CKAD — Certified Kubernetes Application Developer Guide

The CKAD validates your ability to design, build, configure, and expose cloud-native applications on Kubernetes. It's 100% hands-on — you solve real problems in a live terminal environment.

Exam Overview

Detail	Value
Provider	CNCF / Linux Foundation
Format	100% hands-on (terminal-based)
Length	2 hours
Passing Score	66%
Price	~$395 USD (includes one free retake)
Validity	3 years
Prerequisites	Basic Docker + Kubernetes knowledge

Domain Breakdown

Domain	Weight
Core Concepts	13%
Configuration	18%
Multi-Container Pods	10%
Observability	18%
Pod Design	20%
Services & Networking	13%
State Persistence	8%

Key Differences: CKA vs CKAD

Aspect	CKA (Administrator)	CKAD (Developer)
Focus	Cluster operations	Application deployment
Cluster setup	Yes (kubeadm, TLS)	No
Network policies	Yes	Basic
Storage	PV/PVC provisioning	PVC usage
RBAC	Cluster admin	ServiceAccount
Security	TLS, certs	Secrets, ConfigMaps
Helm	No	Yes

Domain Deep Dives

1. Core Concepts (13%)

Pods

• Smallest deployable unit in Kubernetes
• One or more containers sharing network/IP and storage
• Pod lifecycle — Pending → Running → Succeeded/Failed → CrashLoopBackOff
• kubectl run pod-name --image=nginx
• kubectl explain pod — Learn pod spec fields

Kubernetes Architecture Basics

• Control plane: API server, etcd, scheduler, controller manager
• Worker nodes: kubelet, kube-proxy, container runtime
• kubectl → API server → etcd (all state)

2. Configuration (18%)

ConfigMaps

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_COLOR: blue
  APP_MODE: production

• Mount as volumes or environment variables
• kubectl create configmap, kubectl get configmap

Secrets

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  password: cGFzc3dvcmQxMjM= # base64 encoded

• Base64 encoded (not encrypted — use KMS or external secrets operator)
• Mount as volumes or environment variables
• kubectl create secret generic, kubectl get secret

SecurityContext

• Run as non-root user, read-only root filesystem, capabilities

securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

Resource Requirements

resources:
  requests:
    memory: "256Mi"
    cpu: "250m"
  limits:
    memory: "512Mi"
    cpu: "500m"

• Requests — Minimum guaranteed (used for scheduling)
• Limits — Maximum allowed (throttling/eviction)

ServiceAccount

• kubectl create serviceaccount my-sa
• automountServiceAccountToken: false — Opt out of automatic token mount
• Bind roles with RoleBinding

3. Multi-Container Pods (10%)

Sidecar Pattern

• Main container + helper container in same pod
• Example: web server + log collector (Fluentd)
• Share storage volumes and network namespace

Init Containers

spec:
  initContainers:
    - name: init-db
      image: busybox
      command: ["sh", "-c", "until nslookup db-service; do echo waiting for db; sleep 2; done;"]

• Run sequentially before main containers
• Each must complete successfully before next starts
• Can have different images and security settings

Ambassador Pattern

• Proxy container that mediates access to external services

Adapter Pattern

• Transforms output of main container (e.g., log format normalization)

4. Observability (18%)

Liveness Probes

• Checks if container is alive — restart if fails

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10

Readiness Probes

• Checks if container is ready to serve traffic
• If fails, pod is removed from Service endpoints

readinessProbe:
  exec:
    command:
      - cat
      - /tmp/healthy

Startup Probes

• For slow-starting applications
• Defers liveness checks until startup completes

Container Logging

• kubectl logs pod-name
• kubectl logs -f pod-name — follow
• kubectl logs pod-name -c container-name — multi-container
• --since=5m, --tail=50

Metrics

• kubectl top pod, kubectl top node
• Requires metrics-server deployment

Debugging

• kubectl describe pod pod-name — Events, conditions, status
• kubectl exec -it pod-name -- /bin/sh
• kubectl get events --sort-by='.lastTimestamp'

5. Pod Design (20%)

Deployments

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: nginx
          image: nginx:1.25

• RollingUpdate — Gradual replacement (default)
• Recreate — Kill all, then recreate (downtime)
• Rollback — kubectl rollout undo deployment/web-app
• Pause/resume — kubectl rollout pause deployment/web-app

Jobs and CronJobs

apiVersion: batch/v1
kind: Job
spec:
  completions: 3
  parallelism: 2
  backoffLimit: 4
  template:
    spec:
      restartPolicy: Never # or OnFailure

• kubectl create job, kubectl get job
• CronJob — Schedule (cron syntax), jobTemplate, concurrencyPolicy (Allow/Forbid/Replace)

Labels, Selectors, and Annotations

• Labels — Identifying metadata (app, env, tier), selected by label selectors
• Annotations — Non-identifying metadata (tool info, build info, contact)
• Equality-based: =, !=
• Set-based: in, notin, exists

Rolling Updates and Rollbacks

• kubectl set image deployment/web-app nginx=nginx:1.26
• kubectl rollout status deployment/web-app
• kubectl rollout history deployment/web-app
• kubectl rollout undo deployment/web-app --to-revision=2

6. Services & Networking (13%)

Service Types

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  type: ClusterIP
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080

• ClusterIP — Internal cluster access (default)
• NodePort — Static port on each node (30000-32767)
• LoadBalancer — Cloud provider LB
• Headless — clusterIP: None for DNS-based discovery

Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-service
                port:
                  number: 80

• Requires Ingress Controller (nginx, traefik, contour, AWS ALB)
• TLS termination, name-based virtual hosting, path routing

Network Policies

• Pod-level firewall (requires CNI plugin that supports it)
• Ingress/Egress rules based on pod labels, namespaces, IP blocks

7. State Persistence (8%)

PersistentVolumeClaim (PVC)

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-claim
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: standard

Using PVC in Pod

spec:
  volumes:
    - name: data-volume
      persistentVolumeClaim:
        claimName: data-claim
  containers:
    - volumeMounts:
        - name: data-volume
          mountPath: /data

Access Modes

• ReadWriteOnce (RWO) — Single node read-write
• ReadOnlyMany (ROX) — Many nodes read-only
• ReadWriteMany (RWX) — Many nodes read-write

StorageClasses

• Dynamic provisioning (cloud: EBS, Azure Disk, GCE Persistent Disk)
• Parameters — type (ssd/hdd), iops, replication, encryption

ConfigMap as Volume

volumes:
  - name: config-volume
    configMap:
      name: app-config

Essential Commands

# Pod operations
kubectl run nginx --image=nginx --restart=Never
kubectl get pods -o wide
kubectl describe pod nginx

# Configuration
kubectl create configmap app-config --from-literal=key=value
kubectl create secret generic db-secret --from-literal=password=secret123
kubectl get configmap app-config -o yaml

# Deployments
kubectl create deployment web --image=nginx --replicas=5
kubectl scale deployment web --replicas=3
kubectl set image deployment/web nginx=nginx:1.26
kubectl rollout status deployment/web

# Services
kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort
kubectl get svc

# Debugging
kubectl logs -f deployment/web
kubectl exec -it pod/web-5d4f8c7b9-abc12 -- /bin/sh
kubectl port-forward pod/web-5d4f8c7b9-abc12 8080:80

# Certifications (quick reference)
kubectl run nginx --image=nginx --dry-run=client -o yaml > nginx-pod.yaml
kubectl create deployment nginx --image=nginx --dry-run=client -o yaml > nginx-deploy.yaml
kubectl expose pod nginx --port=80 --name=nginx-service --dry-run=client -o yaml

Study Tips

1. Learn kubectl imperatively — --dry-run=client -o yaml to generate YAML from CLI
2. Master kubectl explain — kubectl explain deployment.spec saves hours of memorization
3. Use aliases — alias k=kubectl, export do="--dry-run=client -o yaml", export now="--grace-period=0 --force"
4. Practice with vim — Know basic editing, indentation, copy/paste in vim (you'll edit YAML in terminal)
5. Know multi-container patterns — Sidecar, init containers, ambassador, adapter
6. Understand probes — When to use liveness vs readiness vs startup

Practice Questions

Test your knowledge with our CKAD practice questions — 50+ questions covering all domains.

Start Practice →

Career Impact

• Kubernetes Developer — $100k–$150k
• Cloud-Native Developer — $110k–$155k
• DevOps Engineer — $105k–$150k
• Platform Engineer — $115k–$160k

Next: CKA (Administrator) or CKS (Security Specialist)

Related Articles

• CKA Exam Guide — Certified Kubernetes Administrator
• Kubernetes Pod Design Patterns
• Kubernetes ConfigMaps and Secrets Guide
• Docker Certified Associate Exam Guide