Tracks and cluster profiles
Every track is a signed pack: its exercises, setup scripts, graders and the shared lab helpers. kubefit packs downloads them all when no track is saved, and only the saved track once drill, next, test or set has remembered one. Name the tracks to be sure: kubefit packs cks lfcs.
| Pack id | Track | Prepares for | Drills | Runtime | Cluster profile | Extra tools |
|---|---|---|---|---|---|---|
cka | Cluster administration | CKA | 25 | kind | base | |
ckad | Application development | CKAD | 25 | kind | base | |
cks | Kubernetes security | CKS | 25 | kind | cks | trivy (20 of the 25 drills check for it before they start), OpenSSL |
lfcs | Linux administration | LFCS | 25 | Lima VM | ||
cnpe | Platform engineering | CNPE | 25 | kind | base | |
ckne | Cloud native networking | CKNE | 25 | kind | ckne | |
istio | Service mesh | ICA | 25 | kind | base | istioctl (23 drills), OpenSSL (one drill) |
ops | Operations workshop | Not a certification | 25 | kind | base |
The pack id is what you type: kubefit drill istio, kubefit packs cks lfcs, kubefit report ops. Exercise ids start with it, as in cka-03-broken-service.
OPS is a workshop, not a certification. It drills day-two operations such as etcd backup and restore, node drains and certificate expiry. No exam sits behind it, its drills carry no domain weights, and it has no exam date on your Profile.
Cluster profiles
Kubernetes tracks run on kind. The upgrade drill additionally creates a separate v1.34.0 control plane to upgrade to v1.35.0; all other drills use their normal profile.
basecreates themusclecluster: one control plane and two workers. CKA, CKAD, CNPE, ICA and OPS share it.ckscreatesmusclefrom a hardened configuration with audit logging and encryption-at-rest mounts, so the CKS scenarios see the node names and files they expect.cknecreatesmuscle-cknewith no default CNI, and the track pins its own kubeconfig context so Cilium can be installed and inspected.
kubefit records which profile built a cluster. A cks-built muscle also serves the base tracks, because it is a superset. A base-built muscle cannot serve CKS, and the drill stops with cluster muscle was created for the base profile; this exercise needs cks. Run kubefit end, then try again. Do that and let the next drill rebuild.
When to run kubefit end
| Situation | Run kubefit end? |
|---|---|
Another drill in the same track, or another base track (CKA, CKAD, CNPE, ICA, OPS) | No. The cluster is reused and each drill reseeds its own state |
Moving from a base track to CKS | Yes. Both profiles build a cluster named muscle, and CKS needs the hardened one |
Moving from CKS to a base track | No. The hardened muscle is accepted by the base tracks |
| Moving to or from CKNE | Not required, since it uses its own muscle-ckne cluster. Do it anyway if memory is tight: two clusters are heavy |
| Moving to or from LFCS | Not required: the VM and the clusters are independent. Same memory advice |
| Cluster creation failed midway, or the cluster behaves strangely | Yes, then start the drill again |
| Done for the day | Yes. It frees CPU, memory and disk; reps, notes, packs and token stay. Two CKA drills leave their own Docker resources behind: see Local files |
The next drill after kubefit end pays the cluster or VM creation time again, so do not run it between every rep.
Add-ons a track needs, such as the NGINX ingress controller, Gateway API, metrics-server, MetalLB, Cilium, Multus, seccomp profiles or the CNPE stack, install once per cluster the first time a drill needs them.
Track runtime notes
CKS. Needs the cks profile, so kubefit end when you arrive from a base track. Twenty drills check that trivy is on the host before they start, although only the two scanning drills run it, and OpenSSL is used for certificate work. Security report triage and signed release evidence drills are offline by design.
CKNE. Runs on muscle-ckne, built with no default CNI so Cilium can be installed and inspected. The track pins its own kubeconfig context, so check kubectl config current-context before blaming a grader. Packet-path drills use isolated Linux network namespaces inside a privileged lab Pod.
LFCS. No Kubernetes and no Docker: everything happens inside the Lima VM, as root, with hyphenated helper commands (kubefit-grade, not kubefit grade). Details below.
ICA. Shares the base cluster and needs istioctl on your host. The mesh installs once per cluster the first time a drill needs it.
LFCS
LFCS drills run inside a Lima virtual machine named kubefit-lfcs: Ubuntu 24.04, 2 CPUs, 3 GiB of memory, a 20 GiB system disk and two blank 4 GiB disks for storage exercises. The drill shell is a root shell inside the VM with kubefit-task, kubefit-grade, kubefit-hint, kubefit-solution and kubefit-abandon available. Storage and kernel exercises run in the VM, never on your host. kubefit end deletes the VM and its disks.
Exam-allowed documentation
Each task ends with the documentation pages that answer it, limited to the sites the exam lets you open. kubefit task prints them. The track's Concepts guide in the app lists the allowed sites; see Concepts and playbooks.
Advanced drill scope
The CKA upgrade creates the additional kubefit-upgrade cluster. Its task documents cleanup. The etcd recovery drill uses an isolated Docker member and volume, never the live cluster datastore. CSI expansion installs a pinned demonstration driver on one worker. Allow extra memory and image-download time for these exercises.
LFCS system and storage commands run only in its disposable VM.
Coverage against the exam
Be clear about what a pack is:
- Built from public blueprints. Each certification track follows the exam's published domains. Scenarios are original; none is recalled from a live exam.
- Drill weights exist for CKA and CKAD only. Those drills carry their domain's exam percentage, which the scheduler uses. CKS, LFCS, CNPE, CKNE, ICA and OPS drills carry none yet, so every domain in those tracks ranks equally in
kubefit nextand Reports. Their percentages are in the Concepts guides and in the mock exam point split. - A training set, not the curriculum. Twenty-five drills lean toward the heavily weighted domains. They do not touch every curriculum line, and a full report does not mean full coverage. Read the official curriculum alongside the Concepts guide.
- Version drift happens. Exam Kubernetes versions and curricula change on their owners' schedules. Check the current curriculum with the exam's owner before you book.
- The environment differs. The real exam gives you a remote desktop, several clusters and its own rules. Here you get kind or one VM, on your own machine. The skills transfer; the ergonomics do not.
- Targets are training targets, not official timings.
KubeFit is not affiliated with or endorsed by CNCF or The Linux Foundation; see About KubeFit.