Exam bookmarks
Download cka-bookmarks.html
Import in Chrome: chrome://bookmarks → ⋮ → Import bookmarks from HTML file.
Firefox: Ctrl+Shift+O → Import and Backup → Import Bookmarks from HTML.
Read this before you plan around bookmarks
Since the exam moved to the PSI Bridge secure browser, the terminal is a remote desktop whose browser is provisioned fresh for every candidate. Personal bookmarks do not travel into it, and neither do extensions — by design, so that no candidate starts with an advantage. PSI adds its own documentation quick links instead.
So treat this set as three things, in order of how much it is worth:
- A drill. Work through the practice tasks with only these pages open. What you are actually training is which page answers which symptom — knowledge that survives into an exam where you must find the page by searching, not by clicking a bookmark.
- A simulator kit. The Killer.sh sessions run in your own browser, where the bookmarks work exactly as imported. That is where the bar folder earns its keep.
- A URL memory aid. In the exam you can still type a path or use the docs’ own search box. The paths worth knowing cold are in 0 · First 60 seconds and the two etcd links — everything else you can find by search.
Check the rules yourself before exam day: the allowed-resources list is revised with the curriculum, and this page is a snapshot, not an authority.
What is in the set, and why it is short
Seventy-seven links, weighted the way the exam is: Troubleshooting and Cluster Architecture go deepest, Storage
gets seven. Nothing here is a page you could reproduce from kubectl explain in less time than the page takes
to load — that is the entire selection rule. Deep links land on the anchor with the YAML on it rather than at
the top of a long page.
The folder names sort in order, so the bar reads left to right the way you should reach for them.
Search it the way the exam asks. Type the symptom, not the page name — PVC pending, no endpoints,
rollback, snapshot. Terms narrow: network policy deny matches only rows carrying all three. That is the drill
in miniature, and the one thing you can practise here that survives into an exam where the bookmarks do not.
/ focuses the box, Esc clears it, and the query stays in the URL so a filtered view can be
shared or reopened. The rule across the site: / searches what you are looking at,
Ctrl/⌘+K searches everything.
Allowed during the exam — one extra browser tab, restricted to these:
https://kubernetes.io/docs/— Kubernetes documentation, all language translationshttps://kubernetes.io/blog/— Kubernetes bloghttps://github.com/kubernetes/— The kubernetes GitHub org and its repositorieshttps://helm.sh/docs/— Helm documentationhttps://gateway-api.sigs.k8s.io/— Gateway API documentation — CKA only
The Linux Foundation permits ONE extra browser tab, restricted to the domains listed in `allowed`. Verify that list against the Candidate Handbook and the 'Resources Allowed' page before your exam — it is revised with the curriculum. Source: Resources Allowed, all LF certification programs.
0 · First 60 seconds 4
Open before task 1. Everything here answers 'what is the flag called' faster than a search does — but slower than `kubectl explain`, so use them only when explain has failed you.
| Page | When you reach for it |
|---|---|
| kubectl quick reference | The alias/completion block, and every imperative one-liner. The single highest-value page in the set. |
| kubectl create — subcommands | "Can I generate this instead of writing YAML?" — the list of what `create` can produce. |
| API reference — object fields | An exact field name or its nesting, when `kubectl explain --recursive` is not enough. |
| kubectl for Docker users / command index | You know the verb but not the flag, and the quick reference did not have it. |
1 · Troubleshooting — 30% 13
The heaviest domain, and the one that does not yield to reading. These are ordered the way a broken cluster is diagnosed: cluster, then node, then Pod, then network.
| Page | When you reach for it |
|---|---|
| Cluster is broken — where to look | Nodes NotReady, control-plane component down, API server unreachable. |
| Static Pod manifests (control plane) | apiserver/etcd/scheduler won't start — the manifest path and how the kubelet picks it up. |
| crictl — containers below kubectl | The API server itself is down and you need the container logs anyway. |
| kubelet config file | A kubelet flag or path is wrong and you need to know which file to fix. |
| Node status and conditions | Reading `describe node`: DiskPressure, MemoryPressure, what each condition means. |
| Application not running | Pending, CrashLoopBackOff, ImagePullBackOff — the triage order. |
| Debug Pods | A Pod is Pending or restarting and `describe` has not told you why yet. |
| kubectl debug / ephemeral containers | The image has no shell, or you need to poke at a running Pod from inside. |
| Service has no endpoints | Service exists, `get endpoints` is empty — the selector/port checklist. |
| DNS resolution debugging | Name resolution fails inside Pods; CoreDNS Pods or config suspect. |
| metrics-server / kubectl top | `kubectl top` errors, or the task asks you to report resource usage. |
| Container logs and streams | "Write the output stream of container X to a file" — where the logs actually live. |
| System component logs | journalctl vs /var/log — which component logs where. |
2 · Cluster architecture — 25% 18
etcd and kubeadm are the two tasks people most often lose whole on. Both are procedural: the page is worth opening even when you think you remember the order.
| Page | When you reach for it |
|---|---|
| etcd — BACK UP | `etcdctl snapshot save` with the three TLS flags. Do not type this from memory. |
| etcd — RESTORE | `snapshot restore --data-dir`, then repoint the static Pod manifest. |
| kubeadm upgrade — control plane | Drain → unhold → plan → apply → kubelet → restart → uncordon, in that order. |
| kubeadm upgrade — worker nodes | `kubeadm upgrade node` — the step people skip after upgrading the control plane. |
| Drain a node safely | `--ignore-daemonsets`, `--delete-emptydir-data`, and when drain hangs. |
| kubeadm join / create a cluster | Add a node; regenerate a join token; where admin.conf goes. |
| kubeadm token — new join command | The join token expired: `kubeadm token create --print-join-command`. |
| HA control-plane topologies | Stacked vs external etcd — the distinction a question can turn on. |
| kubeadm certificate renewal | Expired control-plane certs; `kubeadm certs check-expiration`. |
| RBAC — Role / RoleBinding YAML | verbs, apiGroups, resourceNames — the exact spec shape. |
| RBAC — imperative + auth can-i | `create role/rolebinding` flags, and how to prove the binding works. |
| ServiceAccount for a Pod | Bind a role to a ServiceAccount and attach it to a workload. |
| CertificateSigningRequest (user access) | "Create a user and grant it access" — CSR YAML, approve, build the kubeconfig. |
| kubeconfig — contexts and users | `set-credentials` / `set-context` when you must hand back a working kubeconfig. |
| CRDs — define a custom resource | Install or inspect a CRD; `kubectl get crd`, scope, versions. |
| Operator pattern | A question frames a controller-plus-CRD as an operator. |
| Extension interfaces — CNI / CSI / CRI | Which interface owns what; where a CNI config file lives. |
| Container runtimes (CRI setup) | cgroup driver, containerd config, the socket path. |
3 · Services & networking — 20% 13
Gateway API is the post-2025 addition most people have not practised. NetworkPolicy is the one YAML on the exam that is genuinely hard to produce cold.
| Page | When you reach for it |
|---|---|
| NetworkPolicy — the resource | podSelector / ingress / egress / ports. Copy, then cut. |
| NetworkPolicy — default deny | "Deny all traffic except…" — the empty-selector policies. |
| NetworkPolicy — walkthrough | You want the worked example rather than the reference. |
| Service — types and ports | ClusterIP / NodePort / LoadBalancer; targetPort vs port vs nodePort. |
| Endpoints and EndpointSlices | Verifying a Service actually selected Pods. |
| Ingress — the resource | Path rules, pathType, backend service — the YAML to copy. |
| IngressClass | The Ingress is created but no controller picks it up. |
| Gateway API (Kubernetes docs) | GatewayClass → Gateway → HTTPRoute, on the allowed kubernetes.io domain. |
| Gateway API — official site | The upstream docs. Allowed for CKA only. Deep links move between releases — enter through the root. |
| Gateway API — guides | A worked HTTPRoute; simple gateway; traffic splitting. |
| DNS for Services and Pods | The FQDN form: svc.namespace.svc.cluster.local. |
| CoreDNS customisation | Editing the CoreDNS Corefile ConfigMap. |
| Connect applications with a Service | Expose a Deployment end to end, verified from a client Pod. |
4 · Workloads & scheduling — 15% 17
Most of this domain is imperative kubectl and should never cost you a page load. These are the exceptions — the spec blocks with nesting you will get wrong from memory.
| Page | When you reach for it |
|---|---|
| Deployment — rollout and rollback | `rollout undo --to-revision`, `rollout history`, `rollout status`. |
| Deployment — update strategy | maxSurge / maxUnavailable placement in the spec. |
| ConfigMap into a Pod | envFrom vs valueFrom vs volume mount — all three shapes on one page. |
| Secrets with kubectl | `create secret generic --from-literal`, and reading one back. |
| Probes — liveness / readiness / startup | The probe block, including initialDelaySeconds and the exec form. |
| Requests and limits | resources: block; units for cpu and memory. |
| HPA — walkthrough | "Configure workload autoscaling" — `kubectl autoscale`, then verify. |
| HPA — how it decides | The v2 spec with metrics, if a target other than CPU is asked for. |
| Taints and tolerations | NoSchedule / PreferNoSchedule / NoExecute, and the toleration block. |
| nodeSelector and node affinity | required vs preferred — the nesting nobody remembers. |
| Scheduling reference | Pod affinity/anti-affinity and topologySpreadConstraints. |
| PodDisruptionBudget | minAvailable / maxUnavailable, usually paired with a drain task. |
| DaemonSet | One Pod per node, and why a drain needs --ignore-daemonsets. |
| CronJob and Job | schedule, restartPolicy, backoffLimit — `create cronjob` gets you most of it. |
| Init containers | A Pod must wait on something before its main container starts. |
| ResourceQuota | Pods in a namespace suddenly fail admission. Once a quota constrains cpu or memory, every Pod there must declare matching requests and limits. |
| LimitRange — namespace defaults | The other half of the quota trap: a LimitRange supplies the defaults that stop a quota rejecting every Pod. |
5 · Storage — 10% 7
Ten percent, and almost always the same shape: make a PVC bind. The three conditions for binding are what the page is really for.
| Page | When you reach for it |
|---|---|
| PV and PVC — binding lifecycle | The PVC is Pending: accessModes, size, storageClassName must all agree. |
| PV / PVC YAML to copy | A minimal volume spec you can edit down in seconds. |
| PV walkthrough (hostPath) | The full PV → PVC → Pod chain, which is the usual exam task. |
| StorageClass | provisioner, reclaimPolicy, volumeBindingMode. |
| Change the default StorageClass | The is-default-class annotation, exactly as spelled. |
| Dynamic provisioning | A PVC should create its PV rather than match an existing one. |
| Volume types | emptyDir, hostPath, configMap and secret volumes. |
6 · Helm & Kustomize 7
Added to the curriculum in the 2025 revision, and the most common gap in people who studied from older material. Helm's docs are a separate allowed domain.
| Page | When you reach for it |
|---|---|
| Kustomize with kubectl | kustomization.yaml; `kubectl apply -k`; `kubectl kustomize` to preview. |
| Helm — using Helm | install / upgrade / rollback / uninstall and what each does. |
| helm install | `--set`, `-f values.yaml`, `--namespace --create-namespace`. |
| helm upgrade | `--install`, `--reuse-values`, and rolling a release forward. |
| helm repo add | Add and update a chart repository before installing from it. |
| helm template | "Show what this chart would apply" without touching the cluster. |
| Charts — values and structure | Where values.yaml sits and how overrides resolve. |
The pages deliberately left out
- Anything
kubectl explainanswers.kubectl explain pod.spec.containers.resources --recursivebeats a page load, and it matches the cluster’s own version. - Concept pages you would read, not copy from. In a 7-minute task you do not read.
raw.githubusercontent.comexample manifests. Widely shared in older bookmark sets, and not on the allowed list —github.com/kubernetes/is, that host is not. Not worth the risk.kubernetes.io/search/. The docs’ in-page search box is the sanctioned way to search; the standalone search path sits outside the/docs/prefix the rules name, so it is not bookmarked here.
Generated from data/bookmarks.json, which also produces the downloadable
file — one source, two outputs. npm run check fails the build if any URL falls outside the
allowed list.