Pass the CKA in 6 Weeks: A Week-by-Week Plan (New Syllabus)

Every topic on the updated CKA curriculum, in the order to study it, with the crash courses, labs, and docs for each week.

Author

Vishakha Sadhwani
October 14, 2026

The Certified Kubernetes Administrator (CKA) exam changed in 2025. Helm and Kustomize became hands-on tasks, CRDs and operators moved from "recognize the pattern" to "install and configure one," Gateway API now sits alongside Ingress, and Pod Security Policies are gone entirely. A lot of older prep material still teaches the previous syllabus, so it pays to check what you're studying before you start.

The exam itself hasn't changed in spirit. It's a two-hour, hands-on test in a live terminal, graded on whether your cluster ends up in the right state. You can't memorize your way through it. You pass by repeating the same tasks until they're fast.

This plan splits the curriculum into six weeks, ordered so that each week builds on the one before. Every week has the topics to cover, a crash course to watch first, labs to practice in, and the official docs you'll also have open during the exam. Week 6 is the heaviest, because troubleshooting carries the most marks.

Week

Focus

Exam weight

1

Foundations: architecture, core workloads, kubectl

Supports every domain

2

Cluster setup: kubeadm, etcd, RBAC

Cluster Architecture (25%, shared with Week 3)

3

Cluster extensions: Helm, Kustomize, CRDs

Cluster Architecture (25%, shared with Week 2)

4

Networking: Services, Gateway API, NetworkPolicies

Services & Networking (20%)

5

Workloads and storage

Workloads & Scheduling (15%) + Storage (10%)

6

Troubleshooting and full mocks

Troubleshooting (30%)

Week 1: Foundations

What you cover: How a cluster actually works, and the core objects you'll create over and over in the exam. The goal this week is speed with kubectl. Most CKA tasks start with an imperative command that generates YAML, which you then edit.

Topics

  • Control plane architecture: what the API server, etcd, scheduler, controller manager, and kubelet each do

  • Pods, Deployments, ReplicaSets, and DaemonSets

  • Imperative kubectl commands: create, run, expose, scale, and --dry-run=client -o yaml

  • kubectl explain and finding things quickly in the docs

Watch

Practice

Docs

Exercise: Create a Deployment, scale it to 5 replicas, expose it as a Service, and generate the YAML for each step with --dry-run=client -o yaml. Then do it again faster.

Key takeaways: what each control plane component is responsible for (you'll need this when it breaks in Week 6), and enough kubectl fluency that you rarely write YAML from scratch.

Week 2: Cluster Setup

What you cover: Building and maintaining the cluster itself. These are the tasks that set the CKA apart from the developer-focused CKAD, and etcd backup and restore shows up on almost every sitting.

Topics

  • kubeadm: install a cluster, join worker nodes, upgrade the control plane and nodes

  • etcd backup and restore with etcdctl

  • RBAC: Roles, ClusterRoles, bindings, and ServiceAccounts

  • Static pods, plus cordon, drain, and uncordon for node maintenance

Watch

Practice

Docs

Exercise: Back up etcd, delete a Deployment, restore from the snapshot, and confirm the Deployment is back. Then upgrade a cluster by one minor version, starting with the control plane and then each worker.

Key takeaways: the exact upgrade order, where the certificates and static pod manifests live (/etc/kubernetes/pki and /etc/kubernetes/manifests), and how to grant the minimum permissions a task asks for.

Week 3: Cluster Extensions (New in the Update)

What you cover: The topics added in the 2025 curriculum update. Older courses and books often skip them, so if your material doesn't mention Helm, Kustomize, or CRDs, it's out of date.

Topics

  • Helm: install, upgrade, and roll back cluster components from charts

  • Kustomize: bases and overlays, and kubectl apply -k

  • CRDs and operators: install one and create a custom resource

  • Extension interfaces: what CNI, CSI, and CRI each plug into

Watch

Practice

Docs

Exercise: Install a component with Helm, upgrade it with a changed value, then roll it back. Write a Kustomize base with two overlays (dev and prod) that change the replica count and labels.

Key takeaways: the handful of Helm and Kustomize commands the exam actually asks for, and a clear sense of where CNI, CSI, and CRI fit in a cluster.

Week 4: Networking (20%)

What you cover: How traffic reaches pods and how to restrict it. Networking is one of the harder domains, and the newly added Gateway API makes it larger than it used to be.

Topics

  • Services (ClusterIP, NodePort, LoadBalancer) and Ingress

  • Gateway API: Gateways and HTTPRoutes, which now sit alongside Ingress

  • NetworkPolicies: default deny, then allow specific traffic

  • CoreDNS and service discovery

Watch

Practice

Docs

Exercise: Expose an app through Ingress, then expose the same app through a Gateway and HTTPRoute. Add a default-deny NetworkPolicy, confirm traffic breaks, then allow only one namespace back in.

Key takeaways: how to read and write HTTPRoutes, how NetworkPolicy selectors combine, and how to test connectivity from inside a temporary pod.

Week 5: Workloads and Storage (25%)

What you cover: Controlling where pods run, how they scale, how they're secured, and how they keep data. These are two smaller domains together, and most of the tasks are quick wins if you've practiced them.

Topics

  • Node affinity, taints, and tolerations

  • Horizontal Pod Autoscaling (HPA) and workload autoscaling

  • Pod Security Standards (Pod Security Policies were removed, so skip any PSP content)

  • StorageClasses, PersistentVolumes, PersistentVolumeClaims, and dynamic provisioning

Watch

Practice

Docs

Exercise: Taint a node, then schedule one pod that tolerates it and one that doesn't. Create a PVC against a StorageClass, mount it in a pod, write a file, delete the pod, and confirm the file survives in a new pod.

Key takeaways: the difference between affinity (attracting pods) and taints (repelling them), how to label a namespace to enforce Pod Security Standards, and how PVCs bind to PVs.

Week 6: Troubleshooting (30%) and Mock Exams

What you cover: Finding and fixing what's broken. This is the heaviest domain, so give it the most hours. It's also where all the previous weeks come together: you can't fix a control plane you don't understand.

Topics

  • Control plane and node failures: broken static pod manifests, a stopped kubelet, expired certificates

  • Pod failures: CrashLoopBackOff, ImagePullBackOff, and pods stuck in Pending

  • Debugging Service and DNS connectivity

  • Full mock exams under a timer

Watch

  • Piyush Sachdeva's CKA series: Day 37 (application failures), Day 38 (cluster component failures), Day 39 (network troubleshooting), and Day 41 (exam tips)

  • Rewatch the Kubernetes crash course, Part 1 architecture section. Most cluster troubleshooting is knowing which component owns the symptom.

Practice

Docs

Exercise: Break your own cluster. Add a typo to a static pod manifest, stop the kubelet on a worker, point a Service selector at the wrong label. Fix each one using only kubectl, journalctl, crictl, and the docs.

Key takeaways: a repeatable debugging order (get, describe, logs, events, then node-level logs) and the timing discipline you only build from full mocks.

Exam-Day Tactics

  • Flag and skip. Tasks carry different weights. One 7% task is worth more than three 3% tasks, so don't sink 15 minutes into something small.

  • Use what's already set up. The k alias for kubectl and bash autocompletion come preconfigured in the exam environment.

  • Get to the right environment first. Each task tells you which cluster or host to work on. Switch to it before you do anything else.

  • Verify every change. Run kubectl get (or describe) after each task. Graders check the final state, not your commands.

  • Aim for finished, not perfect. The pass mark is 66%. Completing most tasks beats perfecting a few.

Before You Book

  • Check the Kubernetes version. The exam tracks the latest stable release and moves to new minor versions within weeks of release (it was v1.35 as of September 2026). Confirm it on the official CKA page and practice on a matching cluster.

  • Use the discount. Code 30K8SUG takes 30% off CKA, CKAD, CKS, KCNA, and KCSA: get the discount

  • Check for seasonal offers. Higher seasonal codes run on bundles, so check before you pay.

  • Book it now. The exam date is what makes a six-week plan actually take six weeks.

Crash Course Quick List

Every video in one place:

Course details, free tiers, and exam rules change over time. Confirm the current curriculum and exam version on the Linux Foundation page before you book.