Overview
Domain 1 is the foundation of the KCNA. It covers what Kubernetes is made of and how its objects behave: the control plane components (kube-apiserver, etcd, kube-scheduler, kube-controller-manager) and node components (kubelet, kube-proxy, container runtime), plus the core API objects such as Pods, ReplicaSets, Deployments, StatefulSets, DaemonSets, Jobs, Services, Namespaces and labels. Administration covers kubectl, declarative manifests, the API structure and resource versions. Scheduling asks how the scheduler filters and scores nodes using resource requests, nodeSelector, affinity, taints and tolerations. Containerization covers images, layers, registries, the OCI specifications and the Container Runtime Interface with runtimes such as containerd and CRI-O.
The exam is multiple choice, so you will not type commands, but you must recognise what a manifest or command does. The curriculum was revised in November 2025, and this domain remains the anchor for every other one.
How it's tested
Domain 1 questions are mostly short identification items: which component performs a task, which object fits a workload, or what a field in a manifest controls. Some give a small YAML fragment or a kubectl command and ask what happens. Expect several questions that differ only in one component name.
-
Which component does this
A responsibility is described, such as persisting cluster state or assigning a Pod to a node, and you pick the control plane or node component that owns it.
-
Pick the workload object
A workload is described by its needs, such as one copy per node or stable network identity, and you choose Deployment, StatefulSet, DaemonSet, Job or CronJob.
-
Why is the Pod Pending
A Pod cannot be placed and you identify the scheduling cause, such as insufficient requested CPU, an untolerated taint or an unmatched node selector.
A question asks which component writes the chosen node name into a new Pod's spec. The kubelet is tempting because it runs the Pod, but it only acts once the Pod is bound to its node. The kube-scheduler watches for unscheduled Pods, selects a node and creates a binding through the API server. So the answer is kube-scheduler, and etcd only stores the result.
Topics 4
Official topics from the CNCF / The Linux Foundation outline, in outline order.
1.1 Kubernetes Core ConceptsCluster architecture, the API object model and the main workload objects.
- What it means
- The control plane runs kube-apiserver, etcd, kube-scheduler and kube-controller-manager (plus cloud-controller-manager on cloud providers), while each worker node runs the kubelet, kube-proxy and a container runtime. Workloads are expressed as API objects whose spec states desired state and whose status reports observed state.
- What to understand
- Controllers run reconciliation loops that compare spec with status and act to close the gap. A Pod is the smallest deployable unit and can hold several containers sharing a network namespace and volumes. Deployments manage ReplicaSets for stateless apps, StatefulSets give ordered names and per-replica storage, DaemonSets run one Pod per node, and Jobs and CronJobs run work to completion. Labels and selectors connect Services and controllers to Pods.
- How it shows up
- Expect component-to-responsibility matching and choosing the right controller for a described workload.
- Common confusion
- Thinking etcd or the scheduler talks to nodes directly; every component communicates through the kube-apiserver.
1.2 AdministrationWorking with the cluster through kubectl, manifests and the API.
- What it means
- Administration covers how people and tools interact with a cluster: kubectl verbs, kubeconfig contexts, namespaces, declarative YAML manifests, API groups and versions, and basic cluster lifecycle ideas such as upgrades and adding nodes.
- What to understand
- kubectl apply is declarative and merges a manifest into the live object, while create and replace are imperative. Every manifest needs apiVersion, kind, metadata and usually spec. kubectl get, describe, logs and explain are the main reading tools. Namespaces scope names and many policies but not nodes or PersistentVolumes. Custom Resource Definitions extend the API with new kinds that operators manage.
- How it shows up
- You may be shown a command or manifest and asked what it creates, or which kubectl verb answers a question.
- Common confusion
- Treating namespaces as a security boundary on their own, when isolation needs RBAC and NetworkPolicy as well.
1.3 SchedulingHow the kube-scheduler chooses a node for each Pod.
- What it means
- Scheduling is the process of assigning each new Pod to a node. The kube-scheduler first filters out nodes that cannot run the Pod, then scores the rest and binds the Pod to the highest-scoring node.
- What to understand
- Filtering considers resource requests against allocatable capacity, nodeSelector and node affinity, taints the Pod does not tolerate, and Pod affinity or anti-affinity. Limits are not used for placement; requests are. A taint repels Pods, and a toleration only permits placement without attracting the Pod. If no node passes filtering, the Pod stays Pending with a FailedScheduling event. Priority classes can trigger preemption of lower-priority Pods.
- How it shows up
- A Pending Pod scenario, or a requirement such as keeping Pods on GPU nodes, asks which scheduling feature applies.
- Common confusion
- Believing a toleration forces a Pod onto the tainted node; affinity or a nodeSelector is needed for that.
1.4 ContainerizationImages, registries, runtimes and the standards beneath Kubernetes containers.
- What it means
- Containerization is packaging an application with its dependencies into an image that runs as an isolated process using Linux namespaces and cgroups. Images are built from layered filesystems, stored in registries and pulled by a container runtime.
- What to understand
- The Open Container Initiative defines image, runtime and distribution specifications, so images built by any compliant tool run anywhere. The kubelet talks to runtimes such as containerd or CRI-O through the Container Runtime Interface; dockershim was removed in Kubernetes 1.24, though Docker-built images still run. Tags are mutable while digests identify an exact image. Small base images and non-root users reduce attack surface.
- How it shows up
- Questions ask what CRI or OCI standardises, how a container differs from a virtual machine, or what a Dockerfile instruction does.
- Common confusion
- Assuming Kubernetes can no longer run images built with Docker after dockershim was removed.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
kube-apiserver
The front end of the control plane through which every read and write passes.
- Remember
- It validates requests, applies admission control and is the only component that talks to etcd.
- Tested as
- Many component questions hinge on everything going through the API server.
- Trap
- Picking etcd as the component that clients or nodes contact.
-
etcd
A consistent, distributed key-value store holding all cluster state.
- Remember
- Losing etcd without a backup means losing the cluster's desired state.
- Tested as
- Asked as the answer to 'where is cluster state stored'.
- Trap
- Confusing it with a container registry or log store.
-
kube-scheduler
Assigns unscheduled Pods to nodes by filtering and scoring.
- Remember
- It decides placement but does not start containers.
- Tested as
- Pending Pods and placement questions point here.
- Trap
- Choosing the kubelet for placement decisions.
-
kube-controller-manager
Runs built-in controllers such as the ReplicaSet, Node and Job controllers.
- Remember
- Controllers reconcile desired state with actual state in a loop.
- Tested as
- Explains why a deleted Pod in a Deployment comes back.
- Trap
- Thinking the scheduler recreates missing Pods.
-
kubelet
The node agent that ensures containers described in assigned Pods are running and healthy.
- Remember
- It runs probes and reports Pod status back to the API server.
- Tested as
- Node-side responsibility questions usually point here.
- Trap
- Mixing it up with kube-proxy, which handles Service traffic rules.
-
Deployment and ReplicaSet
A Deployment manages ReplicaSets, which keep a set number of identical Pods running.
- Remember
- Rolling updates create a new ReplicaSet and scale the old one down.
- Tested as
- Default answer for stateless applications.
- Trap
- Choosing a StatefulSet for a stateless web front end.
-
StatefulSet
Runs Pods with stable names, ordered rollout and a dedicated volume claim each.
- Remember
- Pods are named app-0, app-1 and keep their identity when rescheduled.
- Tested as
- Databases and clustered stateful systems point here.
- Trap
- Assuming a Deployment gives each replica its own persistent volume.
-
DaemonSet
Runs one copy of a Pod on every eligible node.
- Remember
- New nodes automatically receive the Pod.
- Tested as
- Log collectors and node monitoring agents point here.
- Trap
- Setting a Deployment's replica count to match the node count.
-
Requests vs. limits
Requests are what the scheduler reserves; limits cap what a container can use.
- Remember
- Exceeding a memory limit gets the container OOMKilled; CPU over the limit is throttled.
- Tested as
- Scheduling and resource questions turn on this difference.
- Trap
- Thinking limits influence which node is chosen.
-
Taints and tolerations
A node taint repels Pods that lack a matching toleration.
- Remember
- Effects are NoSchedule, PreferNoSchedule and NoExecute.
- Tested as
- Used for dedicated or control plane nodes.
- Trap
- Expecting a toleration to attract a Pod to a node.
-
CRI and containerd
The Container Runtime Interface is the API the kubelet uses to drive any compliant runtime.
- Remember
- containerd and CRI-O are the common CRI runtimes today.
- Tested as
- Questions on what replaced dockershim lead here.
- Trap
- Naming Docker Engine as the required runtime.
-
OCI image
An image format defined by the Open Container Initiative made of layers and a manifest.
- Remember
- A digest pins an exact image; a tag can be moved.
- Tested as
- Immutability and supply chain questions use this.
- Trap
- Treating the latest tag as a fixed version.
-
Labels and selectors
Key-value pairs on objects and the queries that match them.
- Remember
- Services and controllers find their Pods by selector, not by name.
- Tested as
- Explains how traffic and ownership are wired.
- Trap
- Assuming annotations can be used for selection.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Deployment vs. StatefulSet vs. DaemonSet vs. Job
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Deployment | Keeps N interchangeable replicas of a stateless app | Supports rolling updates and rollbacks through ReplicaSets | Using it for databases that need stable identity |
| StatefulSet | Runs replicas with stable names and individual storage | Ordered creation and deletion | Expecting it to be the default for every app |
| DaemonSet | One Pod on each node | Replica count follows the number of nodes | Choosing it for an app that needs three replicas |
| Job / CronJob | Runs Pods until a task completes, once or on a schedule | Pods are not restarted after success | Using a Deployment for a nightly batch task |
Control plane vs. node components
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| kube-apiserver | Central REST API and gatekeeper | Only component that reads and writes etcd | Thinking nodes connect to etcd |
| kube-scheduler | Chooses a node for each Pod | Placement only | Assuming it starts containers |
| kubelet | Runs and monitors Pods on a node | Talks to the runtime through CRI | Confusing it with kube-proxy |
| kube-proxy | Programs Service routing rules on a node | Uses iptables or IPVS, not application logic | Thinking it is an HTTP reverse proxy |
Container vs. virtual machine
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Container | Isolated process sharing the host kernel | Starts in seconds with a small footprint | Assuming it has its own kernel |
| Virtual machine | Full guest OS on a hypervisor | Stronger isolation at higher resource cost | Believing containers are lightweight VMs with separate kernels |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
etcd as the hub
- What candidates pick
- etcd as the component that kubelets or kubectl contact.
- Why it looks right
- etcd holds all the data, so it seems central.
- Why it's wrong
- Only the kube-apiserver talks to etcd; every client and node component goes through the API server.
Clue to watch for Wording such as 'which component do clients send requests to'.
-
Toleration as attraction
- What candidates pick
- Adding a toleration to make Pods run on dedicated nodes.
- Why it looks right
- The toleration matches the taint, so placement seems assured.
- Why it's wrong
- A toleration only allows scheduling on the tainted node; without affinity or a nodeSelector the Pod may still land elsewhere.
Clue to watch for A requirement that Pods run only on certain nodes.
-
Limits drive scheduling
- What candidates pick
- Answering that the scheduler checks container limits.
- Why it looks right
- Limits are the larger, more visible number.
- Why it's wrong
- The scheduler sums requests against allocatable node capacity and ignores limits for placement.
Clue to watch for A Pending Pod with 'Insufficient cpu' in its events.
-
Scheduler restarts Pods
- What candidates pick
- Naming the kube-scheduler as what replaces a deleted Pod.
- Why it looks right
- It is the component most associated with Pods.
- Why it's wrong
- The ReplicaSet controller creates the replacement; the scheduler then only places it.
Clue to watch for A Pod belonging to a Deployment is deleted and reappears.
-
Docker required
- What candidates pick
- Docker Engine as the runtime every node must run.
- Why it looks right
- Docker is the best-known container tool.
- Why it's wrong
- Kubernetes uses any CRI runtime such as containerd or CRI-O, and Docker-built OCI images run on them.
Clue to watch for Answer options that mention CRI, containerd or dockershim.
-
Namespace as full isolation
- What candidates pick
- Separate namespaces as the complete answer to tenant isolation.
- Why it looks right
- Namespaces visibly separate resources.
- Why it's wrong
- Namespaces scope names and quotas, but network and API access need NetworkPolicy and RBAC.
Clue to watch for A question about preventing one team's Pods from reaching another's.
Answer framework
Use this sequence for Domain 1 questions about components, objects and placement.
- Decide whether the question is about state, decisions or execution: state points to etcd, decisions to the scheduler or controllers, and execution to the kubelet and runtime.
- For a workload description, look for identity, per-node, run-to-completion or stateless clues and map them to StatefulSet, DaemonSet, Job or Deployment.
- For a placement problem, check requests against capacity first, then nodeSelector and affinity, then taints without matching tolerations.
- For a manifest or command, read apiVersion, kind and the verb, and ask whether the action is declarative or imperative.
- For container questions, separate the image standard (OCI), the kubelet's interface (CRI) and the runtime itself (containerd or CRI-O) before choosing.
Practice question
Want more like this? The KCNA practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with architecture because every later topic depends on it. Draw the control plane and a worker node from memory, label each component, and trace a kubectl apply of a Deployment from the API server to running containers. Repeat until you can explain each hand-off without notes.
Then build a small local cluster with kind or minikube. Create a Deployment, a StatefulSet, a DaemonSet and a Job, delete Pods and watch controllers replace them, and run kubectl explain on fields you do not recognise. Even though the exam is multiple choice, seeing objects behave makes the vocabulary stick.
For scheduling, create a Pod with a large CPU request so it stays Pending, then taint a node and add a toleration to observe what does and does not change. Read the events each time.
Finish with containerization: build an image, inspect its layers, pull it by digest and note which runtime your cluster uses. Because this domain is 44% of the exam, plan the largest share of your study time here and revisit it with practice questions in your final week.
FAQ
How much of the KCNA is Kubernetes Fundamentals?
Kubernetes Fundamentals is weighted at 44%, the largest of the four domains. On a 60-question exam that is about 26 questions, so it deserves the most study time.
Do I need to run kubectl commands in the KCNA exam?
No. The KCNA is multiple choice, but questions show commands and manifests and ask what they do, so hands-on practice still helps.
Which Kubernetes components should I memorise?
kube-apiserver, etcd, kube-scheduler, kube-controller-manager and cloud-controller-manager on the control plane, plus kubelet, kube-proxy and the container runtime on each node.
Is Docker still used with Kubernetes?
Docker can still build images, and those OCI images run on Kubernetes. The kubelet now uses CRI runtimes such as containerd or CRI-O instead of the removed dockershim.
What changed in this domain in the 2025 curriculum?
The November 2025 revision regrouped it into Core Concepts, Administration, Scheduling and Containerization and set its weight at 44%, down from 46% in the earlier outline.
How deep should my scheduling knowledge be?
Know requests, nodeSelector, node affinity, taints and tolerations, and how to read a Pending Pod's FailedScheduling event. Scheduler internals and custom schedulers are beyond the associate level.
Do I need to know Custom Resource Definitions?
Know the idea: a CRD adds a new object kind to the API, and an operator or controller acts on it. Writing one is not expected.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
Practise identifying control plane and node components, choosing workload objects and explaining scheduling outcomes in timed sets of questions.