Certified Cloud Native Platform Engineer: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run on Kubernetes 1.35, the version the CNPE exam environment runs.
The Linux Foundation describes CNPE as "an online, proctored, performance-based test" that "requires solving multiple tasks from within a Linux-based remote desktop using the terminal and web-based interfaces". The candidate instructions say "The exams consist of 15-20 performance-based tasks" and that "The CNPE environment is currently running Kubernetes v1.35"; the general documentation allowed is kubernetes.io. The GoldenKube CNPE scenarios run on a local Kubernetes cluster and are graded from the cluster state, so a task that the exam might solve in a web interface is written so that its result can be checked in the cluster.
The scenarios are written against the five official domains: networking, storage and compute best practices, right-sizing and multi-tenancy (platform architecture and infrastructure); GitOps workflows, CI/CD pipelines and progressive delivery such as blue/green or canary (GitOps and continuous delivery); custom resource definitions, self-service provisioning, operators and automation frameworks (platform APIs and self-service capabilities); monitoring, alerting, logging and tracing, deployment metrics and incident remediation (observability and operations); and service-to-service security, RBAC, audit trails and compliance, policy engines and admission control, and security scanning in pipelines (security and policy enforcement).
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 64% source |
| Price (USD) | 445 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based source |
| Prerequisites | None source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Exam environment runs Kubernetes v1.35 source |
Published scenarios per official CNPE domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Platform Architecture and Infrastructure | 15% | 3 |
| GitOps and Continuous Delivery | 25% | 5 |
| Platform APIs and Self-Service Capabilities | 25% | 5 |
| Observability and Operations | 20% | 4 |
| Security and Policy Enforcement | 15% | 3 |
goldenkube exam cnpe draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 64%. Solutions and hints are hidden in exam mode.
20 published scenarios
Offer databases as a platform API: a namespaced CustomResourceDefinition with an enum-validated schema, a status subresource and printer columns, plus the first claim.
Single node · ~15 min · 10 points
goldenkube start cnpe-api-001
Expose app configuration as a Crossplane v2 namespaced composite API: define the XRD, write a pipeline Composition with patch-and-transform, and provision the first composite.
Single node · ~20 min · 10 points
goldenkube start cnpe-api-002
Use the Prometheus Operator as a platform automation: declare an Alertmanager and a namespaced AlertmanagerConfig, and confirm the operator reconciled them into a running, configured instance.
Single node · ~15 min · 8 points
goldenkube start cnpe-api-003
A team gets a working namespace by labelling it: a Kyverno ClusterPolicy generates the quota and the admin RoleBinding for every namespace carrying the team label and keeps them in sync.
Single node · ~15 min · 10 points
goldenkube start cnpe-api-004
Offer environment provisioning as a reusable Argo WorkflowTemplate with a parameter and a resource step, then provision the blue environment through it.
Single node · ~15 min · 8 points
goldenkube start cnpe-api-005
Two teams share one cluster. Give each namespace a ResourceQuota and LimitRange, add a tenant PriorityClass and pin a tenant workload to a dedicated node pool.
Two nodes · ~15 min · 11 points
goldenkube start cnpe-arc-001
OpenCost runs with list prices and the catalog service reserves far more than it uses. Load the on-prem price sheet into OpenCost, right-size the workload and let an HPA scale it.
Single node · ~15 min · 11 points
goldenkube start cnpe-arc-002
Tenant data must survive claim deletion and tenants must be isolated by default. Make a Retain StorageClass the only default, bind the ledger claim to it and lock the namespace down.
Single node · ~15 min · 10 points · Storage
goldenkube start cnpe-arc-003
The shop manifests live in the in-cluster Git server. Deliver them with an Argo CD Application that creates its namespace, prunes and heals drift.
Single node · ~15 min · 10 points
goldenkube start cnpe-git-001
The infra repository should be reconciled by Flux, but one manifest in it does not apply. Wire up the GitRepository and Kustomization, then fix the repository so the reconciliation turns Ready.
Single node · ~18 min · 10 points
goldenkube start cnpe-git-002
Replace the storefront Deployment with an Argo Rollout that sends 20% of the pods to a new version, waits for a human, then completes; ship podinfo 6.17.0 through it.
Single node · ~18 min · 9 points
goldenkube start cnpe-git-003
Build a Tekton Pipeline whose first Task emits the release version as a result and whose second Task publishes it into the staging namespace with kubectl, then run it.
Single node · ~18 min · 9 points
goldenkube start cnpe-git-004
Run checkout as an Argo Rollout with a blue/green strategy, verify the new version on the preview Service, then switch the active Service by promoting.
Single node · ~15 min · 8 points
goldenkube start cnpe-git-005
Get the shop API into the platform Prometheus: scrape it with a ServiceMonitor, alert on its 5xx ratio and precompute its request rate with a recording rule.
Single node · ~18 min · 10 points
goldenkube start cnpe-obs-001
The platform OpenTelemetry Collector only handles metrics. Give it an OTLP traces pipeline with the right processors, expose it, and prove it with generated spans.
Single node · ~18 min · 9 points
goldenkube start cnpe-obs-002
Ship only the shop namespace's container logs: run the OpenTelemetry Collector as a DaemonSet with the filelog receiver on the node's pod log files and print the records with the debug exporter.
Single node · ~18 min · 9 points
goldenkube start cnpe-obs-003
Two workloads in namespace checkout are degraded: diagnose a failed rollout and an OOM-killed container from events and status, remediate both in place and record the findings in an incident ConfigMap.
Single node · ~14 min · 10 points
goldenkube start cnpe-obs-004
Move the bank and frontend workloads into the Istio mesh and require mutual TLS for every workload in bank, so meshed clients still reach the ledger while plaintext clients are refused.
Single node · ~16 min · 11 points
goldenkube start cnpe-sec-001
Give the CI service account exactly the rights it needs to roll out Deployments in one namespace, and enforce a pod baseline there with Kyverno: non-root containers and pinned image tags.
Single node · ~16 min · 11 points
goldenkube start cnpe-sec-002
Produce a CycloneDX SBOM for an image from the node's containerd store with Trivy and publish it as a ConfigMap, then restrict the registries Pods in a namespace may pull from with an OPA Gatekeeper ConstraintTemplate and Constraint.
Single node · ~18 min · 10 points
goldenkube start cnpe-sec-003
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The CNPE scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
The CNPE curriculum names tools only as examples, among them Argo, Crossplane, Flux, Gatekeeper, Kyverno, OpenTelemetry, Prometheus and Tekton, and says candidates are not tested on deep tool-specific knowledge beyond the listed competencies. Each scenario page shows the full task text, so you can see what a task asks before you run it.
No. The Linux Foundation lists no prerequisite for CNPE. CNPA is the multiple-choice platform engineering exam and covers much of the same vocabulary, so its GoldenKube question bank is a useful warm-up for the CNPE labs.