Certified Kubernetes Administrator 2026

Explore the basics of container orchestration, its role in automating deployment, scaling, networking, and fault tolerance across fleets of servers, with Kubernetes, Docker Swarm, and EKS.

Explore the basics of Kubernetes, including the control plane, worker nodes, and pods, and learn how the system schedules containers, self-heals, and enables scalable production deployments.

Explore Kubernetes installation options, from managed services like eks and aks to quick local clusters with minikube or kind, and from-scratch setups for full customization.

Configure the local Kubernetes cluster using Kind with Docker container nodes across Windows, macOS, and Linux. Explore using Docker Desktop and Minikube as backup installations.

Configure kind on Windows by downloading the binary, placing it in a binaries folder, and updating PATH so kind runs from any directory, with Docker as a prerequisite.

Configure kind on macOS using brew or manual binary, verify Intel vs ARM, ensure Docker desktop is running for future clusters, and add the binary to path.

Launch a local Kubernetes cluster with Kind by verifying that Kind and Docker are running. Create clusters with custom names like kplabs-k8s and use a configuration file for multi-node setups.

Explore connectivity options to a Kubernetes cluster, including direct API requests, the kubectl CLI, and the Kubernetes dashboard, with kubectl prioritized for exams and real-world use.

Learn how kubectl runs commands against a Kubernetes cluster and uses kube config for authentication. Identify the default location (~/.kube/config) and how to override it with --kubeconfig.

Kubectl connects to a Kubernetes cluster using a kubeconfig file stored in the .kube folder, containing the cluster DNS or IP address and authentication details like tokens and certificates.

Learn to configure a local Kubernetes cluster with minikube on Linux, macOS, and Windows, meeting minimum resources and using Docker or other VM managers.

Understand Kubernetes pods, which can host one or more containers and share network and storage. Learn the docker-to-pod analogy and kubectl basics like run, get pods, describe pod, and exec.

Explore two primary methods to create Kubernetes objects—kubectl run and manifest files—and learn how manifest files enable version-controlled, multi-resource deployments across clusters using kubectl apply.

Explore the basics of Kubernetes resource types, from pods to secrets, and learn how to discover them with kubectl api-resources for effective application lifecycle management.

Master the basic structure of a manifest file, including API version, kind, metadata, and pod spec with containers and images, using YAML and kubectl.

Learn to generate Kubernetes manifest files automatically using kubectl with dry-run=client and output YAML, enabling version-controlled deployments without creating real pods.

Learn to create multi-container pods in Kubernetes using manifest files, and connect to specific containers with kubectl exec -c; understand how containers share network and storage within a pod.

Explore how Kubernetes pods use commands and arguments to control container startup. Learn how command overrides the entry point and arguments override the cmd, with nginx and busybox examples.

explore how to define and override commands and arguments in kubectl run, create pods from busybox, view logs, and apply command and argument overrides in yaml manifests.

Explore how to define command and arguments in Kubernetes manifests using array notation or a multi-line yaml list. Compare readability and learn when to separate command and arguments for clarity.

Explore Kubernetes resources cli documentation for the Certified Kubernetes Administrator 2025 course, using kubectl explain to inspect pod fields, specs, and containers, and compare cli and api reference approaches.

The expose instruction in a docker file informs which port the application inside the container listens on, such as port 80, and guides publishing with the hyphen p option.

Expose ports in a pod by adding a ports section with containerPort, demonstrated with nginx and port 8080; kubectl explain shows this is informational.

Learn how Kubernetes labels and selectors use key-value pairs to tag resources, filter pods and other objects by environment (dev or prod), and simplify resource management.

Attach labels to Kubernetes objects and use selectors to filter pods by environment. Explore labeling in YAML with multiple labels in metadata and manage label-based deployments.

learn how replica sets maintain a stable set of three nginx pods, auto-recreate failed pods across nodes, and scale from three to ten pods as needs evolve.

Create replica sets using manifest files and YAML, exploring labels, selectors, and the pod template. Practice scaling replicas with kubectl to manage pods efficiently.

Identify replica set challenges, such as updates to the pod template not updating existing pods and label collisions. Note the lack of rollback and how deployments address these issues.

Explore how deployments on top of replica sets manage pods, enable rolling updates and versioning, support container image changes, and rollbacks in Kubernetes.

Create and manage deployments with kubectl and manifest files, learn how deployments use replica sets, scale replicas, update images, view rollout history, undo changes, and roll back to revisions.

Explains how multiple worker nodes distribute pods across a Kubernetes cluster to improve fault tolerance and scalability, with kubectl get nodes as a key diagnostic tool.

Learn to scale a DigitalOcean managed Kubernetes cluster by adding worker nodes via node pools, observe pod distribution across nodes with nginx deployment, and remove nodes to minimize cost.

Master node selector in Kubernetes to place pods on appropriately sized nodes based on CPU and memory needs, using node labels like size=medium or large.

Label a worker node and define a matching node selector in the pod spec. The Kubernetes scheduler places the pod on the labeled node, as shown by kubectl.

Explore how a DaemonSet ensures one pod runs on every node, automatically creating pods on new worker nodes, with use cases like antivirus, log collection, and monitoring agents.

Explore the practical creation of daemonsets in Kubernetes, using a minimal YAML manifest and kubectl apply. See how a daemonset maintains one pod per node and adapts as nodes change.

Learn how node affinity extends node selectors, using required and preferred rules with operators like in, not in, exist, and does not exist to schedule pods.

Learn how Kubernetes uses requests and limits to allocate memory and CPU for pods, ensuring fair scheduling and preventing resource starvation in production environments.

Learn how Kubernetes priority classes govern pod scheduling and preemption by assigning high or low priority to pods, enabling the scheduler to preempt lower-priority pods to accommodate higher-priority ones.

Explore multi-container pod design patterns, including sidecar, ambassador, and adapter, to coordinate containers within a pod, share volumes, and transform logs or proxy requests efficiently.

Learn how init containers run before the application containers inside a pod, authenticate to external storage with secrets or tls, and fetch files into a shared volume.

Discover how Kubernetes service provides a stable endpoint and load balances traffic across front-end and back-end pods, scales with deployments, and enables external access to applications.

Explore how a Kubernetes service acts as a gateway, distributing traffic to endpoints, with a hands-on workflow to create a service and manual endpoints, test via curl.

Learn how to register service endpoints using selectors in Kubernetes, replacing hard-coded endpoints with dynamic pod labeling. See how app=backend labels automatically populate service endpoints as pods come and go.

Discover cluster IP as an internal Kubernetes service with a stable internal IP, default type, and how to create it via manifest or kubectl, including ports and targets.

Explore node port service type to expose a Kubernetes app to external world, with a port on every worker node that forwards traffic to backend pods via cluster IP.

Launch a Kubernetes cluster via the CLI to enable node port and load balancer services, using DigitalOcean's doc tl, kubectl, and kubeconfig, while securing API tokens and cleaning up resources.

Create and test a node port service in Kubernetes, linking a backend nginx pod and accessing it via the worker node's public IP and port.

Learn how the Kubernetes load balancer service type exposes apps by routing external traffic through a cloud provider load balancer to node ports, with notes on minikube, DNS, and costs.

Create a load balancer service in a managed Kubernetes cluster using a simple manifest. Verify the external IP and endpoints, then delete the service to remove the load balancer.

Discover how Kubernetes ingress routes traffic from a single load balancer to multiple services using ingress rules and an ingress controller, demonstrated with example and app services.

Learn to create ingress rules with kubectl, mapping hosts to backends like example-service. Explore two-rule examples, manifest yaml dry runs, and how rules precede controller deployment.

Deploy and test an nginx ingress controller to route traffic through an ingress resource with two rules, linking two services and pods to a load balancer.

Learn how helm charts package Kubernetes objects into a single deployable unit, enabling easy production deployments from public repositories like Artifact Hub, with helm install and uninstall commands.

Install the helm binary on your workstation and configure path to recognize it. Download the appropriate release, then install on Windows, macOS, or Ubuntu with apt and verify helm.

Explore practical helm usage with essential commands, chart sources like Artifact Hub and Bitnami, deploying nginx, inspecting resources, and customizing namespaces and templates.

Learn how Kubernetes namespaces isolate resources within a cluster, using development, QA, and production, and manage pods, configmaps, and secrets with kubectl across namespaces including default.

Learn how service accounts enable applications to authenticate to a Kubernetes cluster using tokens attached to pods, differentiating them from human user accounts.

Discover how Kubernetes creates a default per-namespace service account and how pods inherit its permissions. Explore how the service account token is mounted in pods and how RBAC controls access.

Explore practical scenarios for Kubernetes service accounts, including creating accounts with kubectl and mounting a custom service account to pods by specifying serviceAccountName in the pod spec.

Explore named ports in Kubernetes and how services reference a port by name. See practical examples of container ports and named target ports for service routing.

Discover how the metrics server provides cpu and memory metrics in Kubernetes by collecting data from kubelets and exposing it via the metrics API, enabling kubectl top pods and nodes.

Install the metrics server for a Kubernetes cluster, then use kubectl top pods and kubectl top nodes to view cpu and memory metrics, with installation options via yaml or helm.

Learn how the horizontal pod autoscaler in Kubernetes automatically scales deployments based on CPU, memory, or custom metrics, adding or removing pods within min and max limits.

Explore how the horizontal pod autoscaler uses metrics server data and cpu targets to scale a deployment from one to three replicas with resource requests.

Learn how the stabilization window in the horizontal pod autoscaler delays scale-down to prevent instability, contrasts with immediate scale-up, and is tested on a PHP Apache deployment.

Learn how the vertical pod autoscaler automatically adjusts CPU and memory requests based on utilization, provides recommendations, and offers update modes auto, initial, and off to optimize Kubernetes resource use.

Configure and test the vertical pod autoscaler in Kubernetes by installing VPA, deploying nginx, and exploring update modes from off to auto with real-time recommendations.

Discover how the gateway api extends ingress to support tcp, udp, http, and grpc, enabling path-based routing, traffic splitting with weighted backends, header edits, and cross-namespace routing for Kubernetes services.

Explore gateway API structure, including gateway class, gateway, protocol specific route, and service, and explain how the nginx gateway controller implements HTTP routes across layer four and layer seven.

Explore the gateway api with a session: install the nginx gateway fabric, configure a gateway class and http routes, and verify traffic to an apache service behind a load balancer.

Explore TLS configurations on the gateway API, comparing terminate and passthrough modes, and learn how certificates stored as secrets enable secure client-gateway traffic.

Demonstrate TLS terminate mode in the Gateway API by creating a TLS secret, referencing it in the gateway, deploying nginx, and testing HTTPS access.

Explore how ingress features map to Gateway API, including explicit HTTP/HTTPS listeners, TLS termination with secret name or certificate refs, and routing rules via HTTP routes for migration.

Create and manage custom resources in Kubernetes by defining crds, extending the api with custom resource types like database and http route, and using kubectl to apply and inspect them.

Discover how to skip CRDs when installing helm charts, using the skip CRDs flag and conditional values like values.crds.install, and verify outcomes with helm template and a dry run.

Explore how Kubernetes authenticates users through multiple methods, including static tokens, client certificates, bootstrap tokens, service accounts, and OpenID Connect, while noting that Kubernetes itself does not manage user accounts.

Learn how Kubernetes handles authorization after authentication, exploring modes such as always allow, always deny, and RBAC, with a practical demo of permission policies.

Discover role based access control in Kubernetes by linking roles, role bindings, and subjects to manage permissions within namespaces and across the cluster.

Generate a long-lived, service account bound token with kubectl for RBAC testing, then configure environment variables and use curl to verify role and cluster role bindings.

Explore how roles and role bindings grant namespace-scoped permissions in Kubernetes, detailing api groups, resources, verbs, and subjects, with practical kubectl commands and manifest generation.

Explore cluster roles and cluster role bindings, learn how to grant cluster-wide permissions with subjects and role references, and generate manifests with a dry run guided by the rbac documentation.

Discover how asymmetric key encryption uses public and private keys to encrypt data with one key and decrypt with the paired key, enabling secure messages and SSH authentication.

Explain how https extends http with tls, using certificates from trusted authorities like lets encrypt, to establish a secure channel via public key exchange and symmetric keys.

Learn certificate-based authentication for a Kubernetes cluster by creating a key and CSR with OpenSSL, submitting and approving the CSR, and configuring kubectl with a client certificate.

Understand kubeconfig and how kubectl authenticates to Kubernetes using client certificates or tokens; learn about default location and referencing a custom kubeconfig.

Explore the kubeconfig structure in depth, including clusters with server IP or DNS and certificate authority data, users with tokens or certificates, and context mappings for multi-cluster access.

Create a kubeconfig file from scratch by defining clusters, users, and contexts, then manage multiple contexts with get context and use context for development and production clusters.

Discover how Kubernetes volumes solve state persistence and shared storage by persisting data beyond container lifecycles and enabling cross-container access.

Use an emptyDir volume to provide temporary shared storage for multi-container pods, enabling writer and reader containers to share files, with memory or disk backing.

Mount the host file system into a pod with a host path based volume to access worker node logs, configuration files, and write persistent data.

Learn how persistent volumes and persistent volume claims separate storage provisioning from pod manifests, enabling admins to provision PVs and developers to mount them via PVCs in pods.

Create two host path persistent volumes: 1 gb and 3 gb; create a 2 gb PVC with storage class manual; bind it to a pod to observe PV PVC workflow.

Compare static vs dynamic provisioning of persistent volumes in Kubernetes, explaining manual PV creation before PVC, vs automatic PV creation via storage class provisioners, with a DigitalOcean example.

Explore dynamic provisioning in Kubernetes using the Local Path provisioner to create a Local Path storage class and automatically provision PVs for PVCs, with wait for first consumer binding.

Demonstrate how reclaim policies govern what happens to a persistent volume after a PVC is deleted, comparing delete and retain across static and dynamic provisioning with storage classes.

Explore the four PVC access modes—readWriteOnce, readOnlyMany, readWriteMany, and readWriteOnce pod—and how storage class and backend support determine which modes you can use across nodes and pods.

Learn to use config maps to store non-sensitive key-value data in Kubernetes, avoiding hard-coded credentials and enabling environment-specific configuration for apps.

Explore creating Kubernetes config maps with kubectl, using from literal, from file, from env, and from folder path data, including multi-file data and YAML manifest approaches.

Mount ConfigMap data into pods using volume mounts and expose keys as environment variables, demonstrating creation, mounting paths, and referencing ConfigMap data inside containers.

Explore how immutable config maps prevent updates after creation by setting immutable to true, blocking edits. Learn to delete and recreate them and update deployments to reference newer maps.

Explore how security context in Kubernetes enforces non-root privileges using run as user, run as group, and FS group to reduce risks with host path and empty dir volumes.

Learn how Kubernetes secrets provide a centralized store for sensitive data like credentials and tokens, mount them into pods, and apply base64 encoding and RBAC protections.

Learn to create Kubernetes secrets with kubectl create secret generic, using literal or file data; inspect and decode base64 values, then mount secrets into pods via volumes or environment variables.

Understand Kubernetes architecture by examining control plane and worker node components. Learn the roles of API server, etcd, scheduler, controller manager, kubelet, and kube proxy.

Explore how to use sysctl to view and modify kernel parameters such as net.ipv4.ip_forward and vm.swappiness, with temporary changes and permanent persistence via /etc/sysctl.d and sysctl --system.

Set up the Kubernetes worker node with kubeadm by mirroring the master node steps, including containerd installation, repository configuration, and joining the cluster with kubeadm join.

Build a Kubernetes cluster from scratch to learn how two servers—control plane components (kube API server, etcd, scheduler, controller manager) and worker nodes (kubelet, kube proxy)—connect, troubleshoot, and manage versions.

Learn common patterns for building a Kubernetes cluster from scratch, including certificate authority based authentication, per-component certificates, kubeconfig files, and systemd managed services.

Launch two-server Kubernetes cluster from scratch, configuring control plane components (etcd, scheduler, controller manager) and a worker node (kubelet, kube proxy), with consistent hostnames for reliable setup.

Download server, node, and client binaries for a Kubernetes cluster, including API server, scheduler, and controller manager in server binaries, kubelet and kube-proxy in node binaries, and kubectl as client.

Download Kubernetes server binaries for control plane and node binaries for the worker nodes, create a root binaries folder, and extract API server, controller manager, scheduler, kubelet, and kube proxy.

Explore how a certificate authority issues signed certificates for Kubernetes components and enables secure, trusted communication. Understand verification across sender and receiver to ensure identity and trust within the cluster.

Create a certificate authority by generating a private key and CSR, self-sign to form the Kubernetes CA certificate and key, stored in the root certificates folder for cluster components.

Configure etcd on the control plane by creating and signing etcd certificates with the certificate authority, setting the server IP, deploying etcd with systemd, and verifying data storage with etcdctl.

Configure the kube api server in the control plane by specifying etcd endpoints and mutual tls certificates, including ca, cert, and key files, to enable etcd-backed data storage.

Configure the kube api server on the control plane by moving the binary to /usr/local/bin, generate api server certificates using server_ip, and start the service with systemd.

Configure the controller manager on the control plane node, generate certificates and a kube config file, and start the service with systemd to securely connect to the API server.

Configure the Kubernetes scheduler by generating certificates and a kubeconfig, deploying the scheduler binary, and starting it with systemd so the API server can assign pods to nodes.

Validate the Kubernetes cluster status by checking control plane components with systemctl and kubectl, configure an admin kubeconfig, and verify namespaces and secrets to confirm a healthy single-server control plane.

Configure a Kubernetes worker node by installing the container runtime, configuring kubelet and kube proxy, generating certificates, deploying kube configs, and starting services to join the control plane.

Configure networking on worker and control plane nodes with CNI plugins and Calico, enabling node readiness. Verify nginx pod creation and resolve DNS and permission issues; note upcoming RBAC.

Set up rbac permissions by applying the cluster rule and cluster role binding on the control plane, then re-run kubectl exec until access succeeds after a short propagation delay.

Configure CoreDNS in the cluster and verify name resolution by deploying DNS components, then test with a BusyBox pod using nslookup and ping to google.com.

Learn how to configure kubelet preferred address type to use the internal IP, enabling the API server to connect to kubelets when hostnames are not resolvable.

Explore the impact of breaking down a Kubernetes cluster by stopping the kube scheduler, kubelet, and controller manager, creating pods, and observing pod status and service accounts across namespaces.

Explore how Kubernetes network policies act like port-level firewalls to govern ingress and egress between pods, using pod selectors, namespace selectors, and an IP block.

Explore the structure of a Kubernetes network policy, including api version, kind, metadata, spec with pod selector, policy types, ingress and egress rules, and from, to, and ip blocks.

explores practical network policies in Kubernetes, including ingress and egress rules, pod selectors, namespace selectors, match labels, and IP block, with hands-on testing.

Understand static pods run by kubelet without the API server by placing pod manifests in the kubelet manifest path for direct pod deployment and management.

Explore taints and tolerations in a Kubernetes cluster, showing how taints repel pods and how tolerations provide a special pass for tainted nodes.

Edit existing Kubernetes resources using kubectl edit or patch, updating labels, annotations, pods, and configmaps, and more. Learn when to use each method and understand mutable versus immutable fields.

Explore node capacity, allocatable, and allocated resources in Kubernetes, and learn to assess CPU, memory, and storage for pods using kubectl describe node and kubectl get pods.

Analyze how to set pod requests and limits by comparing allocatable and allocated CPU and memory, and understand scheduling failures when a pod consumes all resources.

Learn to use JSON path to query kubectl outputs, create two pods (nginx and Apache), and extract pod names, IPs, and metadata.

Secure ingress traffic with TLS and HTTPS by configuring the ingress controller. Use Kubernetes secrets to store the TLS certificate and key and reference them in the ingress TLS configuration.

Set up ingress with TLS in a Kubernetes cluster using a self-signed certificate, including Nginx ingress, TLS secret, and an example ingress.

Understand the container runtime interface (CRI) that decouples kubelet from Docker, enabling runtimes like containerd and CRI-O. Learn how the kubelet uses CRI to manage containers and images.

Configure the cri docker d adapter to enable kubelet to manage docker containers via the kubernetes container runtime interface, install docker, set up kubeadm, and verify with nginx pods.

Kubernetes events show resource state changes and scheduler decisions, and you can view them with kubectl get events, noting the default one-hour retention and namespace scope.

Learn how field selectors filter Kubernetes resources by field values, such as listing ports across namespaces except the default, using metadata.namespace and other fields for precise troubleshooting of events.

Understand docker logging drivers, capturing standard output and error with the docker logs command, and learn why json-file is default while others like syslog, Splunk, and journaled vary in behavior.

Learn how Kubernetes captures pod logs with kubectl logs, including multi-container pods; deploy BusyBox pods with kubectl apply and fetch container-specific output to debug.

Explore cluster component logs for Kubernetes, using journalctl to view Kube API server, scheduler, controller manager, kubelet, and kube proxy logs; filter by time with since and until.

Explore the Kubernetes pod lifecycle, from pending to unknown, with examples of scheduling, image pull errors, and running, succeeded, or failed phases for debugging workloads.

Explore Kubernetes container restart policies, including always (default), on failure, and never, and learn how self-healing restarts pods based on exit codes using BusyBox and nginx examples.

Troubleshoot Kubernetes application failures by inspecting pods, services, and dependencies, then diagnose a nodeport setup and fix the application-failure YAML to restore the nginx page.

Identify and fix app failure in a Kubernetes setup by diagnosing a NodePort service and missing endpoints caused by namespace and label-selector mismatches.

Identify and troubleshoot control plane failures by validating application configs, checking cluster components with kubectl get componentstatus and cluster info, and inspecting logs via journalctl and cluster info dump.

Learn the Kubernetes version skew policy and how component versions—API server, controller manager, scheduler, kubelet, kube proxy, kubectl—must align for stability. The policy defines allowable minor-version differences and live upgrades.

Drain a worker node to safely migrate pods to other nodes during maintenance. Learn kubectl drain usage, manage daemonsets, and handle replicas and static pods for reliable OS upgrades.

Explore taint based evictions in Kubernetes, using tolerations to govern pod eviction timing during node issues. Learn to adjust toleration seconds to minimize downtime and ensure pods are rescheduled.

Enforce tls 1.3 in a secure nginx deployment by updating the immutable config map to version two and restarting the deployment, then verify with openssl tests.

Recreate the MariaDB deployment and its persistent volume claim to bind to the existing retained PV, then verify the MariaDB pod runs and the var/lib/mysql/initial.txt file exists.