CKA - Certified Kubernetes Administrator Cheat Sheet

Updated 2026-06-04

Next Topic: EX200 - Red Hat Certified System Administrator (RHCSA) Cheat Sheet

🎯Take a practice test on this topic8 practice tests · 330 questions→

🧠Study flashcards on this topic240 cards · spaced repetition→

This sheet covers the Certified Kubernetes Administrator (CKA) exam from the Cloud Native Computing Foundation (CNCF) and The Linux Foundation, currently aligned to Kubernetes v1.34. CKA is a two-hour, performance-based exam: every task is solved live from a terminal against a real cluster, so the bar is not recall but doing, fast, with only the official kubernetes.io docs open. The five domains weight toward Troubleshooting (30%) and Cluster Architecture (25%), so command-line fluency in diagnosing failures and building clusters with kubeadm matters more than memorizing definitions. Use each table as a checklist of the exact objects, flags, and recovery moves the exam expects you to reach for under time pressure.

What This Cheat Sheet Covers

This topic spans 24 focused tables and 245 indexed concepts, 240 flashcards, 8 practice tests with 330 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Storage Classes and Dynamic Volume ProvisioningTable 2: Persistent Volumes, Claims, Access Modes and Reclaim PoliciesTable 3: Troubleshoot Clusters and NodesTable 4: Troubleshoot Control Plane and Cluster ComponentsTable 5: Monitor Cluster and Application Resource UsageTable 6: Container Logs and Output StreamsTable 7: Troubleshoot Services and NetworkingTable 8: Deployments, Rolling Updates and RollbacksTable 9: ConfigMaps and SecretsTable 10: Workload Autoscaling (HPA and VPA)Table 11: Self-Healing Workload PrimitivesTable 12: Pod Scheduling, Affinity and Admission ControlTable 13: Role-Based Access Control (RBAC)Table 14: Prepare Infrastructure and Install Clusters with kubeadmTable 15: Cluster Lifecycle: Upgrades, Drain and etcd BackupTable 16: Highly-Available Control PlaneTable 17: Install Cluster Components with Helm and KustomizeTable 18: Extension Interfaces: CNI, CSI and CRITable 19: CRDs, Operators and Cluster ExtensionTable 20: Pod Connectivity and the Cluster Network ModelTable 21: Network PoliciesTable 22: Service Types and EndpointsTable 23: Ingress, Ingress Controllers and the Gateway APITable 24: CoreDNS and Cluster DNS

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Storage Classes and Dynamic Volume Provisioning

CKA exam domain Storage (10%): implement storage classes and dynamic volume provisioning. Covers the StorageClass object and the fields that drive on-demand volume creation; the PersistentVolume and PersistentVolumeClaim objects, access modes and standalone reclaim policies are covered in Table 2.

Concept	Example	Description
Dynamic Provisioning	A user creates a PVC with `storageClassName: fast` and a volume is auto-created to match	Creates storage on demand when a PVC is made, so admins do not pre-create PVs by hand. • Built entirely on the StorageClass API object • Static provisioning is the opposite: an admin makes PVs ahead of time
StorageClass	`kind: StorageClass` `provisioner: ebs.csi.aws.com`	The object that describes a class of storage and how to provision it. Its name is how a PVC requests it. • Holds `provisioner`, `parameters`, `reclaimPolicy`, `volumeBindingMode`, `allowVolumeExpansion` • Most fields are immutable after creation
provisioner	`provisioner: ebs.csi.aws.com` `provisioner: kubernetes.io/no-provisioner`	The required field naming the volume plugin (CSI driver) that creates the volume. Determines what backend is used. • Internal names start with `kubernetes.io`; external ones do not • `kubernetes.io/no-provisioner` means no dynamic provisioning
Default StorageClass	`kubectl patch storageclass gold -p` `'{"metadata":{"annotations":` `{"storageclass.kubernetes.io/is-default-class":"true"}}}'`	The class used when a PVC omits `storageClassName` entirely, set by the `is-default-class` annotation. • Needs the DefaultStorageClass admission controller enabled • If several are marked default, the most recently created one wins
volumeBindingMode	`volumeBindingMode: WaitForFirstConsumer` (default is `Immediate`)	Controls WHEN the volume binds and provisions. • `Immediate` (default): at PVC creation, before any Pod, so topology may not fit • `WaitForFirstConsumer`: waits for a Pod, then provisions in that Pod's zone
allowVolumeExpansion	`allowVolumeExpansion: true` then edit the PVC to request a larger size	Lets a PVC be grown later by editing its requested size; must be `true` first. • Resizes the existing volume, never creates a new one • Shrinking a PVC below its current size is not supported
reclaimPolicy (StorageClass)	`reclaimPolicy: Retain` `# default value is Delete`	The policy a dynamically provisioned PV inherits from its class; defaults to `Delete` if unset. • `Delete` removes the PV and the backend storage when the PVC is deleted • This is the class default, not the same as patching a single PV
parameters	`parameters:` `type: gp3` `encrypted: "true"`	Provisioner-specific key value settings passed to the driver when it creates a volume. • Accepted keys differ by provisioner; values are quoted strings • At most 512 parameters per class
storageClassName: ""	`spec:` `storageClassName: ""`	An empty string explicitly disables dynamic provisioning for that PVC, so it binds only to a no-class PV. • Different from omitting the field, which triggers the default class • A PVC already set to `""` is not changed when a default appears
allowedTopologies	`allowedTopologies:` `- matchLabelExpressions:` `- key: topology.kubernetes.io/zone`	Restricts which zones a volume may be provisioned in, used with `WaitForFirstConsumer`. • Replaces older zone and zones parameters • Matches node topology labels such as the zone key

Table 2: Persistent Volumes, Claims, Access Modes and Reclaim Policies

CKA exam area Storage (10%): configure volume types, access modes and reclaim policies, and manage PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs). This slice covers the PV and PVC objects, the binding lifecycle, and the basic volume types a Pod consumes (the sibling table owns StorageClasses and dynamic provisioning).

Concept	Example	Description
PersistentVolume (PV) vs PersistentVolumeClaim (PVC)	`PV` = cluster-wide storage resource `PVC` = namespaced request that consumes a PV	• A PV is a piece of storage in the cluster, a resource like a node, with a lifecycle independent of any Pod. • A PVC is a user's request for storage and lives in a namespace. Pods consume PVs by referencing a PVC, never a PV directly.

The rest of this section is part of the full cheat sheet

Table 3: Troubleshoot Clusters and Nodes

CKA exam domain Troubleshooting (30%), Task: Troubleshoot clusters and nodes. Covers node-level diagnosis: reading node status, the kubelet agent and container runtime on the node, the conditions that flip a node to NotReady, the taints the control plane adds in response, and safely taking a node out of and back into service.

Command	Example	Description
kubectl get nodes	`kubectl get nodes` `NAME STATUS ROLES` `node-1 NotReady <none>`	• First move when something is wrong: confirm every node is `Ready`. A `NotReady` line points you at one node to dig into • Does not need metrics-server, that is only for `kubectl top`.

The rest of this section is part of the full cheat sheet

Table 4: Troubleshoot Control Plane and Cluster Components

CKA Troubleshooting (30%) area, Troubleshoot cluster components: diagnosing and repairing the control-plane components (kube-apiserver, etcd, kube-scheduler, kube-controller-manager) that kubeadm runs as static Pods, plus reading their logs and fixing kubelet/kubeconfig/cert problems when the API is unreachable.

Concept	Example	Description
Static Pod Manifest Directory	`ls /etc/kubernetes/manifests` `etcd.yaml kube-apiserver.yaml` `kube-controller-manager.yaml kube-scheduler.yaml`	• The kubelet watches this directory and runs each control-plane component as a static Pod. • You fix a broken component by editing its manifest here, not via the API • Not to be confused with a Deployment the scheduler places

The rest of this section is part of the full cheat sheet

Table 1: Storage Classes and Dynamic Volume Provisioning

Concept	Example	Description
Dynamic Provisioning	A user creates a PVC with `storageClassName: fast` and a volume is auto-created to match	Creates storage on demand when a PVC is made, so admins do not pre-create PVs by hand. • Built entirely on the StorageClass API object • Static provisioning is the opposite: an admin makes PVs ahead of time
StorageClass	`kind: StorageClass` `provisioner: ebs.csi.aws.com`	The object that describes a class of storage and how to provision it. Its name is how a PVC requests it. • Holds `provisioner`, `parameters`, `reclaimPolicy`, `volumeBindingMode`, `allowVolumeExpansion` • Most fields are immutable after creation
provisioner	`provisioner: ebs.csi.aws.com` `provisioner: kubernetes.io/no-provisioner`	The required field naming the volume plugin (CSI driver) that creates the volume. Determines what backend is used. • Internal names start with `kubernetes.io`; external ones do not • `kubernetes.io/no-provisioner` means no dynamic provisioning
Default StorageClass	`kubectl patch storageclass gold -p` `'{"metadata":{"annotations":` `{"storageclass.kubernetes.io/is-default-class":"true"}}}'`	The class used when a PVC omits `storageClassName` entirely, set by the `is-default-class` annotation. • Needs the DefaultStorageClass admission controller enabled • If several are marked default, the most recently created one wins
volumeBindingMode	`volumeBindingMode: WaitForFirstConsumer` (default is `Immediate`)	Controls WHEN the volume binds and provisions. • `Immediate` (default): at PVC creation, before any Pod, so topology may not fit • `WaitForFirstConsumer`: waits for a Pod, then provisions in that Pod's zone
allowVolumeExpansion	`allowVolumeExpansion: true` then edit the PVC to request a larger size	Lets a PVC be grown later by editing its requested size; must be `true` first. • Resizes the existing volume, never creates a new one • Shrinking a PVC below its current size is not supported
reclaimPolicy (StorageClass)	`reclaimPolicy: Retain` `# default value is Delete`	The policy a dynamically provisioned PV inherits from its class; defaults to `Delete` if unset. • `Delete` removes the PV and the backend storage when the PVC is deleted • This is the class default, not the same as patching a single PV
parameters	`parameters:` `type: gp3` `encrypted: "true"`	Provisioner-specific key value settings passed to the driver when it creates a volume. • Accepted keys differ by provisioner; values are quoted strings • At most 512 parameters per class
storageClassName: ""	`spec:` `storageClassName: ""`	An empty string explicitly disables dynamic provisioning for that PVC, so it binds only to a no-class PV. • Different from omitting the field, which triggers the default class • A PVC already set to `""` is not changed when a default appears
allowedTopologies	`allowedTopologies:` `- matchLabelExpressions:` `- key: topology.kubernetes.io/zone`	Restricts which zones a volume may be provisioned in, used with `WaitForFirstConsumer`. • Replaces older zone and zones parameters • Matches node topology labels such as the zone key

Table 2: Persistent Volumes, Claims, Access Modes and Reclaim Policies

Concept	Example	Description
PersistentVolume (PV) vs PersistentVolumeClaim (PVC)	`PV` = cluster-wide storage resource `PVC` = namespaced request that consumes a PV	• A PV is a piece of storage in the cluster, a resource like a node, with a lifecycle independent of any Pod. • A PVC is a user's request for storage and lives in a namespace. Pods consume PVs by referencing a PVC, never a PV directly.

Table 3: Troubleshoot Clusters and Nodes

Command	Example	Description
kubectl get nodes	`kubectl get nodes` `NAME STATUS ROLES` `node-1 NotReady <none>`	• First move when something is wrong: confirm every node is `Ready`. A `NotReady` line points you at one node to dig into • Does not need metrics-server, that is only for `kubectl top`.

Table 4: Troubleshoot Control Plane and Cluster Components

Concept	Example	Description
Static Pod Manifest Directory	`ls /etc/kubernetes/manifests` `etcd.yaml kube-apiserver.yaml` `kube-controller-manager.yaml kube-scheduler.yaml`	• The kubelet watches this directory and runs each control-plane component as a static Pod. • You fix a broken component by editing its manifest here, not via the API • Not to be confused with a Deployment the scheduler places