CKA Study Guide 2026
Everything you need to pass the CKA exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 CKA Exam Format at a Glance
📚 CKA Topics to Study (65)
✍️ Sample CKA Questions & Answers
1. Which kubeadm command is used to initialize a new Kubernetes control plane node?
`kubeadm init` bootstraps a new control plane and is a core task covered in the CKA cluster installation domain.
2. What is the minimum RBAC permission needed for a user to view their own CertificateSigningRequests?
CertificateSigningRequest is a cluster-scoped resource; a user needs get permission on certificatesigningrequests at the cluster level to view them.
3. What does a Pod's 'nodeSelector' field do in Kubernetes scheduling?
nodeSelector is the simplest node selection constraint; it restricts Pod scheduling to nodes whose labels include all specified key-value pairs.
4. What Linux capability is required for a container to bind to a port below 1024?
CAP_NET_BIND_SERVICE allows a process to bind to privileged ports (below 1024) without running as root, and must be added explicitly for containers needing this ability.
5. Which protocol does Istio use as the identity format for workload certificates?
Istio issues SPIFFE-compatible X.509 certificates encoding a SPIFFE URI (spiffe:///ns//sa/) as the workload identity.
6. How do you check the expiration date of the API server certificate on a kubeadm cluster?
Both openssl x509 -noout -dates and kubeadm certs check-expiration are valid methods to inspect certificate expiration on a kubeadm-managed cluster.