CKAD 2026 — 884 practice questions

52 exam sessions, 17 questions each, for a real Kubernetes cluster. Every exam builds its own environment, grades itself and cleans up after itself. Two of them (mock-killer-a, mock-killer-b) reproduce the scenarios of the killer.sh simulator sessions.

./doctor.sh                 # everything it can check
./doctor.sh mock-killer-a   # plus that exam's instances

It changes nothing, always exits 0, and prints one line per fact: platform and bash version, which tools are on PATH, whether the docker daemon answers and what kind it is, the kubectl context and whether the API server replies, which exam components are installed, which ports are published, and the state of an exam's instances. The BAD lines are the ones to fix. Paste the whole output into a bug report - it answers every question worth asking about a broken setup.

Runs on Linux, macOS and Windows. On Windows use Git Bash or WSL2 - not cmd or PowerShell; the scripts are bash. macOS is supported with the /bin/bash Apple ships (3.2) and the BSD userland, so there is nothing to install from Homebrew. What you do need is Docker (Docker Desktop on macOS and Windows, the engine on Linux), kubectl, and ssh.

The exams talk to a real cluster and log you into real machines, so three things get installed once:

cd _bootstrap && ./install.sh && ./status.sh && cd ..   # cluster components
cd _instances && ./build.sh && cd ..                    # the ssh instance image
cd _examui    && npm install  && cd ..                  # the exam console

_bootstrap/install.sh adds an ingress-nginx controller (NodePort 30080), metrics-server and a local image registry (NodePort 30500) to your cluster. Without them the Ingress, HPA and image questions are graded on their YAML alone; with them they are graded by behaviour — a real curl through the controller, real HPA metrics, a real image pull. ./status.sh shows what your cluster has.

_instances/build.sh builds ckad-instance:1, the container you land in when you type ssh ckadXXXX. It carries kubectl, helm, vim, curl, jq and the rest, mounts only that instance's course/<n> directories, and can not reach the exam directory — so the solutions stay out of reach, like in the real exam.

NetworkPolicies are the one thing a stock Docker Desktop or kind cluster cannot enforce. Those questions are graded on the manifest and say so in the question text. _bootstrap/kind-calico.sh creates a separate cluster that does enforce them. See _bootstrap/README.md.

Platform: everything here targets Linux. On a Windows machine run it inside WSL2 (Ubuntu) - install Docker Desktop with the WSL2 integration switched on, and docker and kubectl are available inside WSL against the same cluster. The real CKAD exam terminal is Linux too, so practising in a Linux shell is exactly the muscle memory you want.

curl localhost:30080 gets nothing? Docker Desktop's Kubernetes is a kind cluster under the hood, and a kind node only publishes the NodePorts it was created with. install.sh notices and starts a small forwarder per port (_bootstrap/portmap.sh), so localhost works anyway. If the port it wanted was taken by one of your own Services it takes the next free one and says so — the exams read the port from the cluster, so nothing needs adjusting.

There are two ways to work through an exam. The browser console is the one you want — it looks and behaves like the real Linux Foundation exam UI.

cd _examui
npm run dev

Then open http://localhost:3000 and pick an exam.

If your cluster needs a specific context, set it before starting:

export KUBECTL="kubectl --context=docker-desktop"
npm run dev

You get the question panel on the left, a real terminal on the right, a 120 minute clock, question flagging and a notepad. Each question names an instance: you type ssh ckadXXXX, solve the task, and type exit — logging out is what submits it for grading.

The console walks you through everything else: Prepare environment runs the exam's setup, Start exam begins the clock, and the results page shows your score with the full walkthrough.

Full details, keyboard shortcuts and configuration: _examui/README.md.

Every exam also works standalone:

cd exam-01-voyager
./setup.sh            # builds the exam environment (1-2 min)
cat questions.md      # solve the 17 questions with kubectl
./verify.sh           # automatic grading, 66% = pass
./cleanup.sh          # remove every namespace and object of this exam

solutions.md has a full walkthrough per question; solve.sh applies the complete reference solution if you want to see a finished environment.

• a Kubernetes cluster and kubectl (kind, minikube, k3s, Docker Desktop …)
• Node 20+ for the browser console
• a bash — Linux and macOS have one; on Windows the console finds Git Bash (C:\Program Files\Git\bin\bash.exe) or falls back to WSL
• Docker, for the instance containers you ssh into — without it the console falls back to a local shell per instance and warns you, and on Windows/macOS the exam directory is then only a cd .. away
• an ssh client — Windows 10+, macOS and Linux all ship one
• helm on the PATH for the Helm questions
• strongly recommended: _bootstrap/install.sh — it installs a real ingress-nginx (NodePort 30080), metrics-server and an image registry (NodePort 30500) into your cluster, which is what makes the Ingress, HPA and image questions gradable by behaviour instead of only by their YAML. _bootstrap/status.sh shows what your cluster supports; _bootstrap/README.md explains what each component changes, including the one thing that cannot be retrofitted (NetworkPolicy enforcement — see _bootstrap/kind-calico.sh). Without it every question is still graded, structurally, and verify.sh marks the behavioural checks as skipped.

• Run one exam at a time. Different exams reuse the same namespace names.
• File paths in the questions are relative to the exam directory, e.g. ./course/3/job.yaml. setup.sh creates that tree.
• Namespaces are named after bodies of the solar system.
• 120 minutes, pass mark 66% — like the real exam.

• Secrets & Environment Variables — 69 questions across all exams
• Ingress — 60 questions across all exams
• NetworkPolicy — 54 questions across all exams
• Resource Requests & Limits — 60 questions across all exams
• Docker Image Tasks — 61 questions across all exams
• Canary Deployments — 56 questions across all exams
• Service Selectors — 64 questions across all exams
• CronJobs — 58 questions across all exams
• SecurityContext — 64 questions across all exams
• RBAC — 58 questions across all exams
• Deployment Rollbacks — 52 questions across all exams
• Deprecated API Fixes — 52 questions across all exams
• Probes — 22 questions across all exams
• Storage, PV & PVC — 17 questions across all exams
• Sidecar & Init Containers — 13 questions across all exams
• Jobs — 14 questions across all exams
• Labels & Annotations — 18 questions across all exams
• Pods & kubectl Basics — 16 questions across all exams
• Helm — 20 questions across all exams
• Kustomize — 19 questions across all exams
• HorizontalPodAutoscaler — 13 questions across all exams

_generator/ holds the generator that produced all of this. A different seed reshuffles every exam out of the same question bank:

cd _generator && python3 -m ckadgen.build ../out