Home › practice tasks
Kubernetes · hands-on

Kubernetes practice tasks for CKA, CKAD & CKS

Read all 50 task descriptions without signing in. One selected task per Kubernetes certification is free each week with an account (2 starts per week). Other live tasks require full access.

50 hands-on CKA, CKAD, and CKS tasks on real Kubernetes clusters in your browser - each graded by a programmatic validator with partial credit. Read the task first, then check whether its live lab is the free weekly selection or requires full access.

Read this week’s free CKA task →

CKA Practice Tasks

17 tasks · CKA lab · curriculum

Cluster Architecture, Installation & Configuration · 25%

CNI InstallationArgo CD Helm InstallationCertificate Management

Workloads & Scheduling · 15%

PriorityClass ConfigurationHorizontal Pod AutoscalerSplit Node ResourcesSidecar ContainerTaints and Tolerations

Services & Networking · 20%

Network PolicyGateway API MigrationTLS Version RestrictionNodePort ServiceIngress

Storage · 10%

StorageClass ConfigurationRestore MariaDB with PVC

Troubleshooting · 30%

cri-dockerd SetupControl Plane Failure

CKAD Practice Tasks

17 tasks · CKAD lab · curriculum

Application Design and Build · 20%

Create CronJob with History LimitsBuild Container Image with PodmanFix Broken Deployment YAML

Application Deployment · 20%

Canary Deployment Traffic SplitRolling Update and RollbackRight-size Deployment Memory within a Namespace LimitCreate and Expose a Deployment

Application Observability and Maintenance · 15%

Add Readiness ProbeFix Service Selector

Application Environment, Configuration and Security · 25%

Create Secret from Hardcoded VariablesServiceAccount, Role, and RoleBindingFix Broken Pod ServiceAccountPod and Container Security Context

Services & Networking · 20%

Fix NetworkPolicy Pod LabelsCreate NodePort ServiceExpose an Application via IngressFix a Misconfigured Ingress

CKS Practice Tasks

16 tasks · CKS lab · curriculum

Cluster Setup · 10%

CIS Benchmark: Harden the Kubelet and etcdUpgrade a Worker Node by One Patch VersionSecure the API Server (Anonymous Auth, Node,RBAC, NodeRestriction)

Cluster Hardening · 15%

Create a TLS Secret for clever-cactusNetworkPolicies for Namespace IsolationCilium Ingress with TLS Termination and HTTP-to-HTTPS RedirectEnable Istio Sidecar Injection and Enforce STRICT mTLS

System Hardening · 15%

Harden the Docker Daemon on a Node

Minimize Microservice Vulnerabilities · 20%

Enforce Container Immutability on lamp-deploymentLock Down ServiceAccount Token AutomountingFix Deployment for Restricted Pod Security Standard

Supply Chain Security · 20%

Fix a Vulnerable Dockerfile and Deployment ManifestIdentify a Vulnerable Package and Generate an SPDX SBOMImagePolicyWebhook Admission Control

Monitoring, Logging and Runtime Security · 20%

Finding a Pod Reading from /dev/memImplement and Extend an API Server Audit Policy