Install

The full machine setup: every tool a track can need, the kubefit CLI, and kubefit doctor to check the result. If you only want a first CKA rep, the Quickstart is shorter and sends you back here when a tool is missing.

Prerequisites

kubefit runs on macOS (Apple silicon or Intel) and Linux. What you need depends on the tracks you drill.

On macOS, use Homebrew:

brew install kind kubernetes-cli helm lima

Docker is separate: brew install --cask docker on macOS, or Docker Desktop ↗.

Linux

Install tools from their official Linux packages or release binaries. Select your distribution and CPU architecture in each guide:

• Docker Engine ↗ — install and start the daemon; follow the Linux post-install steps ↗ to run Docker as your normal user.
• kind release binaries ↗.
• kubectl on Linux ↗.
• Helm release binaries or package manager ↗.
• LFCS: Lima release binaries ↗ and QEMU ↗.
• ICA: istioctl ↗.
• CKS: Trivy Linux packages ↗.

Optional tmux is available through your distribution’s package manager.

kubefit doctor prints a hint for anything missing, matched to your platform: Homebrew commands on macOS, and the upstream install pages or a direct command on Linux.

Give Docker enough resources for a three-node kind cluster: 4 CPUs and 6 GB of memory is comfortable. The LFCS VM asks for 2 CPUs, 3 GiB of memory and a 20 GiB disk, plus two 4 GiB practice disks.

Install the CLI

On macOS, install from the Homebrew tap. The same formula carries Linux amd64 and arm64 builds, for Homebrew on Linux:

brew tap BGilleran522/kubefit
brew trust BGilleran522/kubefit
brew install kubefit

Homebrew 7 requires brew trust for third-party taps; without it the install stops with Refusing to load formula ... from untrusted tap. The binary is universal, so one formula covers Apple silicon and Intel, and it is signed with a Developer ID Application certificate and notarized by Apple. Later versions are brew upgrade kubefit.

On Linux, download the static binary for your architecture and verify its checksum before installing. This needs curl, jq, tar, sha256sum and sudo:

(
  set -eu
  case "$(uname -m)" in
    x86_64) arch=amd64 ;;
    aarch64|arm64) arch=arm64 ;;
    *) echo "Supported Linux architectures: x86_64 and arm64" >&2; exit 1 ;;
  esac
  tmp=$(mktemp -d)
  trap 'rm -rf "$tmp"' EXIT
  cd "$tmp"
  curl -fsSL -o release.json https://api.github.com/repos/BGilleran522/homebrew-kubefit/releases/latest
  version=$(jq -er '.tag_name' release.json)
  asset="kubefit-$version-linux-$arch.tar.gz"
  sha=$(jq -er --arg name "$asset" '.assets[] | select(.name == $name) | .digest | select(test("^sha256:[0-9a-f]{64}$")) | ltrimstr("sha256:")' release.json)
  curl -fL -o kubefit.tar.gz "https://github.com/BGilleran522/homebrew-kubefit/releases/download/$version/$asset"
  printf '%s  kubefit.tar.gz\n' "$sha" | sha256sum -c -
  tar -xzf kubefit.tar.gz kubefit
  sudo install -m 0755 kubefit /usr/local/bin/kubefit
  kubefit version
)

The installer fetches the latest release and checks its GitHub-published SHA-256 digest before installation. Missing release metadata, a failed download or a checksum mismatch stops installation. Install jq through your distribution’s package manager if needed. If GitHub rate-limits the request, retry later or use the releases page ↗. Upgrading uses the same commands.

The Linux binaries are CGO_ENABLED=0 static builds for amd64 and arm64, so they run on glibc and musl alike. Signing and notarization are macOS concerns; the Linux archives are unsigned.

Check your tools

kubefit doctor

doctor reports each tool as ok, missing (with the install command) or stopped when Docker is installed but its daemon is not running. Fix what your track needs and run it again. Docker, kind, kubectl and helm are the core tools. From CLI v0.1.9, doctor also lists Lima, istioctl, trivy, Python 3 and Bash as optional, and a missing one does not count against your setup: Lima only matters for LFCS, istioctl for the istio pack, trivy for CKS, and Python 3 and Bash for mock exams. Earlier versions do not check istioctl, trivy, Python 3 or Bash, so confirm those yourself, for example with trivy --version.

Next

Installing needs no account, but drilling does: packs are downloaded with your login. Continue with the Quickstart from step 3, or read Account, email and CLI login for how sign-in and tokens work. Per-track requirements are in Tracks and cluster profiles.

kubefit doctor exits nonzero when a core tool is missing or broken, or the Docker daemon is unavailable. Track-specific tools, including Lima for LFCS, are reported as optional and do not fail the core check. The output identifies which track needs each tool.