CertGrid CertGrid

KCNA (Kubernetes and Cloud Native Associate)

Cluster basics, cloud native architecture and the CNCF landscape.

46 published guides

22 of 46 guides need path access. Unlock KCNA path

46-guide Kubernetes and Cloud Native Associate learning path · 46 published · about 728 min of reading · 12 learning tracks · reviewed 23 August 2026

Orientation2 guides

What KCNA covers, how it differs from CKA, and the cluster you will use.

  1. Concepts 12 min

    KCNA Exam Format and Domain Weights

    Know what the four domains actually weigh before you decide how to study.

    44% Kubernetes fundamentals

    Updated 22 Aug 2026

  2. Concepts 11 min

    The KCNA Practice Cluster

    Meet the four-node cluster every command here runs against.

    kubectl version

    Updated 22 Aug 2026

Kubernetes Fundamentals8 guides

The objects every cloud native conversation assumes you know.

  1. Concepts 14 min

    kubectl and the Kubernetes API

    Turn up verbosity and watch kubectl stop being magic - it is a GET returning JSON.

    kubectl get pods -v=8

    Updated 22 Aug 2026

  2. Concepts 13 min

    Owner References and the Controller Chain

    Read the two numbers that say whether a controller has caught up with your change.

    generation vs observedGeneration

    Updated 22 Aug 2026

  3. Configuration 15 min

    LimitRange Defaults for Pods

    Create a Pod with no resources at all and read back the four values the namespace supplied for you.

    LimitRange defaults

    Updated 22 Aug 2026

  4. Hands-on Lab 14 min

    Pod Restart Policies and Job Completion

    Run work that finishes, and see why a Completed Pod sticking around is the feature rather than a leak.

    completions: 4, parallelism: 2

    Updated 23 Aug 2026

  5. Hands-on Lab 14 min Paid

    ConfigMap Consumption Methods

    Change one ConfigMap and watch an environment variable, a mounted file and a subPath mount give three different answers.

    subPath: MESSAGE

    Updated 23 Aug 2026

  6. Hands-on Lab 15 min Paid

    Pod Phase Versus Readiness

    Watch a Pod sit in Running while its Service refuses every connection, then turn traffic on by creating one file.

    conditions.ready=false

    Updated 23 Aug 2026

  7. Hands-on Lab 15 min Paid

    Deployment Rollout Health and Availability

    Ship a tag that does not exist, and find out why three replicas kept serving while the rollout hung instead of failing.

    maxUnavailable: 25%

    Updated 23 Aug 2026

  8. Hands-on Lab 14 min Paid

    Controllers and Pod Recreation

    Run a StatefulSet and a Deployment side by side, delete a Pod from each, and see which one gives you back the same name and the same disk.

    volumeClaimTemplates

    Updated 23 Aug 2026

Containers and Runtimes3 guides

What runs a container once the scheduler has decided where.

  1. Hands-on Lab 16 min

    Container Runtimes and the CRI

    Follow the chain from kubelet to containerd to runc, and find which one touches a namespace.

    crictl ps

    Updated 22 Aug 2026

  2. Hands-on Lab 15 min Paid

    Pod Sandboxes and Pause Containers

    Find out what the pause container does by doing nothing at all.

    crictl pods

    Updated 22 Aug 2026

  3. Hands-on Lab 14 min Paid

    The cgroup Driver: kubelet and containerd

    Avoid the half-working cluster you get when the kubelet and the runtime disagree.

    systemd vs cgroupfs

    Updated 22 Aug 2026

Scheduling and Placement3 guides

How the scheduler decides which node runs a Pod - and refuses.

  1. Hands-on Lab 16 min

    nodeSelector and Scheduling Constraints

    Watch two identical selectors diverge, and read the scheduler's own count of why.

    untolerated taint(s)

    Updated 22 Aug 2026

  2. Hands-on Lab 16 min Paid

    Taints and Tolerations: NoSchedule and NoExecute

    Taint one node twice and watch the first effect block the next Pod while the second evicts the Pod already running on it.

    workload=blocked:NoExecute

    Updated 23 Aug 2026

  3. Hands-on Lab 12 min Paid

    DaemonSets and Node Eligibility

    Find out why a DaemonSet reports three desired Pods on a four-node cluster, and change the answer with one toleration.

    DESIRED 3 on 4 nodes

    Updated 23 Aug 2026

Networking and Discovery5 guides

How Pods find each other and how traffic gets in.

  1. Hands-on Lab 14 min

    ClusterIP Services and Virtual IPs

    Find out why a Service address refuses ping, answers HTTP on the same IP, and fails silently when nothing is behind it.

    ping vs curl

    Updated 22 Aug 2026

  2. Hands-on Lab 18 min Paid

    NetworkPolicy Scope and Limitations

    Close a namespace with default-deny, then let exactly one caller back in.

    podSelector: {}

    Security Updated 22 Aug 2026

  3. Hands-on Lab 17 min

    Service Types: ClusterIP, NodePort and LoadBalancer

    See a NodePort answer on every node, then watch a LoadBalancer sit pending with no error at all until something outside Kubernetes hands it an address.

    type: LoadBalancer

    Updated 23 Aug 2026

  4. Hands-on Lab 18 min

    Ingress Path Routing and Rewrites

    Route two paths to two Services, then work out which nginx returned the 404 - the controller's or your application's.

    rewrite-target

    Updated 23 Aug 2026

  5. Concepts 15 min

    Gateway API and GatewayClass

    Install an API, create objects against it that validate perfectly, and watch them do absolutely nothing because no controller is implementing them.

    Accepted=Unknown(Pending)

    Updated 23 Aug 2026

Storage2 guides

Volumes, claims and what the CSI layer is for.

  1. Hands-on Lab 16 min

    Volume Types and What Each One Loses

    See what an emptyDir loses when the Pod goes, what a hostPath loses when the node changes, and how much a claim actually gets you.

    emptyDir vs hostPath vs PVC

    Updated 22 Aug 2026

  2. Hands-on Lab 17 min Paid

    PVC Expansion and Volume Snapshots

    Understand why a resized PVC reports 128Mi requested against 64Mi actual.

    FileSystemResizePending

    Updated 22 Aug 2026

Security and the 4C Model3 guides

Cloud, cluster, container, code - and where each one fails.

  1. Hands-on Lab 17 min

    Pod Security Admission Namespace Labels

    Watch one namespace label reject a privileged Pod, then block it again at runtime.

    pod-security.kubernetes.io/enforce

    Security Updated 22 Aug 2026

  2. Hands-on Lab 15 min Paid

    RBAC: Roles, ServiceAccounts and Bindings

    Give a ServiceAccount exactly one permission, and check it without trial and error.

    kubectl auth can-i

    RBAC Updated 22 Aug 2026

  3. Hands-on Lab 18 min Paid

    The Four Cs of Cloud Native Security

    Read a Secret straight out of etcd, and stop reciting the 4C model as four separate problems.

    etcdctl get /registry/secrets

    Security Updated 22 Aug 2026

Troubleshooting and Debugging2 guides

What a broken Pod tells you, where it says it, and how to get inside one.

  1. Troubleshooting 18 min

    Reading Pod Status and Container State

    Read six broken Pods at once and find each one's real reason in a different field.

    containerStatuses vs conditions

    Updated 22 Aug 2026

  2. Troubleshooting 16 min

    Debugging Containers with Ephemeral Containers

    Get inside a distroless container by attaching a second one that has the tools.

    kubectl debug --target

    Updated 22 Aug 2026

Cloud Native Architecture7 guides

The ecosystem, the standards it agrees on, and how systems scale.

  1. Concepts 16 min

    Cloud Native Standards: CRI, CNI, CSI and OCI

    See why you can swap containerd for Docker or Calico for Flannel - CRI, CNI, CSI and OCI.

    kubectl get csidrivers

    Updated 22 Aug 2026

  2. Troubleshooting 16 min

    HorizontalPodAutoscaler and Resource Requests

    Fix an HPA stuck at cpu: <unknown>/60% forever - a percentage needs a denominator.

    cpu: <unknown>/60%

    Updated 22 Aug 2026

  3. Concepts 13 min

    HPA, VPA and Cluster Autoscaler

    Tell HPA, VPA and Cluster Autoscaler apart, and find which one you actually have.

    kubectl get hpa

    Updated 22 Aug 2026

  4. Hands-on Lab 15 min Paid

    Scale to Zero on Kubernetes

    Learn which half of serverless Kubernetes gives you for free, and which half it does not.

    replicas: 0

    Updated 22 Aug 2026

  5. Troubleshooting 16 min Paid

    Replica Count and Cluster Capacity

    Diagnose two different limiters capping the same Deployment, in two different places.

    ResourceQuota + HPA max

    Updated 22 Aug 2026

  6. Hands-on Lab 15 min

    Resource Requests, Usage and Cost

    See a cluster completely full at 3% CPU, and understand what the scheduler actually spends.

    Insufficient cpu

    Updated 22 Aug 2026

  7. Hands-on Lab 17 min

    The CNCF Landscape and Project Maturity

    Replace the CNCF poster with the 161 API kinds your own cluster already has.

    kubectl api-resources | wc -l

    Updated 22 Aug 2026

Observability6 guides

Metrics, logs and traces, with a Prometheus you install yourself.

  1. Hands-on Lab 22 min

    Installing Prometheus on Kubernetes

    Fix four node-exporters in CrashLoopBackOff from a port collision with your own host agent.

    bind: address already in use

    Updated 22 Aug 2026

  2. Hands-on Lab 20 min Paid

    PromQL Query Basics

    Query Prometheus from inside the cluster and answer four real questions.

    up == 0

    Updated 22 Aug 2026

  3. Troubleshooting 16 min

    Prometheus Targets and Control Plane Scraping

    Understand why kube-proxy, scheduler, controller-manager and etcd read as down on a healthy cluster.

    127.0.0.1 bind address

    Updated 22 Aug 2026

  4. Hands-on Lab 19 min Paid

    Default Alerting Rules and Alert Tuning

    Work out which of nineteen firing alerts is telling you something real.

    Watchdog / InfoInhibitor

    Updated 22 Aug 2026

  5. Hands-on Lab 13 min Paid

    Grafana Dashboards for Kubernetes

    Find where the chart's dashboards come from and how they get loaded.

    ConfigMap sidecar

    Updated 22 Aug 2026

  6. Hands-on Lab 19 min Paid

    SLOs, SLIs and Error Budgets

    Turn an SLO from a document into a recording rule, a target and a subtraction.

    1 - (errors / total)

    Updated 22 Aug 2026

Delivery and GitOps5 guides

Getting a change from a commit to a running Pod, declaratively.

  1. Hands-on Lab 18 min

    Installing Argo CD

    Get past annotations: Too long on the documented one-liner.

    kubectl apply --server-side

    Updated 22 Aug 2026

  2. Hands-on Lab 16 min Paid

    The Argo CD Application Resource

    Deploy from Git with twenty lines of YAML, and see what keeps deploying afterwards.

    kind: Application

    Updated 22 Aug 2026

  3. Hands-on Lab 15 min Paid

    GitOps Self-Heal and Prune

    Watch a hand-edit reverted within a second, and find what prune deliberately leaves alone.

    selfHeal: true

    Updated 22 Aug 2026

  4. Hands-on Lab 17 min Paid

    Helm Charts and Release State

    Render a chart without a cluster, then find where Helm stored what it sent.

    helm template / --dry-run

    Updated 22 Aug 2026

  5. Hands-on Lab 20 min Paid

    Progressive Delivery and Automated Rollback

    Shift 20% of traffic, ask Prometheus whether to continue, and reverse on a bad image.

    kind: Rollout

    Updated 22 Aug 2026

Command Cheat Sheets1 sheet

Searchable references for day-to-day work.

← Back to Learn