CKAD Exam Format and Scope

Orientation / Guide 1 of 44 / Beginner

• Kubernetes1.36.4
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 12 min
• Reviewed23 August 2026

Written against the versions above. Counts come from this cluster, not from the API reference. `api-resources` reports what the API server currently serves, including every CRD installed on it, so the numbers move with the cluster. The shape of the answer does not.

Before you start

• A cluster and kubectl. Nothing is created or changed anywhere in this guide.
• No prior Kubernetes knowledge is assumed beyond knowing that kubectl talks to a cluster.

1. 1

   The line that decides what you can be asked

   Kubernetes objects are either namespaced or cluster-scoped, and CKAD lives almost entirely on one side of that line. Ask the cluster:

   80

   86

   Eighty namespaced kinds, eighty-six cluster-scoped. That second number is misleading on this cluster and it is worth saying so: Calico registers dozens of its own cluster-scoped CRDs, and they are counted here. A bare kubeadm cluster has far fewer.

   Look at what is on the cluster-scoped list - nodes, persistentvolumes, clusterroles, storageclasses, customresourcedefinitions, certificatesigningrequests. Those are CKA and CKS subject matter. A CKAD task will hand you a namespace and everything it asks for will live inside it.

   $kubectl versionClient Version: v1.36.4Kustomize Version: v5.8.1Server Version: v1.36.4$kubectl api-resources --namespaced=true --no-headers | wc -l80$kubectl api-resources --namespaced=false --no-headers | wc -l86$kubectl api-resources --namespaced=false --no-headers | awk '{print $1}' | tr '\n' ' 'componentstatuses namespaces nodes persistentvolumes mutatingadmissionpolicies mutatingadmissionpolicybindings mutatingwebhookconfigurations validatingadmissionpolicies validatingadmissionpolicybindings validatingwebhookconfigurations customresourcedefinitions apiservices clusteranalysistemplates selfsubjectreviews tokenreviews selfsubjectaccessreviews selfsubjectrulesreviews subjectaccessreviews certificatesigningrequests bgpconfigurations bgpfilters bgppeers blockaffinities caliconodestatuses clusterinformations felixconfigurations globalnetworkpolicies globalnetworksets hostendpoints ipamblocks ipamconfigs ipamhandles ippools ipreservations kubecontrollersconfigurations stagedglobalnetworkpolicies tiers flowschemas prioritylevelconfigurations gatewayclasses volumegroupsnapshotclasses volumegroupsnapshotcontents nodes ingressclasses ipaddresses servicecidrs runtimeclasses apiservers gatewayapis goldmanes imagesets installations istios managementclusterconnections tigerastatuses whiskers clusternetworkpolicies bgpconfigurations bgpfilters bgppeers blockaffinities caliconodestatuses clusterinformations felixconfigurations globalnetworkpolicies globalnetworksets hostendpoints ipamconfigurations ippools ipreservations kubecontrollersconfigurations profiles stagedglobalnetworkpolicies tiers clusterrolebindings clusterroles deviceclasses resourceslices priorityclasses volumesnapshotclasses volumesnapshotcontents csidrivers csinodes storageclasses volumeattachments volumeattributesclasses

   Expected resultTwo counts, and a list dominated by things a developer never edits.

   Success conditionYou can name the half of Kubernetes CKAD does not test.

2. 2

   The objects that actually come up

   Filter the namespaced list down to what the CKAD curriculum names and you get a list short enough to hold in your head:

   configmaps limitranges persistentvolumeclaims pods resourcequotas secrets serviceaccounts services daemonsets deployments replicasets statefulsets horizontalpodautoscalers cronjobs jobs networkpolicies pods ingresses networkpolicies networkpolicies

   That is the whole exam. Seventeen or so kinds, and you will spend most of your time on six of them.

   Notice pods appears twice and networkpolicies three times. That is not a mistake in the filter - the metrics API serves a pods resource of its own, and Calico serves two more networkpolicies. This is exactly why an ambiguous short name can resolve to something you did not mean, and why kubectl get networkpolicies.networking.k8s.io exists.

   $kubectl api-resources --namespaced=true --no-headers | awk '{print $1}' | grep -E '^(pods|deployments|replicasets|statefulsets|daemonsets|jobs|cronjobs|services|ingresses|configmaps|secrets|persistentvolumeclaims|serviceaccounts|networkpolicies|resourcequotas|limitranges|horizontalpodautoscalers)$' | tr '\n' ' 'configmaps limitranges persistentvolumeclaims pods resourcequotas secrets serviceaccounts services daemonsets deployments replicasets statefulsets horizontalpodautoscalers cronjobs jobs networkpolicies pods ingresses networkpolicies networkpolicies$kubectl api-versions | wc -l40

   Expected resultA short list of kinds, with visible duplicates.

   Success conditionYou have the object list the rest of this path works through.

3. 3

   What is on the cluster that you will never be asked to fix

   The cluster has four nodes and a control plane running as static Pods:

   etcd-cka1001 kube-apiserver-cka1001 kube-controller-manager-cka1001 kube-scheduler-cka1001

   On CKA, those four are the exam. On CKAD they are furniture. You are never asked to restore etcd, renew an API server certificate, join a node or debug a kubelet.

   What this buys you is focus. The two hours are spent on: write a manifest, fix a manifest, expose something, configure something, and work out why a Pod is not running. Everything in this path is one of those five.

   $kubectl get nodes --no-headers | wc -l4$kubectl -n kube-system get pods -l tier=control-plane -o 'custom-columns=POD:.metadata.name' --no-headers | tr '\n' ' 'etcd-cka1001 kube-apiserver-cka1001 kube-controller-manager-cka1001 kube-scheduler-cka1001

   Expected resultFour nodes, four control-plane components.

   Success conditionYou know what to skip when a study guide starts talking about etcd.

Troubleshooting

• kubectl get networkpolicies returns something unexpected.

  Why: More than one API group serves that resource name - here, Calico's as well as Kubernetes'.

  Fix:Qualify it: kubectl get networkpolicies.networking.k8s.io. kubectl api-resources | grep <name> shows every group serving a name.

• A study resource spends chapters on etcd and kubeadm.

  Why: It is CKA material.

  Fix:Check whether the object is namespaced. If it is cluster-scoped, it is almost certainly not CKAD.

Official sources

• CKAD curriculum
• Namespaces - not all objects are in a namespace
• kubectl api-resources