The Certified Kubernetes Application Developer (CKAD) exam, offered by the Linux Foundation, validates your ability to design, build, and deploy applications on Kubernetes. This certification is ideal for developers who work with containerized applications and need to demonstrate practical expertise in the Kubernetes ecosystem. This guide provides a structured overview of the exam domains, question formats, and a clear preparation roadmap to help you succeed on test day.
Use this topic map to guide your study for Linux Foundation CKAD (Certified Kubernetes Application Developer) within the Kubernetes Application Developer path.
The CKAD exam combines multiple question types to evaluate both conceptual knowledge and hands-on problem-solving skills. Questions progress in difficulty and emphasize real-world scenarios you'll encounter in production environments.
Effective preparation requires mapping exam domains to a structured study schedule and reinforcing concepts through practical exercises. Allocate time proportionally to each topic, prioritize hands-on labs, and use practice tests to identify gaps before exam day.
Explore other Linux Foundation certifications: view all Linux Foundation exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to CKAD and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a Bundle Discount offer for both formats: Certified Kubernetes Application Developer.
The CKAD exam focuses on practical, hands-on skills for developing and deploying applications on Kubernetes. Rather than testing theoretical knowledge alone, it emphasizes your ability to build container images, configure deployments, manage networking, and troubleshoot issues in a live cluster environment.
In practice, you start with Application Design and Build by creating and containerizing your code. Next, you use Application Deployment to release it on Kubernetes. Application Environment, Configuration and Security ensures your app has the right settings and access controls. Services and Networking makes your app reachable to users and other services. Finally, Application Observability and Maintenance keeps your app healthy and running smoothly in production.
You should be comfortable with basic kubectl commands, writing YAML manifests, and deploying simple applications to a Kubernetes cluster. Ideally, complete at least 2-3 months of hands-on practice with labs that cover all five exam domains. Focus on labs that simulate real scenarios: deploying multi-tier applications, configuring networking policies, and troubleshooting pod failures.
Common mistakes include misunderstanding the difference between Services and Ingress, overlooking resource requests and limits, writing YAML with incorrect indentation or field names, and failing to verify that deployed applications actually work. Many candidates also rush through scenario-based questions without fully reading requirements. Slow down, read each question twice, and always test your configurations before submitting.
In your final week, focus on weak domains identified in practice tests rather than re-reading notes. Complete at least two full-length practice tests under exam conditions to build confidence and pacing. Review your mistakes carefully, then spend 2-3 hours doing targeted hands-on labs in those specific areas. On the day before the exam, do a light review of key commands and concepts, then rest well.
SIMULATION
Context
Your application's namespace requires a specific service account to be used.
Task
Update the app-a deployment in the production namespace to run as the restrictedservice service account. The service account has already been created.
Solution:
SIMULATION
Context
An existing web application must be exposed externally.
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00025
An application externally using the URL external.sterling-bengal.local . Any requests starting with / must be routed to the application web-app.
To test the web application's external reachability, run
[candidate@ckad00025] $ curl http://external.sterling-bengal.local/
or open this URL in the remote desktop's browser.
ssh ckad00025
You need to expose the existing app ''web-app'' externally at:
Host: external.sterling-bengal.local
Path: / (and anything starting with /) route to web-app
In CKAD labs, this is almost always done with an Ingress pointing to the Service web-app.
1) Find where web-app Service lives (namespace + port)
kubectl get svc -A | grep -w web-app
You'll get something like:
<NAMESPACE> web-app ClusterIP ... <PORT>/TCP
Set the namespace:
NS=<NAMESPACE>
Check the service port(s):
kubectl -n $NS get svc web-app -o yaml
Note the service port number (commonly 80).
Also verify it has endpoints (so it actually routes to pods):
kubectl -n $NS get endpoints web-app -o wide
If endpoints are empty, the Service selector doesn't match pods --- tell me and I'll give the exact fix. But usually it's fine.
2) Create the Ingress to route / to web-app
Create a manifest (use the service port you saw; I'll assume 80 below):
cat <<'EOF' > web-app-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web-app-ingress
spec:
rules:
- host: external.sterling-bengal.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web-app
port:
number: 80
EOF
Apply it:
kubectl -n $NS apply -f web-app-ingress.yaml
Verify:
kubectl -n $NS get ingress web-app-ingress
kubectl -n $NS describe ingress web-app-ingress
If your Service port is not 80, change number: 80 to the correct value and re-apply.
3) Test external reachability (as instructed)
Run exactly:
curl -i http://external.sterling-bengal.local/
If curl still fails (quick checks)
A) Is there an ingress controller running?
kubectl get pods -A | egrep -i 'ingress|nginx'
kubectl get svc -A | egrep -i 'ingress|nginx'
B) Does Ingress show an address?
kubectl -n $NS get ingress web-app-ingress -o wide
C) Do we have endpoints?
kubectl -n $NS get endpoints web-app -o wide
SIMULATION
Set Configuration Context:
[student@node-1] $ | kubectl
Config use-context k8s
Context
A web application requires a specific version of redis to be used as a cache.
Task
Create a pod with the following characteristics, and leave it running when complete:
* The pod must run in the web namespace.
The namespace has already been created
* The name of the pod should be cache
* Use the Ifccncf/redis image with the 3.2 tag
* Expose port 6379
Solution:
SIMULATION
Context
You are asked to deploy an application developed for an older version of Kubernetes on a cluster running a recent version of Kubernetes .
You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00026
Task
Fix any API -deprecation issues in the manitest file
/home/candidate/credible-mite/web.yaml
so that the application can be deployed on cluster ckad00026.
The application was developed for Kubernetes v1.15.
The cluster ckad00026 runs Kubernetes 1.29+.
Deploy the application specified in the updated manifest file
/home/candidate/credible-mite/web.yaml in namespace garfish .
ssh ckad00026
Your job is to edit /home/candidate/credible-mite/web.yaml so it uses APIs supported on Kubernetes 1.29+, then deploy it into namespace garfish.
Because I can't see your file from here, the most reliable exam approach is:
run a server-side dry-run to reveal the exact deprecated/removed APIs and schema errors
edit the manifest to the modern API versions/fields
re-run dry-run until it passes
apply for real and verify rollout
1) Go to the manifest and run a server-side dry-run
cd /home/candidate/credible-mite
ls -l
sed -n '1,200p' web.yaml
Make sure the namespace exists:
kubectl get ns garfish || kubectl create ns garfish
Now run a server-side dry-run (this catches removed APIs on the cluster):
kubectl apply -n garfish -f web.yaml --dry-run=server
Whatever errors you get here tell you exactly what to fix.
2) Fix the common v1.15 v1.29 API deprecations
Edit the file:
vi web.yaml
Below are the most common objects from older manifests and how to update them for 1.29+.
A) Deployments / DaemonSets / StatefulSets
Old (v1.15 often used):
extensions/v1beta1 or apps/v1beta1 or apps/v1beta2
New:
apiVersion: apps/v1
Also in apps/v1, .spec.selector is required and must match the pod template labels.
Example conversion:
apiVersion: apps/v1
kind: Deployment
metadata:
name: web
spec:
replicas: 2
selector:
matchLabels:
app: web
template:
metadata:
labels:
app: web
spec:
containers:
- name: web
image: nginx
Key rule:
spec.selector.matchLabels must exactly match spec.template.metadata.labels (at least for the keys you select on).
B) Ingress
Old:
apiVersion: extensions/v1beta1 (or networking.k8s.io/v1beta1)
New:
apiVersion: networking.k8s.io/v1
Required changes:
spec.rules.http.paths[].pathType is required (usually Prefix)
backend format changes from serviceName/servicePort to service.name/service.port.number (or .name for named ports)
Old backend:
backend:
serviceName: web
servicePort: 80
New backend:
backend:
service:
name: web
port:
number: 80
Full path example:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
spec:
rules:
- host: example.local
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port:
number: 80
C) CronJob
Old:
apiVersion: batch/v1beta1
New:
apiVersion: batch/v1
Most fields stay the same; just update apiVersion.
D) PodDisruptionBudget
Old:
policy/v1beta1
New:
policy/v1
spec.selector/minAvailable/maxUnavailable remain, but apiVersion changes.
E) RBAC
Usually already:
rbac.authorization.k8s.io/v1 (this is fine)
F) Removed APIs you must delete/replace
If you see these in a v1.15-era manifest, they are removed in modern clusters:
PodSecurityPolicy (policy/v1beta1) is removed. You cannot deploy it on 1.29+. Remove it from the manifest (or replace with whatever your environment uses, but for CKAD tasks you usually delete PSP sections from the file).
Some old admission/alpha resources also removed.
If dry-run complains ''no matches for kind ... in version ...'', that's your cue.
3) Re-run dry-run until it succeeds
After you edit:
kubectl apply -n garfish -f web.yaml --dry-run=server
Keep iterating until there are no errors.
4) Deploy for real
kubectl apply -n garfish -f /home/candidate/credible-mite/web.yaml
5) Verify everything in namespace garfish
List what was created:
kubectl -n garfish get all
kubectl -n garfish get ingress 2>/dev/null || true
If there is a Deployment, verify rollout:
kubectl -n garfish get deploy
kubectl -n garfish rollout status deploy --all
Check pods/events if something fails:
kubectl -n garfish get pods -o wide
kubectl -n garfish describe pod
kubectl -n garfish get events --sort-by=.lastTimestamp | tail -n 30
SIMULATION
Context
Anytime a team needs to run a container on Kubernetes they will need to define a pod within which to run the container.
Task
Please complete the following:
* Create a YAML formatted pod manifest
/opt/KDPD00101/podl.yml to create a pod named app1 that runs a container named app1cont using image Ifccncf/arg-output
with these command line arguments: -lines 56 -F
* Create the pod with the kubect1 command using the YAML file created in the previous step
* When the pod is running display summary data about the pod in JSON format using the kubect1 command and redirect the output to a file named /opt/KDPD00101/out1.json
* All of the files you need to work with have been created, empty, for your convenience
Solution:
