CKAD Tests Shipping Working Workloads Fast in a Terminal — Not Architecture Knowledge
CKAD is a two-hour, 15–20 task lab on Kubernetes v1.37 for developers. Speed with kubectl generators, exact names and fixing the owning template rather than the Pod is what separates a pass from a near miss.
Check Your Readiness →Most candidates understand Certified Kubernetes Application Developer (CKAD) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Every task names a context and namespace, and grading reads live objects or answer files at exact paths. Most items combine objects, such as a ConfigMap, Secret and securityContext inside one Deployment, so a single wrong key name loses the whole task.
Add the helper as a second entry under containers
Declare it under initContainers with restartPolicy: Always, a native sidecar that starts first and keeps running. Share an emptyDir mounted in both containers, then export, delete and recreate the bare Pod because those fields are immutable.
Raise initialDelaySeconds on the liveness probe to 120
Add a startupProbe, for example periodSeconds 10 with failureThreshold 12, so liveness and readiness wait until it succeeds. The existing fast liveness check then protects the running app without delaying recovery.
Increase the canary replica count until traffic appears
The Service selector still includes version=v1, so v2 Pods never match. Select only a shared label such as app=api; traffic then splits roughly by replica ratio across both Deployments.
Set only the schedule and the job template
concurrencyPolicy defaults to Allow, so overlapping runs stack up. Set concurrencyPolicy: Forbid to skip, or Replace to stop the old run. Retries are backoffLimit; completions counts required successes.
Readiness failure pulls the Pod from Service endpoints without restarting it; liveness failure restarts the container. For slow starters, add a startupProbe whose failureThreshold × periodSeconds covers boot time instead of inflating initialDelaySeconds on liveness.
capabilities exists only on the container securityContext, and names drop the CAP_ prefix: add ["NET_BIND_SERVICE"]. runAsUser and runAsNonRoot can sit at either level; allowPrivilegeEscalation is container-level only.
Pods refused at admission are never created, so kubectl get pods shows nothing. The error lives in the ReplicaSet events. A compute quota in the namespace also means every container must declare requests and limits, or a LimitRange must supply defaults.
undo returns only to the previous revision. Check kubectl rollout history, then use --to-revision=2. Scaling never creates revisions, and Helm releases use their own numbers through helm history and helm rollback.
The ReplicaSet replaces that Pod from the template without the label. Patch the Deployment's Pod template labels instead, and leave the policies untouched when the task says not to modify them.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
CKAD rewards exact, fast kubectl work. See which task types still slow you down.