CertGrid CertGrid

CKAD (Certified Kubernetes Application Developer)

Building, configuring and shipping apps on a cluster.

44 published guides

29 of 44 guides need path access. Unlock CKAD path

44-guide Certified Kubernetes Application Developer learning path · 44 published · about 660 min of reading · 8 learning tracks · reviewed 26 August 2026

Orientation2 guides

What CKAD asks for, what it never asks for, and the cluster you will use.

  1. Concepts 12 min

    CKAD Exam Format and Scope

    Count what a CKAD task can actually be about, and rule out the whole half of Kubernetes the exam never touches.

    80 namespaced kinds

    Updated 23 Aug 2026

  2. Installation 11 min

    The CKAD Practice Cluster

    Inventory the working cluster you are handed - storage class, ingress controller, metrics - so no later guide has to stop and install one.

    kubectl get ingressclass

    Updated 23 Aug 2026

Working at Exam Speed4 guides

Generate YAML instead of typing it, and find the field without leaving the terminal.

  1. Hands-on Lab 15 min

    Generating YAML with --dry-run=client

    Produce a valid manifest for every object CKAD asks for in under a tenth of a second, and edit it instead of writing YAML from memory.

    --dry-run=client -o yaml

    Updated 23 Aug 2026

  2. Hands-on Lab 12 min

    Setting the Default Namespace in a Context

    Stop losing marks to commands that ran in the wrong namespace, and learn the two flags that look across all of them.

    config set-context --current

    Updated 23 Aug 2026

  3. Hands-on Lab 16 min

    Editing Live Objects: apply, edit, patch and replace

    Use set, patch and replace on a live Deployment, and meet the two fields that refuse to change no matter which one you use.

    field is immutable

    Updated 23 Aug 2026

  4. Hands-on Lab 13 min

    Using kubectl explain for Field Reference

    Get the exact field name and nesting out of the cluster in front of you, without opening a browser tab.

    explain --recursive

    Updated 23 Aug 2026

Application Design and Build9 guides

Multi-container Pods, init and sidecar containers, Jobs, and images you built yourself.

  1. Hands-on Lab 14 min

    Multi-Container Pods: Shared Network and Volumes

    Prove which parts of a Pod are shared between its containers and which are not, with four commands instead of a diagram.

    wget -qO- http://localhost

    Updated 23 Aug 2026

  2. Hands-on Lab 14 min

    Init Containers and Completion Order

    Watch two init containers run in sequence before the app starts, then break one and read the status that tells you the app never ran at all.

    Init:Error

    Updated 23 Aug 2026

  3. Hands-on Lab 15 min

    Sidecar Containers in Jobs

    Watch a Job hang at 0/1 with its work long finished, then fix it by moving one container into initContainers.

    restartPolicy: Always

    Updated 23 Aug 2026

  4. Hands-on Lab 14 min

    Job Completions, Parallelism and backoffLimit

    Run work four times two at a time, then watch a failing Job produce three Pods from a backoffLimit of two and stop.

    BackoffLimitExceeded

    Updated 23 Aug 2026

  5. Hands-on Lab 15 min

    CronJob Schedules and concurrencyPolicy

    Run a job that takes longer than its own schedule, and choose what happens when the next run comes due.

    concurrencyPolicy: Forbid

    Updated 23 Aug 2026

  6. Hands-on Lab 18 min

    Building and Loading Images Without a Registry

    Build a container image on a node, get it into the kubelet's runtime with no registry at all, and then change what it does from the manifest.

    ctr -n k8s.io images import

    Updated 23 Aug 2026

  7. Hands-on Lab 13 min

    Labels and Selectors

    Select objects four different ways, then meet the rejection you get when a Deployment's selector disagrees with its own Pod template.

    selector does not match template

    Updated 23 Aug 2026

  8. Hands-on Lab 15 min

    Pod Volumes and Volume Lifetime

    Use both kinds of volume an application needs, and find out why a healthy PVC sits at Pending until something mounts it.

    WaitForFirstConsumer

    Updated 23 Aug 2026

  9. Hands-on Lab 16 min

    Choosing a Workload Object

    Run all five workload kinds in one namespace and read off what each one actually guarantees, instead of memorising a table.

    Deployment vs StatefulSet vs DaemonSet

    Updated 23 Aug 2026

Application Deployment8 guides

Rolling updates you control, blue-green, canaries, Helm and Kustomize.

  1. Hands-on Lab 16 min Paid

    Controlling a Rollout with maxSurge and maxUnavailable

    Roll two Deployments at the same moment with opposite settings, and watch one keep four Pods serving while the other drops to zero.

    maxSurge / maxUnavailable

    Updated 23 Aug 2026

  2. Hands-on Lab 14 min Paid

    Blue-Green Deployments with Service Selectors

    Run two versions side by side and move every request from one to the other by editing a single field.

    patch service --type=merge

    Updated 23 Aug 2026

  3. Hands-on Lab 15 min Paid

    Canary Deployments by Replica Count

    Split live traffic between two versions with nothing but replica counts, then measure what the split actually turned out to be.

    9 replicas to 1

    Updated 23 Aug 2026

  4. Hands-on Lab 15 min Paid

    Deployment Rollback and Revision History

    Build a readable rollout history, go back to a specific revision, and batch several edits into one rollout instead of three.

    undo --to-revision=1

    Updated 23 Aug 2026

  5. Hands-on Lab 15 min Paid

    Kustomize with kubectl

    Take one base manifest to three environments without templating it, using a tool you already have installed.

    kubectl apply -k

    Updated 23 Aug 2026

  6. Hands-on Lab 16 min Paid

    Helm Install, Upgrade and Rollback

    Render a chart before installing it, install with overrides, upgrade, roll back, and find where Helm keeps the state that makes rollback possible.

    helm rollback web 1

    Updated 23 Aug 2026

  7. Hands-on Lab 18 min Paid

    Manual Scaling and HorizontalPodAutoscaler

    Scale a Deployment two ways, find out why an HPA reads unknown, then put it under real load and watch it go from one replica to six.

    cpu: <unknown>/50%

    Updated 23 Aug 2026

  8. Hands-on Lab 16 min Paid

    Readiness Probes and Rollout Progress

    Break a readiness probe on a new version and watch the rollout stall while every user keeps being served by the old one.

    minReadySeconds

    Updated 23 Aug 2026

Configuration and Security9 guides

ConfigMaps, Secrets, limits, quotas, security contexts and ServiceAccounts.

  1. Hands-on Lab 16 min Paid

    ConfigMaps: Environment Variables and Volume Mounts

    Wire one Pod to three ConfigMaps four different ways, then break it with a key that does not exist and read the status that says so.

    CreateContainerConfigError

    Updated 23 Aug 2026

  2. Hands-on Lab 15 min Paid

    Secrets: Creation, Consumption and Encoding

    Decode a Secret in one command, see the two ways it reaches a container, and find out which of them leaks it further.

    base64 -d

    Updated 23 Aug 2026

  3. Hands-on Lab 16 min Paid

    Resource Requests, Limits and OOMKilled

    Give three Pods three different resource shapes, then find out why exceeding a memory limit kills a container and exceeding a CPU limit does not.

    OOMKilled

    Updated 23 Aug 2026

  4. Hands-on Lab 15 min Paid

    ResourceQuota and LimitRange

    Add a ResourceQuota and watch a Pod that worked a minute ago be refused, then make it work again without editing it.

    must specify limits.cpu

    Updated 23 Aug 2026

  5. Hands-on Lab 17 min Paid

    securityContext: runAsNonRoot and Capabilities

    Harden a Pod four ways and watch three of them produce a visible failure the first time you get them wrong.

    runAsNonRoot

    Updated 23 Aug 2026

  6. Hands-on Lab 16 min Paid

    ServiceAccounts, Roles and RoleBindings

    Grant a workload one permission, verify it without trial and error, then prove both the yes and the no from inside a running Pod.

    auth can-i --as=

    Updated 23 Aug 2026

  7. Hands-on Lab 14 min Paid

    Exposing Pod Metadata with the Downward API

    Feed a container its own name, namespace, IP, node and resource limits, and find the one field that only works as a file.

    fieldRef: status.podIP

    Updated 23 Aug 2026

  8. Hands-on Lab 17 min Paid

    Custom Resources and the Operator Pattern

    Add a new kind to the Kubernetes API in one manifest, watch it do absolutely nothing, and see what an operator adds that a CRD does not.

    kubectl get crd

    Updated 23 Aug 2026

  9. Hands-on Lab 16 min Paid

    Getting a Pod Past Pod Security Admission

    The refusal names every field it wants and which container it wants it on - and half of them belong somewhere different from the other half.

    violates PodSecurity

    Admission Updated 26 Aug 2026

Services and Networking7 guides

Ports that do not match, Services with no endpoints, Ingress and NetworkPolicy.

  1. Hands-on Lab 14 min Paid

    Service Ports: port, targetPort and nodePort

    Find out which of a Service's three port numbers actually routes traffic, by breaking each one in turn.

    targetPort

    Updated 23 Aug 2026

  2. Troubleshooting 15 min Paid

    Service Selectors and Endpoints

    Break a Service with a one-character typo that produces no error anywhere, then learn the DNS names that let you find it.

    Endpoints: <none>

    Updated 23 Aug 2026

  3. Hands-on Lab 16 min Paid

    Service Types End to End

    One Service patched from ClusterIP to NodePort to LoadBalancer, keeping everything it had at each step.

    80:32640/TCP

    Exposure Updated 26 Aug 2026

  4. Hands-on Lab 17 min Paid

    Ingress Rules and Ingress Controllers

    Route two paths to two Services, and see why an Ingress with no class is accepted and then completely ignored.

    ingressClassName

    Updated 23 Aug 2026

  5. Hands-on Lab 16 min Paid

    NetworkPolicy Egress and DNS

    Write a default-deny egress policy, watch every hostname stop resolving, and add the one exception every egress policy needs.

    wget: bad address

    Updated 23 Aug 2026

  6. Hands-on Lab 14 min Paid

    kubectl port-forward and proxy

    Get a browser onto a ClusterIP Service from your laptop, four different ways, without changing the Service at all.

    port-forward svc/web

    Updated 23 Aug 2026

  7. Troubleshooting 15 min Paid

    A Service With Endpoints and No Traffic

    Selector matched, two endpoints, both ready - and not a single request gets through.

    curl exit 7

    Ports Updated 26 Aug 2026

Observability and Maintenance5 guides

Probes, logs from a container that already died, and debugging without a shell.

  1. Hands-on Lab 15 min Paid

    Liveness, Readiness and Startup Probes

    Watch a liveness probe restart an application that was only still booting, then fix it with a third probe instead of loosening the second.

    startupProbe

    Updated 23 Aug 2026

  2. Troubleshooting 14 min Paid

    Container Logs and --previous

    Read the error message that is missing from the logs of a restarting container, using the flag most people never learn.

    logs --previous

    Updated 23 Aug 2026

  3. Troubleshooting 15 min Paid

    Debugging a Container Without a Shell

    Debug a container you cannot exec into, by attaching a second one that shares its network and its Pod.

    kubectl debug --target

    Updated 23 Aug 2026

  4. Troubleshooting 15 min Paid

    Events, describe and kubectl top

    Answer "why is this not running" with three read-only commands, against two Pods that fail for completely different reasons.

    --field-selector type=Warning

    Updated 23 Aug 2026

  5. Troubleshooting 14 min Paid

    Finding Deprecated API Versions

    Meet the error a removed apiVersion produces, find the replacement in two commands, and read the metric that tells you which deprecated APIs your cluster is still being asked for.

    no matches for kind

    Updated 23 Aug 2026

Command Cheat Sheets1 sheet

Searchable references for day-to-day work and exam day.

← Back to Learn