Kubernetes Administrator

For administrators and operations teams with Linux experience: you practise building and maintaining Kubernetes clusters and fixing faults. The path prepares you for the Certified Kubernetes Administrator (CKA) exam, booked separately with the Linux Foundation. Optional depth follows your team responsibilities.

Your starting point in 3 questionsView route, duration & prices

THE LEARNING PATH AT A GLANCE

Kubernetes Administrator: stages, scope and sequence

The route spans 5 stages, from “Prior knowledge” to “Role focus”. Workshop counts, training days and price refer to the core route.

  • 4 workshops · Core route
  • 12 training days · Core route
  • €6,660 excluding VAT · Core route

  1. Prior knowledge

    Existing experience can replace individual stations.

  2. Container foundation

    Either container foundation leads into the shared Kubernetes basics.

  3. Kubernetes basics

    Practical foundations for later role responsibilities and certification goals involving hands-on exams.

  4. Operations practice

    You deepen workload practice, scaling, access and network rules, operational signals and configuration per environment.

  5. Role focus

    This learning path follows a role path, which optional topics deepen.

Your route through this path

YOUR LEARNING PATH

The experience you bring

Check which learning steps you still need.

Find your starting point: 3 questions

TEAM ROUTE: OPTIONAL

Plan a shared training programme

Roles → skill gaps → shared plan

The result: a clear route for the whole team.

Your self-assessment

For each question, choose the answer that best describes your current situation.

Recommendation without contact details or sign-up

Goal set by this learning path

Skills, sequence, workshops

Which Kubernetes skills build on each other?

The learning steps show this path’s recommended sequence. Depending on your goal, they include specialisations, optional topics or certification goals. Each step shows the workshops that cover it.

How to read the learning path
  • Required or recommended
  • Choice
  • Optional further study
  • Further learning path

Preparation

Before starting, if needed; excluded from the workshop count, days and price.

Show 3 skills

  • Prior knowledge

    Existing experience can replace individual stations.

    • PRIOR KNOWLEDGEOptionalIF NEEDED
      Linux and network access

      Command line, processes, file system, connectivity, ports, SSH access

      You practise Linux commands, processes and file permissions, check network interfaces, connectivity and open ports, and connect to remote computers using SSH. The Linux workshop helps fill knowledge gaps; the Docker and Podman workshops introduce YAML as a configuration format.

      Afterwards, you can inspect files, permissions and processes in a Linux terminal, narrow down network problems and work on remote computers using SSH.

      If you lack Linux practice, start with file editing, processes and remote access using SSH. Later CKA preparation requires confidence with Linux and the command line; there, you investigate services and logs using systemctl and journalctl. Depending on your specialization, you also need DNS resolution, IP addressing and TLS encryption knowledge, which the Linux introduction does not cover comprehensively. LFCS preparation on request complements the introduction if you want a Linux system administration credential.

      4 learning moves

      1. Navigate the file system

        You use shell commands to navigate directories and search file contents, so you can find your way around a Linux system.

      2. Check permissions and processes

        You check file permissions and running processes to understand access boundaries and stop unresponsive processes selectively.

      3. Examine network access

        You check network interfaces, connectivity and open ports separately to narrow down connection problems.

      4. Access remote computers with SSH

        You connect to a remote computer using SSH to apply your terminal skills on another system.

      • Prerequisite: The “Kubernetes basics” competency requires Linux and terminal fundamentals; if you already have this knowledge, you do not need the Linux workshop.
      • Optional further study: If you want to deepen system administration beyond Linux basics, you can request LFCS preparation; it is not a prerequisite for CKA preparation.

  • Container foundation

    Either container foundation leads into the shared Kubernetes basics.

    Choose 1 of 2

    Choose Podman if your team or target platform uses it or containers must run without root privileges; otherwise choose Docker.

    • CONTAINEROptionalCHOICE
      Docker fundamentals

      Images, containers, volumes, networks

      You build container images with Dockerfiles, including multi-stage builds, and run containers with persistent storage and network connections. With Docker Compose, you run related application services.

      Afterwards, you can build custom images, connect containers with persistent storage and run related application services with Docker Compose.

      If you lack container experience, you build Docker images and start, inspect and stop containers. Understanding this lifecycle supports later troubleshooting of containers and their runtime services on Kubernetes nodes; Linux terminal practice is required.

      4 learning moves

      1. Distinguish images from containers

        You start containers from images and inspect their state to distinguish the template from the running application.

      2. Build custom images

        When building images, you separate build stages from runtime contents so that build tools need not remain in the final image.

      3. Connect storage and networks

        You use volumes to retain data across container restarts and connect containers through networks so they can exchange data.

      4. Combine services with Compose

        In Docker Compose, you describe services, storage and networks with YAML and check how they work together in an application.

      • Recommended next step: Container experience helps with the Kubernetes introduction but is not a prerequisite for the fundamentals workshop.
      • Replacement route: The bundle connects Docker and Kubernetes through a shared booking and learning group instead of separate dates. It requires more prior knowledge: Linux command-line skills and development or system administration basics.
    • CONTAINERAlternativeCHOICE
      Podman fundamentals

      Rootless containers, pods, images

      You build container images with Podman and run containers without root privileges, with persistent storage and network connections. You group related containers into pods.

      Afterwards, you can build Podman images, run containers without root privileges using networking and persistent storage, and group them into pods.

      If your organisation uses Podman, you choose this introduction instead of Docker. You build images and run containers with Podman to match your working environment; Linux terminal practice is required.

      4 learning moves

      1. Understand rootless operation

        Through Podman's architecture, you learn how containers run under your user account without a central daemon.

      2. Build and manage images

        You build images and manage them in registries to provide applications as a reusable basis for containers.

      3. Connect networking and storage

        With networks and volumes, you connect containers and retain data while checking file permissions in rootless operation.

      4. Group containers into pods

        In pods, you group related containers and check their communication across the shared network.

      • Recommended next step: Container experience helps with the Kubernetes introduction but is not a prerequisite for the fundamentals workshop.

Core route

Each number represents one workshop included in the totals, which may cover several skills.

  1. Workshop step 1 of 4:

    Kubernetes basics

    Practical foundations for later role responsibilities and certification goals involving hands-on exams.

    • KUBERNETES BASICSCore stepSelf-declaredCORE
      Kubernetes basics

      Architecture, pods, deployments, deployment strategies, services, namespaces, CoreDNS, storage and CSI, ConfigMaps, secrets, kubectl

      You deploy and expose applications with Kubernetes, then configure and inspect them using kubectl, the Kubernetes command-line tool. You also set up basic persistent storage for applications.

      Afterwards, you can deploy applications in Kubernetes, make them reachable, supply configuration and persistent storage, and inspect them with kubectl.

      To begin cluster administration, you learn about architecture, pods, deployments, services and storage fundamentals. In the lab, you deploy an application with kubectl, expose it and inspect its state; Linux and terminal practice are required.

      5 learning moves

      1. Understand architecture and pods

        You trace how the control plane, nodes and pods work together and use kubectl to inspect the state of your first pods.

      2. Deploy and update applications

        With deployments, you deploy applications and compare update strategies to assess their risks.

      3. Access and name resolution

        Services make pods reachable while you organise resources with namespaces and check name resolution with CoreDNS.

      4. Separate configuration from images

        Through ConfigMaps and Secrets, you supply configuration and sensitive values to pods so they remain separate from the image.

      5. Check persistent storage

        You attach volumes to pods, explain the roles of CSI and StorageClasses, and check whether data survives a pod restart.

      • Prerequisite: Kubernetes basics are required; you learn Helm from scratch to install, configure and upgrade cluster software and applications and roll them back to earlier versions.
  2. Workshop step 2 of 4:

    Operations practice

    You deepen workload practice, scaling, access and network rules, operational signals and configuration per environment.

    Here you deepen your knowledge of workloads, scaling, network access and basic operational signals. Each learning path specifies whether this depth is core or optional.

    • OPERATIONS PRACTICECore stepSelf-declaredCORE
      Workloads and scaling

      StatefulSets, database operators, scheduling, resource management, HPA, VPA, KEDA

      You examine stateful workloads with StatefulSets and use database operators. Through resource settings and scheduling rules, you control Pod placement. You configure autoscaling with HPA, VPA and KEDA.

      Afterwards, you can examine StatefulSets, use database operators, control pod placement and configure autoscaling with HPA, VPA and KEDA.

      If your team runs applications with persistent data, you practise operating databases with operators, which automate administration tasks. You set resource requests, control placement on cluster nodes and configure automatic scaling; Kubernetes fundamentals are required.

      4 learning moves

      1. Understand stateful workloads

        Using a database running as a StatefulSet, you examine why stable pod identities and persistent storage belong together.

      2. Use database operators

        You set up database operators and consider their advantages and disadvantages to assess their role in database operations.

      3. Control resources and placement

        With resource requests and scheduling rules, you control which nodes pods can run on and observe their placement.

      4. Distinguish scaling approaches

        You configure HPA, VPA and KEDA, distinguishing pod counts, resource adjustments and events as a basis for scaling.

    • OPERATIONS PRACTICECore stepSelf-declaredCORE
      Networking, access and operations

      Ingress and Gateway API overview, service mesh overview, network policies, RBAC, monitoring, logging

      You place Ingress, Gateway API and service mesh in context and practise RBAC and network policies. With Prometheus and Grafana, you set up basic monitoring; with Loki, you set up logging. Gateway API migration and controller portability are outside the practical scope.

      Afterwards, you can assess networking approaches, restrict API access and communication, and set up basic monitoring and logging for Kubernetes.

      When your team needs to restrict access and detect failures, you configure role-based access control (RBAC), network policies and basic monitoring and logging with Prometheus, Grafana and Loki. This belongs to the same advanced workshop as workloads and scaling.

      4 learning moves

      1. Place routing and service mesh in context

        You compare the roles of Ingress, Gateway API and service mesh to understand their areas of use and limitations.

      2. Restrict API access and communication

        With RBAC, you restrict API actions and with network policies, communication, treating these as separate protection tasks.

      3. Collect and display metrics

        You set up Prometheus and Grafana through operators to collect cluster metrics and make them visible in dashboards.

      4. Centralise logs and configure alerts

        With Loki, you centralise cluster logs and add basic alerts to bring together indications of operational problems.

  3. Workshop step 3 of 4:
    • OPERATIONS PRACTICECore stepSelf-declaredPACKAGE MANAGEMENT
      Manage software with Helm

      Charts, values, releases, upgrades, rollbacks

      Helm packages Kubernetes resources into reusable charts and manages their installations as releases. You install and develop charts, adapt them to different environments using values, and practise testing, upgrades and rollbacks.

      Afterwards, you can create Helm charts, adapt them with values, test them and install, upgrade and roll back releases.

      Helm belongs to the CKA curriculum for cluster components. Without prior Helm knowledge, you install third-party software such as ingress controllers, monitoring and databases, adjust configuration values, perform upgrades and roll back changes. The workshop also covers developing your own charts, which are installable software packages.

      4 learning moves

      1. Distinguish charts and releases

        You distinguish a chart as a software package from an installed release to separate the reusable template from its installation.

      2. Adapt configuration with values

        You adapt a chart to its target environment using values and understand which settings change the generated resources.

      3. Develop and test your own charts

        When creating charts, you separate templates from values and use tests to check whether different settings are applied correctly.

      4. Review upgrades and roll back

        Before upgrades, you review changes and practise rollbacks using the release history to respond to faulty updates.

  4. Workshop step 4 of 4:

    Role focus

    This learning path follows a role path, which optional topics deepen.

    • ROLE PATHCore stepROLE PATH
      Administration

      Operate clusters and narrow down failures systematically.

      When you take responsibility for the cluster itself, the focus shifts from using it to building, maintaining and repairing it. The following preparation includes practising recovery of the cluster data store.

    • ROLE COMPETENCYCore stepSelf-declaredROLE PATH
      Cluster operations and troubleshooting

      kubeadm, container runtimes, etcd backup and recovery, CNI, scheduling, storage, RBAC, upgrades, troubleshooting

      Certified Kubernetes Administrator (CKA) preparation requires system administration or DevOps practice. You practise kubeadm cluster setup, upgrades, etcd backup and recovery, and diagnose network, application, storage and access faults. Passing CKA is required for the Certified Kubernetes Security Specialist (CKS) exam.

      Afterwards, you can build clusters with kubeadm, perform upgrades, back up and restore etcd, and systematically isolate operational faults.

      For cluster responsibility, you practise kubeadm setup, upgrades, backup and recovery of etcd, the cluster data store, and systematic troubleshooting. You install software with Helm and adapt configurations with Kustomize. You book the CKA exam separately with the Linux Foundation. Subsequent specializations are optional, based on team responsibilities.

      5 learning moves

      1. Connect cluster components

        When building a cluster with kubeadm, you relate the control plane, container runtimes and CNI to control, execution and networking.

      2. Control placement and storage

        Using scheduling rules and persistent storage, you practise controlling where pods run and how stateful applications receive storage.

      3. Limit access with RBAC

        You assign appropriate permissions to users and service accounts through RBAC to define allowed API actions and their scope.

      4. Practise upgrades and recovery

        You practise ordered cluster upgrades, etcd backups and recovery to understand changes and the return to a backed-up state.

      5. Isolate faults by affected layer

        For network, application, storage and access faults, you separate symptoms from causes to test focused diagnostic hypotheses.

      • DW6 CKA Exam Preparationcovered in depth and practised with exam-like tasksIntermediate4 daysOnline, taught in GermanCKA: Performance-based exam, 120 min, registration only USD 445 (one retake included), as of 4 August 2026; book and pay separately with the Linux Foundation, excluded from shown prices.
      • Prerequisite: CKS preparation requires production cluster administration practice: allow time for this and the CKA exam. The Linux Foundation requires a passed CKA for the CKS exam, even with an expired credential; preparation alone does not qualify.
      • Prerequisite: CKA preparation provides the basis for CKA-level cluster administration; operational experience in your own environment complements the exercises.
      6 more relationships
      • Recommended next step: The administration role path deepens this competency.
      • Optional further study: If your team uses Cilium, extend general networking practice with identity-based access rules, flow diagnostics using Hubble and encryption between nodes with WireGuard.
      • Optional further study: When replacing Ingress, extend the Gateway API overview with migration planning, controller support comparisons and tested rollback to the previous setup.
      • Optional further study: For Rancher or OpenShift environments, add platform-specific application and access management to Kubernetes practice; the workshops build on Kubernetes basics and do not require CKA preparation.
      • Optional further study: If your team needs control between application services, Istio extends general networking basics with encrypted, mutually authenticated connections, access rules and traffic management.
      • Optional further study: For specialist Kubernetes networking work, you can request CKNE preparation at CKA level; it is not limited to Cilium, and the exam is not yet bookable.

Possible goals

This path builds the technical foundation for these goals.

  • GoalCKA-level cluster administrationIn preparation for Certified Kubernetes Administrator (CKA), you practise cluster setup, upgrades, backup, recovery, access control and troubleshooting. Production experience develops in your own environment. Advanced monitoring, security hardening and platform practice are separate extensions.

Further study

Optional further study; excluded from the workshop count, days and price.

Show 10 skills

  • Prior knowledge

    Existing experience can replace individual stations.

    • PRIOR KNOWLEDGEOptionalON REQUEST
      Linux administration (LFCS)

      Users, services, networking, storage, troubleshooting

      Linux Foundation Certified System Administrator (LFCS) assesses users, services, networking, storage and troubleshooting at administration level, beyond the Linux introduction. Preparation is on request, an optional extension of the system administration practice expected for CKA preparation. Book and pay for the exam separately with the Linux Foundation.

      If your administration team role includes managing Linux users, services, networks and storage, you can add dedicated LFCS preparation on request after the Linux introduction. This optional extension is not a prerequisite for CKA preparation; the system administration experience expected there remains necessary.

      • DW49 Linux Foundation Certified System Administrator (LFCS)Exam preparation on requestLFCS: Performance-based exam, 120 min, registration only USD 445 (one retake included), as of 18 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request

  • Role focus

    This learning path follows a role path, which optional topics deepen.

    Extends the path but is not a mandatory step.

    • DEPTH COMPETENCYOptionalON REQUEST
      Kubernetes networking (CKNE)

      Networking via Container Network Interface (CNI), Services, name resolution, traffic management, network security, network observability

      Certified Kubernetes Network Engineer (CKNE) assesses Kubernetes networking beyond Cilium and assumes CKA-level administration skills. Preparation is on request; the exam is not yet bookable. Once available, book and pay for it separately with the Linux Foundation.

      After CKA preparation or with CKA-level administration practice, you can discuss Certified Kubernetes Network Engineer (CKNE) preparation on request if you own networking. The beta is closed; the exam is not yet available or purchasable. Once it becomes available, preparation with hands-on network configuration can be planned.

      • DW38 Certified Kubernetes Network Engineer (CKNE)Exam preparation on requestRequest
    • SPECIALIZATIONOptionalDEPTH
      Observability

      Configure metrics, logs and alert rules, then interpret the operational signals they capture.

      If you own monitoring and alerting in your team, this optional specialization focuses on analysing metrics and logs. In the following workshop, you combine them in a dashboard for troubleshooting.

    • DEPTH COMPETENCYOptionalDEPTH
      Metrics, logs and alerting

      Prometheus, Grafana, Loki, dashboards, alerting

      With Prometheus, Grafana and Loki, you collect and analyse metrics and logs from Kubernetes. You create dashboards, configure alerts and define measurable service objectives. During incidents, you combine signals and also investigate data gaps and resource problems in the monitoring stack.

      Afterwards, you can analyse Kubernetes metrics and logs with Prometheus, Grafana and Loki, configure dashboards and alerts and investigate incidents systematically.

      If you own alerting, dashboards and on-call duties, you use Kubernetes administration experience to practise PromQL and LogQL queries, reliability targets with tolerated failure allowances (error budgets), and monitoring system scaling and tuning beyond the basics. The workshop teaches Prometheus hands-on; Prometheus Certified Associate (PCA) preparation is available afterwards on request.

      4 learning moves

      1. Collect metrics and logs

        You collect metrics with Prometheus and logs with Loki to understand measurements and events as different sources of information.

      2. Query and combine data

        With PromQL and LogQL, you select relevant data and combine it in Grafana dashboards to examine anomalies in context.

      3. Define alerts and service objectives

        You formulate measurable service objectives and configure alert rules and recipients so that critical conditions become visible.

      4. Investigate incidents using signals

        You trace incidents from alerts through dashboards to logs, also checking data gaps and resource problems in the monitoring stack.

      • DW10 Kubernetes Monitoring and Observabilityoptional depthAdvanced4 daysOnline, taught in German
      • DW41 Prometheus Certified Associate (PCA)Exam preparation on requestPCA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
      2 more relationships
      • Optional further study: With experience developing HTTP services, you extend the operations perspective with application telemetry and traces.
      • Optional further study: The observability specialization extends the path with this competency.
    • DEPTH COMPETENCYOptionalDEPTH
      Traces and telemetry

      OpenTelemetry, instrumentation, context propagation, Collector, Tempo, export failures

      You instrument HTTP web services with OpenTelemetry and propagate context across services. In the Collector, you process traces, metrics and logs through separate signal pipelines; in Grafana, you investigate their relationships and diagnose export failures. You need HTTP development experience, confidence with terminal, YAML and containers, knowledge of Pods, Deployments and Services, plus basic Go, Node.js using JavaScript or TypeScript, Python or Java.

      Afterwards, you can instrument HTTP services, trace requests across services and use connected signals to distinguish application faults from telemetry failures.

      Only for team members who also instrument application code by adding measurement points: you trace requests across services with OpenTelemetry. Otherwise, the monitoring workshop covers the operations view. HTTP-service development and basic Go, Node.js with JavaScript or TypeScript, Python or Java are required.

      5 learning moves

      1. Understand the telemetry path

        You map API, SDK, Collector and backends along the data flow to distinguish how telemetry is generated, processed and stored.

      2. Instrument requests with context

        You extend automatic spans with business context and check context propagation so requests remain traceable across service boundaries.

      3. Process signals in the Collector

        Separate Collector pipelines for traces, metrics and logs reveal how each signal is received, processed and exported.

      4. Connect telemetry for diagnosis

        In Grafana, you connect traces from Tempo with metrics and logs to investigate unusual service behaviour through individual requests.

      5. Isolate export failures

        Using queues, retries and Collector metrics, you distinguish telemetry export failures from faults in the application.

      • DW11 Introduction to OpenTelemetryIntermediate3 daysOnline, taught in German
      • DW40 OpenTelemetry Certified Associate (OTCA)Exam preparation on requestOTCA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalDEPTH
      Cluster networking with Cilium

      Cilium, Hubble, L3/L4/L7 policies, FQDN egress, kube-proxy replacement, WireGuard

      You configure Cilium, follow network flows with Hubble and restrict access with policies. The work also involves examining kube-proxy replacement, WireGuard encryption between nodes and data path failures. eBPF programming is not a prerequisite.

      Afterwards, you can configure Cilium, restrict network access with policies and use Hubble and diagnostic data to isolate faults in service paths and rules.

      If you run Cilium or need network visibility, you practise HTTP access and DNS-name rules, Hubble flow diagnosis, kube-proxy replacement and node-to-node encryption beyond basic policies. Prerequisites: Kubernetes practice and networking fundamentals including IP ranges, DNS, TCP and UDP. The workshop teaches Cilium hands-on; Cilium Certified Associate (CCA) preparation is additionally available on request.

      5 learning moves

      1. Place Cilium in the data path

        You check installation prerequisites and trace Pod and Service paths to understand Cilium's role in routing and load balancing.

      2. Inspect communication with Hubble

        Hubble flows reveal sources, destinations and dropped connections so you can identify required communication before restricting it.

      3. Restrict network access deliberately

        You test identity, port, HTTP and FQDN egress rules with allowed and denied requests to verify their effect on access.

      4. Check service paths and encryption

        With kube-proxy replacement and WireGuard, you check service paths and encryption boundaries to understand these operational options.

      5. Isolate data path faults

        You combine status, Hubble flows and endpoint data into a diagnostic path that extends to eBPF programs and Cilium maps when needed.

      • DW32 Introduction to CiliumBeginner3 daysOnline, taught in German
      • DW39 Cilium Certified Associate (CCA)Exam preparation on requestCCA: Multiple-choice, 90 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalDEPTH
      Routing with Gateway API

      Gateway API, HTTPRoute, TLS, controller support, Ingress migration, rollback

      You configure gateways and routes and assess TLS and controller support. The work also involves investigating status conditions and planning a transition from Ingress to Gateway API with a rollback option.

      Afterwards, you can verify gateway routing and TLS, isolate faults through status conditions and prepare an Ingress migration with a tested rollback option.

      When moving from Ingress to Gateway API, you go beyond the basics covered in CKA preparation: you compare controllers and migrate step by step with a tested rollback. Kubernetes network access and TLS fundamentals for encrypted connections are required.

      4 learning moves

      1. Understand resources and responsibilities

        GatewayClass, Gateway and routes separate responsibilities so you can deliberately design shared entry points and service attachments.

      2. Build and test HTTP routing

        With HTTPRoute, you direct requests to suitable backends and inspect status conditions to distinguish routing rules from reference errors.

      3. Check TLS and controller support

        You test TLS connections and certificate trust, then compare required features with the controller's documented support.

      4. Prepare migration with a rollback path

        Parallel tests of Ingress and Gateway API, together with a tested rollback, provide the basis for an informed cutover decision.

    • DEPTH COMPETENCYOptionalDEPTH
      Service mesh with Istio

      Istio, traffic management, mTLS, authorization policies, JWT, troubleshooting

      You configure Istio for communication between services and external access. This includes practising mTLS, access controls and traffic management and examining service mesh operations. This focus does not replace an in-depth Gateway API migration workshop.

      Afterwards, you can use Istio to route service traffic, secure connections and access, and investigate causes of communication failures.

      If your services need encrypted, authorised communication, you configure Istio traffic management, mTLS for encrypted service-to-service connections and access policies. Familiarity with Services, NodePort and Ingress is required. The workshop teaches Istio hands-on; Istio Certified Associate (ICA) preparation is additionally available on request.

      4 learning moves

      1. Understand responsibilities in the mesh

        The roles of Istiod and Envoy explain how Istio distributes configuration and controls communication between services.

      2. Direct traffic deliberately

        Routing rules and a gateway let you direct requests to service versions and enable external access.

      3. Secure connections and access

        You combine mTLS, authorization policies and JWT validation to encrypt connections and define which requests are allowed.

      4. Investigate failures across services

        Metrics, traces and proxy configurations help you investigate the causes of delayed or rejected requests in the mesh.

      • DW16 Introduction to Istio and Service MeshIntermediate3 daysOnline, taught in German
      • DW42 Istio Certified Associate (ICA)Exam preparation on requestICA: Performance-based exam / Multiple-choice, 120 min, registration only USD 250 (one retake included), as of 16 September 2026; book and pay separately with the Linux Foundation, excluded from shown prices.Request
    • DEPTH COMPETENCYOptionalCHOICE
      Kubernetes platforms

      Workloads, access control, storage, Rancher or OpenShift

      You manage workloads, access rights and storage on a selected Kubernetes platform. Choose Rancher or OpenShift to match your environment. Platform installation, cluster management and recovery differ between the workshops.

      Afterwards, you can deploy workloads, attach persistent storage and manage access rights on your chosen platform, Rancher or OpenShift.

      You choose Rancher if your clusters run on Rancher, or OpenShift if they run on OpenShift. You deploy applications and manage access rights on your platform. If it is already in use, the workshop also fits directly after the advanced Kubernetes workshop.

      4 learning moves

      1. Understand the platform

        You explore how your chosen platform, Rancher or OpenShift, extends Kubernetes and makes cluster resources accessible through its interface.

      2. Deploy workloads

        When deploying applications, you use ConfigMaps and Secrets to manage settings and credentials separately from the container image.

      3. Attach persistent storage

        You attach persistent storage to workloads and examine how application data persists independently of short-lived containers.

      4. Assign access rights deliberately

        Using roles and user assignments, you check who can access resources and how permissions restrict that access.

      Choose 1 of 2

      Choose Rancher for Rancher-managed clusters, OpenShift for OpenShift environments; no prior OpenShift experience is needed.

    • ROLE COMPETENCYOptionalOPTIONAL
      Secure the cluster and supply chain

      Hardening against CIS (Center for Internet Security), policies, secrets such as passwords, runtime, software supply chain, audit logs, forensics

      For Certified Kubernetes Security Specialist (CKS), you practise CIS benchmark hardening: AppArmor, seccomp, Pod Security, etcd encryption and default-deny network policies. You also work with software bills of materials, image signing, admission and vulnerability checks, OpenID Connect authentication, Falco runtime detection and incident analysis using audit logs.

      Afterwards, you can harden Kubernetes components, check images before admission and investigate security incidents using runtime data and audit logs.

      The Linux Foundation requires a passed CKA exam before the Certified Kubernetes Security Specialist (CKS) exam, even if certification has expired; preparation is insufficient. When taking on cluster security, you practise hardening, runtime security and supply chain protection, including container image vulnerability scanning. The workshop requires production Kubernetes administration experience.

      5 learning moves

      1. Harden the cluster and access

        You check cluster components against CIS benchmarks and restrict access rights to identify weaknesses and unnecessary permissions.

      2. Protect Pods, secrets and networks

        You restrict container access with Pod Security, AppArmor, seccomp and network policies; etcd encryption protects stored secrets.

      3. Check images before admission

        You use bills of materials, signatures and vulnerability scans to check images and enforce admission rules for their use.

      4. Detect suspicious activity

        Falco rules detect suspicious runtime behaviour, while audit logs record critical API access for investigation.

      5. Contain and reconstruct incidents

        You isolate suspicious Pods and examine audit logs and forensic data to trace attack paths and causes.

      • DW7 CKS Exam Preparationdeepened and practised hands-onAdvanced4 daysOnline, taught in GermanCKS: Performance-based exam, 120 min, registration only USD 445 (one retake included), as of 4 August 2026; book and pay separately with the Linux Foundation, excluded from shown prices.

Which workshops make up the Kubernetes Administrator example route?

The example route includes DW2, DW3, DW9 and DW6. It covers these skills: Kubernetes basics, Workloads and scaling, Networking, access and operations, Manage software with Helm and Cluster operations and troubleshooting.

EXAMPLE ROUTE (ROLE PATH: OPERATIONS)

Kubernetes Administrator

For administrators and operations teams with Linux experience: you practise building and maintaining Kubernetes clusters and fixing faults. The path prepares you for the Certified Kubernetes Administrator (CKA) exam, booked separately with the Linux Foundation. Optional depth follows your team responsibilities.

Route scope
4
Training days
12
List price basis, per person, excl. VAT
€6,660
View the starting workshop for Introduction to Kubernetes (DW2)

Included in the totals: DW2, DW3, DW9 and DW6. Additional workshops are excluded.

Workshops in this example route

Each workshop shows its role, skills covered and planning details.

4 workshops, recommended technical sequence

Preparation

Preparation if needed

Excluded from the workshop count, days and price.
  • Docker fundamentals

    If needed: 1 of 2

    • DW1 Introduction to Docker

      If you lack container experience, you build Docker images and start, inspect and stop containers. Understanding this lifecycle supports later troubleshooting of containers and their runtime services on Kubernetes nodes; Linux terminal practice is required.

      2 days, €1,110 excluding VAT

      Content & dates for Introduction to Docker (DW1)
    • DW8 Introduction to Podman

      If your organisation uses Podman, you choose this introduction instead of Docker. You build images and run containers with Podman to match your working environment; Linux terminal practice is required.

      3 days, €1,665 excluding VAT

      Content & dates for Introduction to Podman (DW8)

Core route

  1. STARTING POINT (KUBERNETES BASICS)

    DW2 Introduction to Kubernetes

    To begin cluster administration, you learn about architecture, pods, deployments, services and storage fundamentals. In the lab, you deploy an application with kubectl, expose it and inspect its state; Linux and terminal practice are required.

    SKILLS COVERED

    Architecture, pods, deployments, deployment strategies, services, namespaces, CoreDNS, storage and CSI, ConfigMaps, secrets, kubectl

    3 days, €1,665 excluding VAT

    Choose a date

    Content & dates for Introduction to Kubernetes (DW2)

  2. OPERATIONS PRACTICE

    DW3 Advanced Kubernetes

    If your team runs applications with persistent data, you practise operating databases with operators, which automate administration tasks. You set resource requests, control placement on cluster nodes and configure automatic scaling; Kubernetes fundamentals are required.

    SKILLS COVERED

    StatefulSets, database operators, scheduling, resource management, HPA, VPA, KEDA, Ingress and Gateway API overview, service mesh overview, network policies, RBAC, monitoring, logging

    2 days, €1,110 excluding VAT

    Choose a date

    Content & dates for Advanced Kubernetes (DW3)

  3. OPERATIONS PRACTICE

    DW9 Introduction to Helm for Kubernetes

    Helm belongs to the CKA curriculum for cluster components. Without prior Helm knowledge, you install third-party software such as ingress controllers, monitoring and databases, adjust configuration values, perform upgrades and roll back changes. The workshop also covers developing your own charts, which are installable software packages.

    SKILLS COVERED

    Charts, values, releases, upgrades, rollbacks

    3 days, €1,665 excluding VAT

    Choose a date

    Content & dates for Introduction to Helm for Kubernetes (DW9)

  4. ROLE COMPETENCY

    DW6 CKA Exam Preparation

    For cluster responsibility, you practise kubeadm setup, upgrades, backup and recovery of etcd, the cluster data store, and systematic troubleshooting. You install software with Helm and adapt configurations with Kustomize. You book the CKA exam separately with the Linux Foundation. Subsequent specializations are optional, based on team responsibilities.

    SKILLS COVERED

    kubeadm, container runtimes, etcd backup and recovery, CNI, scheduling, storage, RBAC, upgrades, troubleshooting

    4 days, €2,220 excluding VAT

    Choose a date

    Content & dates for CKA Exam Preparation (DW6)

Further study

Optional further study

Excluded from the workshop count, days and price.
  • DW10 Kubernetes Monitoring and Observability

    If you own alerting, dashboards and on-call duties, you use Kubernetes administration experience to practise PromQL and LogQL queries, reliability targets with tolerated failure allowances (error budgets), and monitoring system scaling and tuning beyond the basics. The workshop teaches Prometheus hands-on; Prometheus Certified Associate (PCA) preparation is available afterwards on request.

    4 days, €2,220 excluding VAT

    Content & dates for Kubernetes Monitoring and Observability (DW10)
  • DW11 Introduction to OpenTelemetry

    Only for team members who also instrument application code by adding measurement points: you trace requests across services with OpenTelemetry. Otherwise, the monitoring workshop covers the operations view. HTTP-service development and basic Go, Node.js with JavaScript or TypeScript, Python or Java are required.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to OpenTelemetry (DW11)
  • DW32 Introduction to Cilium

    If you run Cilium or need network visibility, you practise HTTP access and DNS-name rules, Hubble flow diagnosis, kube-proxy replacement and node-to-node encryption beyond basic policies. Prerequisites: Kubernetes practice and networking fundamentals including IP ranges, DNS, TCP and UDP. The workshop teaches Cilium hands-on; Cilium Certified Associate (CCA) preparation is additionally available on request.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Cilium (DW32)
Show 5 more workshops
  • DW35 Introduction to Kubernetes Gateway API

    When moving from Ingress to Gateway API, you go beyond the basics covered in CKA preparation: you compare controllers and migrate step by step with a tested rollback. Kubernetes network access and TLS fundamentals for encrypted connections are required.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Kubernetes Gateway API (DW35)
  • DW16 Introduction to Istio and Service Mesh

    If your services need encrypted, authorised communication, you configure Istio traffic management, mTLS for encrypted service-to-service connections and access policies. Familiarity with Services, NodePort and Ingress is required. The workshop teaches Istio hands-on; Istio Certified Associate (ICA) preparation is additionally available on request.

    3 days, €1,665 excluding VAT

    Content & dates for Introduction to Istio and Service Mesh (DW16)
  • Kubernetes platforms

    If needed: 1 of 2

    You choose Rancher if your clusters run on Rancher, or OpenShift if they run on OpenShift. You deploy applications and manage access rights on your platform. If it is already in use, the workshop also fits directly after the advanced Kubernetes workshop.

  • DW7 CKS Exam Preparation

    The Linux Foundation requires a passed CKA exam before the Certified Kubernetes Security Specialist (CKS) exam, even if certification has expired; preparation is insufficient. When taking on cluster security, you practise hardening, runtime security and supply chain protection, including container image vulnerability scanning. The workshop requires production Kubernetes administration experience.

    4 days, €2,220 excluding VAT

    Content & dates for CKS Exam Preparation (DW7)

Why is this route structured this way?

The route follows learning questions: each station builds on the previous one. Here, we explain why the transitions make sense.

Recommended learning sequence, not formal exam eligibility.

The route principle

Each station answers a different learning question.

  1. Understand the foundations

    Who in your team needs Kubernetes fundamentals for cluster operations?

  2. Build operational skills

    Who will scale applications, restrict access and detect failures?

  3. Manage cluster software

    Who will install, configure and update cluster software, then roll it back if problems arise?

  4. Practise cluster operations

    Who takes responsibility for cluster setup, maintenance and recovery and needs CKA preparation?

The learning rationale in detail

Brief explanations clarify the transitions without repeating the route.

  1. DW2 then DW3: Required foundation

    Why do Kubernetes fundamentals precede application operations?

    Knowledge of pods, deployments and services provides the foundation for database operations, resource planning and automatic scaling. Equivalent practical experience can replace the fundamentals workshop; this is not a formal admission rule.

  2. DW3 then DW9: Recommended order

    Why does Helm follow the operational skills stage?

    Understanding access rights and confidential configuration data (Secrets) helps when you set them through Helm configuration values. This order is recommended. The Helm workshop requires Kubernetes fundamentals plus kubectl, YAML and command-line practice, but no prior advanced workshop.

  3. DW9 then DW6: Preparation for the exam

    Why is Helm a core step before CKA preparation?

    The CKA curriculum includes installing cluster components with Helm and Kustomize; CKA preparation uses both tools. Helm therefore belongs to the core route. CKA preparation requires Kubernetes fundamentals, Linux and command-line practice, YAML and text-editor skills, plus system administration or DevOps experience.

What is fixed, what is flexible?

The status shows which core stations contribute to the totals and where prior knowledge or learning goals allow flexibility. Optional additions count only when selected.

  • Included in this route

    A fixed core station. A workshop may cover several competencies.

  • Equivalent alternative

    Podman replaces the optional Docker introduction when your organisation uses Podman.

  • Optional

    Additional depth for specific team responsibilities: choose these additions to match your team members’ tasks, outside the core route.

  • On request

    Exam preparation on request: no public dates or prices, excluded from totals; scope, language, format and price agreed after a discovery call. Requests are not bookings or exam registrations; book and pay for available exams separately with the Linux Foundation.

Sources for this route

Agenda · Practice lab · Exam body · checked on

View methodology and sources

How does the roadmap lead to practical experience?

The roadmap sets out competency goals and sequence; the workshop agenda shows the content. In practical workshops, you apply that knowledge in the browser-based Dojo. The certificate of attendance documents workshop participation but does not replace proof of passing an exam; exams for CKA are taken separately through the Linux Foundation or CNCF.

From learning goal to application

4 clear steps

  1. Competency goal

    The learning goal describes a concrete task.

  2. Workshop agenda

    Content and sequence are clear.

  3. Dojo practice

    In practical workshops, you apply knowledge in Dojo exercises.

  4. Application & context

    The certificate of attendance documents participation, not certification.

What “covered” means and how we substantiate it

4 criteria: directly supported

  • Visible

    Content is transparent

    “Covered” is an editorial classification of the visible workshop agenda, not proof of assessed competence.

  • Structured

    The sequence is explained

    The agenda arranges topics in a clear learning sequence.

  • Applied

    Knowledge is applied in practice

    In practical workshops, you apply knowledge through exercises in the browser-based Dojo.

  • Distinguished

    Records remain separate

    The certificate of attendance and proof of passing an exam remain separate.

Reviewed by the expert team at DevNinjas GmbH

Sources checked on

Which Kubernetes learning path fits your goal?

Compare related paths by their skills and technical focus. Check each workshop’s prerequisites before booking.

Cloud-native developer

For software developers: practise deploying, configuring and troubleshooting your own applications on a Kubernetes platform operated by others, through preparation for the separately booked Linux Foundation Certified Kubernetes Application Developer (CKAD) exam. Automated build pipelines, telemetry (measurement data), operator development and GitOps delivery are optional additions outside the core route.

  • ALTERNATIVE ROLE PATH
  • Core route 10 to 11 days
  • 4 workshops
  • ROLE PATH: DEVELOPMENT

A good fit if you want to build on the same foundations with a different technical focus.

Core routes compared

In both core routes

  • Kubernetes basicsStart
  • Workloads and scaling
  • Networking, access and operations

Only in this core route

  • Manage manifests
  • Develop and debug workloads
Explore the Cloud-native developer learning path
Compare all Kubernetes learning paths

Frequently asked questions about the Kubernetes learning path

A learning path is a recommended sequence, with no obligation to book it all. The right workshops depend on your container knowledge, target role and practical experience. The displayed duration and price refer to the core route.

CKA or CKAD: which suits my Kubernetes operations responsibilities?

Certified Kubernetes Administrator (CKA) preparation suits responsibility for Kubernetes clusters: you practise cluster setup, controlled upgrades and systematic troubleshooting. Certified Kubernetes Application Developer (CKAD) preparation focuses on applications within the cluster. The Kubernetes certification guide compares the exam goals.

Do I need production cluster experience before CKA preparation?

CKA preparation does not require prior experience administering production Kubernetes clusters. The CKA workshop requires Kubernetes and Linux knowledge, plus experience in systems administration or DevOps.

If you lack foundations, preparation adds to the workshop commitment. The learning-path overview explains how additional training affects overall time and cost.

Does the administrator learning path fully cover Rancher or OpenShift?

The Kubernetes administrator core route does not replace platform-specific training in Rancher or Red Hat OpenShift.

Rancher training covers Kubernetes cluster management in a Rancher environment. OpenShift training covers topics including Projects, Routes and platform-specific access controls. Both require Kubernetes fundamentals.

Is Kubernetes administration enough preparation for the OpenTelemetry extension?

The OpenTelemetry extension requires HTTP service development experience and knowledge of a supported programming language; Kubernetes administration alone is insufficient.

The OpenTelemetry introduction suits work on application code and its telemetry. For metrics, logs and alerting from an operations perspective, there is the Kubernetes monitoring workshop. It requires confident use of Deployments, Services, RBAC and Helm, but no prior knowledge of the monitoring tools covered.

Vincent Sturm, Key Account Manager

Discuss your team’s learning path with Vincent

Discuss goals, roles, timing, format and suitable workshop sequences with Vincent. You can explore technical questions with our trainers afterwards if needed.
View public workshop dates