes. The 2-hour exam presents 15–20 real tasks in a live Kubernetes cluster — no multiple choice, no memorization — you must kubectl your way through. CKAD validates the skills needed to deploy applications, manage environment configuration, expose services, set health checks, configure persistent storage, and debug live apps.

📋 Recommended Prerequisites

Basic Linux command line — file management, process control, text editing (vi/vim or nano)
Container fundamentals — Docker images, containers, Dockerfile basics, image layers
YAML fluency — deep comfort writing and editing Kubernetes manifests by hand
Basic Kubernetes awareness — what a Pod, Deployment, Service, and Namespace are
HTTP and REST API concepts — useful for understanding Services, Ingress, probes
Familiarity with at least one application runtime (Node.js, Python, Java, etc.) — helpful for building container images

🗺️ Certification Pathway

Docker / Containers

→

KCNA (optional)

→

CKA (Admin – optional first)

→

CKAD — Developer

→

CKS — Security

Exam Blueprint

CKAD Domain Breakdown (5 Domains)

Performance-based exam — 15–20 tasks in 2 hours on a live Kubernetes cluster

Domain 1: Application Design and Build 20%

Define, build, and modify container images using Dockerfiles
Choose and use appropriate workload resources: Deployment, DaemonSet, StatefulSet, CronJob, Job
Understand multi-container Pod design patterns: sidecar, init containers, ambassador, adapter
Utilize persistent storage: PersistentVolume, PersistentVolumeClaim, StorageClass, volume mounts
Create and configure pod specs with multiple containers sharing volumes
Use emptyDir, configMap, secret, hostPath volume types correctly

Domain 2: Application Deployment 20%

Use kubectl to create, update, rollout, and rollback Deployments
Implement blue/green and canary deployment strategies using labels and selectors
Use Helm to install, upgrade, and manage application releases
Scale Deployments manually and understand HorizontalPodAutoscaler basics
Understand deployment strategies: RollingUpdate vs Recreate — configure maxSurge, maxUnavailable
Use kubectl set image, kubectl rollout history, kubectl rollout undo correctly

Domain 3: Application Observability and Maintenance 15%

Implement liveness, readiness, and startup probes — httpGet, tcpSocket, exec
Use kubectl logs, kubectl exec, kubectl describe to debug running applications
Understand container resource requests and limits — CPU/memory units
Monitor cluster and application health using kubectl top pods/nodes
Debug CrashLoopBackOff, ImagePullBackOff, OOMKilled, and Pending pod states
Use labels, selectors, and annotations effectively for observability and filtering

Domain 4: Application Environment, Configuration and Security 25%

Create and consume ConfigMaps: from literals, files, directories; reference as env vars and volume mounts
Create and consume Secrets: generic, TLS, docker-registry; base64 encoding; mount as volume or env
Configure SecurityContext at pod and container level: runAsUser, runAsNonRoot, readOnlyRootFilesystem, capabilities
Understand ServiceAccounts — create, bind, disable auto-mount
Apply ResourceQuotas and LimitRanges at namespace level
Use admission controllers and understand their role: NamespaceLifecycle, LimitRanger, ResourceQuota

Domain 5: Services and Networking 20%

Create and configure Services: ClusterIP, NodePort, LoadBalancer — understand when to use each
Configure Ingress resources and understand Ingress controllers (nginx, traefik)
Use NetworkPolicies to restrict pod-to-pod communication — ingress/egress rules
Understand Kubernetes DNS: service discovery by name within namespaces (svc.namespace.svc.cluster.local)
Expose applications externally using Services and Ingress
Debug networking issues: DNS resolution failures, connectivity between pods and services

Phase 1 · Weeks 1–2

Foundations: Containers, YAML, and Core Kubernetes

Build the fundamental skills needed before touching exam domains

Container and Docker Fundamentals

Writing Dockerfiles — FROM, RUN, COPY, CMD, ENTRYPOINT

Building and tagging images: docker build -t name:tag

Pushing to registries: Docker Hub, ECR, GCR, GHCR

Container networking, volumes, environment variables

Multi-stage Dockerfiles for smaller production images

Image security: non-root user, minimal base images

Kubernetes Core Objects

Pods, ReplicaSets, Deployments — create, edit, delete

kubectl imperative commands (--dry-run=client -o yaml)

Namespaces — create, switch context, resource isolation

Labels, selectors, annotations — filtering and organization

Services: ClusterIP, NodePort, LoadBalancer basics

ConfigMaps and Secrets — create from literals and files

YAML Mastery (Critical for CKAD)

Write Pod specs from scratch with multiple containers

Generate YAML with --dry-run=client -o yaml pattern

Edit live resources: kubectl edit deployment name

Apply vs Create vs Replace — know the differences

Kubernetes Official Docs — kubernetes.io/docs (your exam companion — master navigation)
KillerCoda.com CKAD scenarios — free interactive browser-based practice
TechWorld with Nana — Docker + Kubernetes Crash Course (YouTube, free)
Certified Kubernetes Application Developer (CKAD) Study Guide — O'Reilly / Sybex

Phase 2 · Weeks 3–4

Application Design, Build, and Storage

Domain 1 deep dive — containers, workload resources, multi-container patterns, persistent storage

Multi-Container Pod Patterns

Sidecar pattern — logging agent alongside main app

Init containers — setup tasks before main container starts

Ambassador pattern — proxy to external services

Adapter pattern — transform output format for main app

Shared volume between containers (emptyDir)

Container dependencies and ordering with init containers

Workload Resources

StatefulSets — ordered pod creation, stable network identity

DaemonSets — one pod per node (logging, monitoring agents)

Jobs — run-to-completion, parallelism, completions

CronJobs — schedule syntax, concurrencyPolicy, history limits

Persistent Storage

PersistentVolume (PV) — static provisioning

PersistentVolumeClaim (PVC) — request storage

Dynamic provisioning with StorageClass

Access modes: ReadWriteOnce, ReadOnlyMany, ReadWriteMany

Mount PVC into pod — volumeMounts and volumes sections

emptyDir, configMap, secret, hostPath volume types

🔬 Hands-On Lab: Multi-Container Logging Sidecar

Create a Pod with a main app container writing logs to /var/log/app.log and a sidecar container that reads from the same emptyDir volume and streams logs to stdout. Validate with kubectl logs on the sidecar container.

🔬 Hands-On Lab: CronJob with PVC

Create a CronJob that runs every minute and writes a timestamp to a file on a PersistentVolumeClaim. Inspect the PVC contents using a one-off Pod that mounts the same PVC. Practice cleaning up completed jobs.

Phase 3 · Weeks 5–6

Deployment Strategies, Config, and Security

Domains 2 & 4 — deployments, Helm, ConfigMaps, Secrets, SecurityContext

Advanced Deployment Strategies

Blue/Green — run two Deployments, switch Service selector

Canary — route small % traffic to new version via labels

Rolling update — maxSurge, maxUnavailable configuration

Rollback with kubectl rollout undo, history, pause, resume

kubectl set image deployment/name container=image:tag

Helm Package Manager

helm install / upgrade / rollback / uninstall

helm repo add / update / list

helm show values, helm get all

Override values: --set key=value or -f values.yaml

ConfigMaps and Secrets

Create ConfigMap from literal, file, directory

Mount ConfigMap as environment variables (envFrom)

Mount ConfigMap as volume (each key = a file)

Create Secret generic, TLS, docker-registry

Mount Secret as volume or inject as env var

Base64 encoding/decoding — echo -n "val" | base64

Security Context and RBAC Basics

securityContext: runAsUser, runAsNonRoot, fsGroup

readOnlyRootFilesystem: true for hardened containers

drop/add Linux capabilities in container securityContext

ServiceAccounts — create, annotate, disable auto-mount

ResourceQuota — limit CPU, memory, pod count per namespace

LimitRange — default requests/limits per container

💡 CKAD Exam Speed Tips

Set alias: alias k=kubectl and export do="--dry-run=client -o yaml" first thing in the exam
Use k explain pod.spec.containers.securityContext to quickly find field names
Generate YAML templates: k create deploy name --image=nginx $do > deploy.yaml then edit
Know how to quickly edit: k edit cm/configmap-name — faster than delete+recreate
For Secrets, always use k create secret generic name --from-literal=key=value $do

Phase 4 · Weeks 7–8

Observability, Services, Networking, and Debugging

Domains 3 & 5 — probes, debugging, Services, Ingress, NetworkPolicy, DNS

Liveness, Readiness, and Startup Probes

livenessProbe — restart container when check fails

readinessProbe — remove from Service endpoints when not ready

startupProbe — protect slow-starting apps from liveness kills

httpGet probe — path, port, scheme

tcpSocket probe — opens TCP connection on port

exec probe — runs command inside container, checks exit code

initialDelaySeconds, periodSeconds, failureThreshold

Application Debugging Workflow

kubectl describe pod — Events section identifies root cause

kubectl logs pod --previous (after CrashLoopBackOff)

kubectl exec -it pod -- /bin/sh (shell into container)

kubectl get events --field-selector reason=Failed

kubectl top pods / kubectl top nodes — resource usage

OOMKilled — increase memory limits; ImagePullBackOff — check image name/tag/registry creds

Services and Ingress

ClusterIP — internal-only (default, most common)

NodePort — expose on cluster node's IP:port (30000–32767)

LoadBalancer — external IP from cloud provider (ELB, GLB)

Ingress — HTTP/HTTPS routing by host and path

IngressClass — specify controller (nginx, traefik)

TLS termination in Ingress with Secret (kubernetes.io/tls)

NetworkPolicy

Default: all pods can communicate freely across namespaces

Apply ingress NetworkPolicy to restrict who can reach a pod

Apply egress NetworkPolicy to restrict pod's outbound traffic

podSelector — which pods the policy applies to

namespaceSelector — allow traffic from specific namespaces

ipBlock — allow/deny traffic to/from CIDR ranges

🔬 Hands-On Lab: NetworkPolicy Isolation

Create a 'frontend' and 'backend' Deployment in the same namespace. Apply a NetworkPolicy that allows only frontend pods (via podSelector with a label) to reach backend pods on port 8080. Verify isolation by running curl from an unrelated pod — it should be blocked. Frontend pod curl should succeed.

🔬 Hands-On Lab: Full-Stack App Deployment

Deploy a 3-tier application: frontend (nginx), backend (node app), and database (postgresql). Create Services for each tier, an Ingress for the frontend, a Secret for DB credentials, a ConfigMap for app config, resource limits on all containers, and readiness probes on the backend. This simulates a typical CKAD exam scenario.

Phase 5 · Weeks 9–10

Exam Simulation and Speed Practice

Full mock exams, timed practice, kubectl muscle memory

Mock Exam Platforms

killer.sh — official CKAD simulator (included with exam voucher — 2 free sessions, 36-hour access each)
KillerCoda.com — free CKAD scenario playground, 100+ exercises
Udemy — KodeKloud CKAD Mock Exams (Lightning Lab + Mock Exam series)
GitHub: dgkanatsios/CKAD-exercises — comprehensive task list with solutions
GitHub: bmuschko/ckad-study-guide — O'Reilly study guide companion exercises

Speed Drills (Do These Until Automatic)

Create ConfigMap + mount as env var in < 90 seconds

Create Secret + mount as volume in < 90 seconds

Deploy + expose as NodePort + curl from another pod in < 2 min

Add readiness probe to existing Deployment in < 2 min

Create NetworkPolicy to restrict ingress in < 2 min

Blue/green switch (update Service selector label) in < 60 sec

Write Ingress with TLS and two path-based routing rules in < 3 min

Debug CrashLoopBackOff — find and fix root cause in < 3 min

💡 CKAD vs CKA Exam Strategy Differences

CKAD has MORE developer-focused tasks (Helm, Ingress, probes, SecurityContext) vs CKA's cluster admin focus (etcd backup, kubeadm, RBAC)
Time management is critical — CKAD tasks often involve multiple steps; skip and return to hard ones
Each task has a % weight shown — prioritize high-weight tasks first
You CAN have both CKA and CKAD — many engineers hold both; CKAD is easier if you already have CKA
Killer.sh simulator is harder than the real exam — if you score 70%+ on killer.sh, you are ready

Career Outcomes

Salary and Role Expectations with CKAD

CKAD is a validator for developer-side Kubernetes work

Software Engineer (Kubernetes-native stack)

$110K–$155K

DevOps Engineer

$115K–$160K

Platform Engineer / SRE

$125K–$175K

Cloud-Native Application Architect

$140K–$190K

💡 CKAD Exam Day Must-Knows

Run exam environment setup immediately: alias k=kubectl; export do="--dry-run=client -o yaml"; export now="--force --grace-period 0"
Use kubectl config use-context [context] at the START of every task — the exam switches clusters between tasks
kubernetes.io/docs is allowed — have bookmarks for: Pods, Services, NetworkPolicy, Ingress, ConfigMaps, Secrets, SecurityContext
Use vim efficiently: set number to see line numbers, :%s/old/new/g for bulk replace, :wq to save
Exam is proctored via webcam — clear desk, no phone, single monitor, valid ID required

Ready to Start Your CKAD Journey?

Practice with realistic CKAD scenario questions, study our curated flashcards, and build the kubectl speed you need.

🧪 Practice CKAD Questions 📚 CKAD Flashcards 🔧 CKAD Hands-On Project ← All Certifications

☸️ CKAD — Certified Kubernetes Application Developer