Certified Kubernetes Application Developer: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run on Kubernetes 1.37, the version the CKAD exam is based on.
The Linux Foundation describes CKAD as the certification that "certifies that candidates can design, build and deploy cloud-native applications for Kubernetes". The GoldenKube CKAD scenarios stay on that application side of the cluster: you work inside namespaces with kubectl, YAML, Helm and Kustomize, never on kubeadm, etcd or the nodes themselves.
The tasks follow the competencies the official page lists under each of the five domains: multi-container Pods with sidecar and init containers, Jobs and CronJobs (design and build); rolling updates, rollbacks, a canary release, a Helm chart and a Kustomize overlay (deployment); probes, logs and a Deployment that never becomes Ready (observability and maintenance); ConfigMaps, Secrets, SecurityContexts, requests and limits with quotas, ServiceAccounts with RBAC and a CustomResourceDefinition (environment, configuration and security); and Services, a NetworkPolicy and an Ingress with TLS (services and networking).
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 66% source |
| Price (USD) | 445 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based (command line) source |
| Prerequisites | None source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Based on Kubernetes v1.37 source |
Published scenarios per official CKAD domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Application Design and Build | 20% | 4 |
| Application Deployment | 20% | 4 |
| Application Observability and Maintenance | 15% | 3 |
| Application Environment, Configuration and Security | 25% | 5 |
| Services and Networking | 20% | 4 |
goldenkube exam ckad draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 66%. Solutions and hints are hidden in exam mode.
20 published scenarios
Recover a Deployment whose latest rollout is stuck by rolling back, then make future rollouts zero-downtime.
Single node · ~6 min · 9 points
goldenkube start ckad-dep-001
Run a stable and a canary Deployment side by side behind one Service and split traffic by replica count.
Single node · ~8 min · 9 points
goldenkube start ckad-dep-002
Deploy an application from an existing Helm chart into a namespace and override one chart value.
Single node · ~6 min · 8 points
goldenkube start ckad-dep-003
Write a Kustomize overlay that changes namespace, names, labels, replicas and image of an existing base, then apply it.
Single node · ~8 min · 9 points
goldenkube start ckad-dep-004
Build a two-container Pod where a log-shipping sidecar reads a file the main container writes into a shared volume.
Single node · ~7 min · 8 points
goldenkube start ckad-des-001
Use an init container to write content into a shared volume before the main web container starts.
Single node · ~7 min · 9 points
goldenkube start ckad-des-002
Create a batch Job that runs several completions in parallel with retry and deadline limits.
Single node · ~6 min · 8 points
goldenkube start ckad-des-003
Create a CronJob with concurrency and history settings, then trigger an immediate run from it.
Single node · ~7 min · 9 points
goldenkube start ckad-des-004
Create a ConfigMap and a Secret and consume them in a Pod as single env vars, envFrom and a mounted volume.
Single node · ~7 min · 9 points
goldenkube start ckad-env-001
Run a Pod as a non-root user with a read-only root filesystem, no privilege escalation and no capabilities.
Single node · ~7 min · 11 points
goldenkube start ckad-env-002
Constrain a namespace with a ResourceQuota and LimitRange defaults, then deploy a workload that fits inside them.
Single node · ~8 min · 10 points
goldenkube start ckad-env-003
Give an application its own ServiceAccount with a namespaced Role and switch a running Deployment to it.
Single node · ~8 min · 10 points
goldenkube start ckad-env-004
Discover the schema of a custom resource and create and update objects of that kind with kubectl.
Single node · ~6 min · 8 points
goldenkube start ckad-env-005
Expose the same pods through a ClusterIP Service with port mapping and a NodePort Service on a fixed node port.
Single node · ~6 min · 9 points
goldenkube start ckad-net-001
Lock down a namespace with a default-deny ingress policy and allow a single client label to reach an API on one port.
Single node · ~8 min · 8 points
goldenkube start ckad-net-002
Expose two Services under one host with path-based Ingress rules and terminate TLS with a certificate Secret.
Single node · ~8 min · 9 points · Ingress
goldenkube start ckad-net-003
Find why a Service does not reach the pods of a healthy Deployment and fix the Service.
Single node · ~6 min · 7 points
goldenkube start ckad-net-004
Add HTTP readiness and TCP liveness probes with specific timings to a running Deployment.
Single node · ~7 min · 10 points
goldenkube start ckad-obs-001
Use events, pod status and describe output to find and fix why a Deployment's pods never become Ready.
Single node · ~8 min · 8 points
goldenkube start ckad-obs-002
Collect container logs and produce label-filtered and custom-column kubectl output into answer files.
Single node · ~7 min · 6 points
goldenkube start ckad-obs-003
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The CKAD scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
No. The Linux Foundation lists no prerequisite for CKAD. The two exams overlap (Pods, Deployments, Services, NetworkPolicies), so preparing for one helps with the other; the CKA catalog is listed next to this one.
Yes. The official CKAD domain Application Deployment names the Helm package manager and Kustomize, and the CKAD bank has one scenario for each: install a local chart with a value override, and build a production overlay.