Most people who fail a CNCF Kubernetes performance exam don’t fail because they don’t know Kubernetes. They fail because they ran out of time. The CKA, CKAD, and CKS are hands-on, terminal-based exams where the clock is your real opponent — and the candidates who pass are the ones who turned kubectl, Vim, and the shell into reflexes.
Here’s the thing the KubeAstronaut journey teaches you quickly: the terminal skill set is almost identical across all five certifications. The Kubernetes concepts differ between CKA (administration), CKAD (development), and CKS (security), but the way you move through the exam environment — generate YAML fast, edit it in Vim, apply it, and verify it — is shared muscle memory. Build it once and it pays off across every performance exam you sit.
This guide is that shared toolkit. Master it and you’ll claw back the minutes that separate a pass from a near-miss.
Why the Terminal Is the Real Exam
CNCF performance exams put you in a remote terminal with access to several clusters. You read a task, switch to the right cluster, do the work on the command line, and move on. There are typically 15–20 tasks and roughly 2 hours, which works out to 6–8 minutes per task — and some tasks are worth more than others.
That math is unforgiving. Spend 90 seconds hand-typing a Pod manifest you could have generated in 5 seconds, repeat that across 17 tasks, and you’ve burned 20+ minutes on typing alone. The exam isn’t testing whether you can write YAML from memory. It’s testing whether you can get the cluster into the required state, fast. Imperative commands and good Vim hygiene are how you do that.
The Three Habits That Save the Most Time
Before any specific command, internalize these three habits. They matter more than any single trick.
- Generate, don’t type. Almost every object can be scaffolded with
kubectl createorkubectl runplus--dry-run=client -o yaml. Hand-writing manifests is the slowest possible path. - Always set the namespace. Tasks specify a namespace. Getting it wrong means zero points even with perfect YAML. Use
-nreligiously or set the context’s namespace. - Verify everything. After every task, confirm the object exists and is healthy. A task you think you finished but didn’t is worse than one you skipped, because you won’t come back to it.
Step 1: Configure Your Shell in the First 90 Seconds
The very first thing to do when the exam starts — before reading task one — is set up your environment. This 90-second investment pays back many times over.
# The single most important alias
alias k=kubectl
# Make the alias work with kubectl autocompletion
source <(kubectl completion bash)
complete -o default -F __start_kubectl k
# Two environment variables that save typing on every single command
export do="--dry-run=client -o yaml" # "dry output"
export now="--force --grace-period=0" # delete immediatelyWith those in place, scaffolding a Deployment becomes:
k create deploy web --image=nginx $do > web.yamlThat’s it. k, the generator, $do, redirect to a file. You’ll type this hundreds of times in practice and it becomes automatic.
On the CKA and CKS exams you also want a fast way to set the namespace so you stop appending -n:
k config set-context --current --namespace=team-blueNow every command runs against team-blue until you switch. Just remember to reset it when a task moves you to a different namespace.
Step 2: Master the Imperative Generators
These are the commands that turn a 90-second typing job into a 5-second one. You should know them without thinking.
| You need to create… | Command |
|---|---|
| A Pod | k run nginx --image=nginx $do |
| A Deployment | k create deploy web --image=nginx --replicas=3 $do |
| A Service (ClusterIP) | k expose deploy web --port=80 --target-port=8080 $do |
| A ConfigMap | k create cm app-config --from-literal=KEY=value $do |
| A Secret | k create secret generic db --from-literal=pass=s3cr3t $do |
| A Job | k create job backup --image=busybox $do -- /bin/sh -c "echo hi" |
| A CronJob | k create cronjob report --image=busybox --schedule="*/5 * * * *" $do |
| A namespace | k create ns dev $do |
| A ServiceAccount | k create sa build-bot $do |
| An RBAC Role | k create role dev --verb=get,list --resource=pods $do |
| A RoleBinding | k create rolebinding dev-rb --role=dev --serviceaccount=ns:build-bot $do |
Notice that the RBAC generators (create role, create rolebinding, create clusterrole, create clusterrolebinding) are critical for both CKA and CKS — RBAC tasks appear constantly, and typing those manifests by hand is painful and error-prone. Let the generator do it.
The “generate, then edit” workflow
The generators won’t produce everything a task needs — they get you 80% of the way. The pattern is always the same:
# 1. Generate the skeleton
k run app --image=nginx $do > app.yaml
# 2. Edit in Vim to add the parts the generator can't (volumes, probes,
# securityContext, resource limits, env from secrets, etc.)
vim app.yaml
# 3. Apply and verify
k apply -f app.yaml
k get pod app -o wideThis generate-edit-apply loop is the single most important workflow on the exam. Practice it until it’s invisible.
Step 3: Survive (and Thrive) in Vim
You will be editing YAML in Vim. There’s no way around it, and YAML’s whitespace sensitivity makes a careless editor deadly. A handful of settings and commands make all the difference.
Create or edit ~/.vimrc at the start of the exam:
set number " line numbers
set expandtab " spaces, never tabs (critical for YAML)
set tabstop=2 " a tab is 2 spaces
set shiftwidth=2 " indent by 2
set autoindent " keep indentation on new linesThe expandtab line alone prevents one of the most common exam failures: a tab character sneaking into YAML and breaking the parse with a cryptic error.
The Vim commands you’ll actually use under pressure:
| Goal | Keys |
|---|---|
| Delete a whole line | dd |
| Delete 5 lines | 5dd |
| Copy a line / paste below | yy / p |
| Indent / outdent a block (visual mode) | > / < |
| Jump to end of file | G |
| Jump to a line number | :42 |
| Undo / redo | u / Ctrl-r |
| Find text | /searchterm |
| Save and quit | :wq |
The block-indent trick is worth highlighting: select lines with Shift-V, press > to indent the whole block at once. When you paste a chunk of YAML at the wrong indentation, this fixes it in two keystrokes instead of editing every line.
Step 4: Verify Like Your Score Depends on It (Because It Does)
Every task should end with a verification command. These are fast, and they catch the silent failures that cost the most points.
# Did the object get created, and is it healthy?
k get pod app -o wide
k get deploy,svc -n team-blue
# Why is a Pod not Running? Events live at the bottom of describe.
k describe pod app | tail -20
# What did the application actually log?
k logs app
k logs app -c sidecar # a specific container in a multi-container Pod
# Is the YAML I applied actually what I think it is?
k get pod app -o yaml | lessFor CKS specifically, verification extends to security posture: confirm a NetworkPolicy actually blocks traffic, that a Pod runs as non-root, or that an admission control policy rejects a bad manifest. The principle is identical — never trust that a change worked; prove it.
Step 5: The Documentation Is Open — Use It Well
CNCF exams allow access to the official Kubernetes documentation at kubernetes.io. This is a gift, but only if you don’t waste time hunting. Two strategies:
- Bookmark mentally, not literally. Know that the docs’ search box (top of every page) is faster than navigating menus. Search “networkpolicy,” grab the example YAML, adapt it.
- Copy canonical examples. The docs contain ready-made manifests for NetworkPolicy, PersistentVolume, securityContext, and more — exactly the objects the generators can’t scaffold. Copy the example, paste into Vim, edit the values. This is faster and less error-prone than writing from memory.
The exam isn’t testing whether you’ve memorized the NetworkPolicy schema. It’s testing whether you can find the right example and adapt it correctly under time pressure — a real-world skill.
Putting It Together: A Sample Task, Timed
Here’s how a real task flows when the habits are in place. Task: “In namespace prod, create a Deployment api with 3 replicas of nginx:1.25, expose it on port 80 via a ClusterIP Service named api-svc.”
# Set namespace once (5 seconds)
k config set-context --current --namespace=prod
# Generate and apply the deployment (10 seconds)
k create deploy api --image=nginx:1.25 --replicas=3
# Expose it (5 seconds)
k expose deploy api --port=80 --name=api-svc
# Verify (10 seconds)
k get deploy api
k get svc api-svc -o wideThirty seconds, fully verified, zero YAML typed by hand. Without these habits the same task can easily eat three or four minutes. Multiply across a whole exam and you can see exactly where the time goes.
Common Time-Wasters to Eliminate
These mistakes show up constantly in practice sessions. Train them out before exam day:
- Hand-typing manifests the generators could produce.
- Forgetting the namespace and doing perfect work in the wrong place.
- Not reading the full task before starting — then redoing work because you missed a requirement.
- Chasing a single hard task instead of flagging it and banking easier points first.
- Skipping verification and assuming success.
- Fighting Vim because
expandtabwasn’t set and YAML won’t parse.
For a deeper look at the conceptual traps (not just the terminal ones), our guide to common Kubernetes exam mistakes is a useful companion to this one.
Where to Practice These Skills
Reading about kubectl speed doesn’t build the muscle memory — repetition under realistic conditions does. The fastest way to internalize this toolkit is to drill it in a real terminal against real clusters, on a clock.
That’s exactly what the KubeAstronaut Mock Exam Bundle on Sailor.sh is built for. It bundles performance-based mock exams across all five CNCF certifications — CKA, CKAD, CKS, KCNA, and KCSA — in environments designed to mirror the real exam. Because the terminal skills transfer across every exam, practicing in one sharpens you for all of them, and the performance-based format forces you to actually do the tasks under time pressure rather than just recognize the right answer. It’s the single most efficient way to turn the techniques in this guide into reflexes before you book.
If you want exam-specific command references to drill alongside, the CKA kubectl cheat sheet and CKAD kubectl cheat sheet break down the commands that matter most per certification, and the CKA exam tips and CKAD exam tips cover strategy beyond the terminal.
Frequently Asked Questions
Do I really need to memorize kubectl commands for the exam?
You need to memorize the generators (k run, k create deploy, k expose, k create role, etc.) because they’re the biggest time-savers and aren’t always easy to find in the docs quickly. For object schemas like NetworkPolicy or PersistentVolume, you can rely on the open documentation — just know how to find and adapt the examples fast.
Is Vim required, or can I use nano?
Both vim and nano are typically available, but Vim is far more efficient once you know a dozen commands, and most experienced candidates use it. The block-indent and line-delete operations alone justify learning it. If you genuinely can’t get comfortable with Vim, nano works — just be aware you’ll be slower on heavy YAML edits.
How much faster do these techniques actually make me?
In practice, candidates who master the generate-edit-apply workflow routinely finish tasks two to four times faster than those typing manifests by hand. On a time-constrained exam, that’s often the difference between completing every task and leaving points on the table.
Do these skills transfer between CKA, CKAD, and CKS?
Almost entirely. The terminal workflow — aliases, generators, Vim, verification — is identical across all three performance exams. The Kubernetes content differs (administration vs. development vs. security), but the way you operate the environment is shared. That’s why drilling these skills once benefits your entire KubeAstronaut journey.
What’s the first thing I should do when the exam timer starts?
Set up your shell: the k alias, autocompletion, the $do and $now variables, and your ~/.vimrc. It takes about 90 seconds and pays for itself within the first two tasks. Then read the tasks, identify the high-value ones, and start banking points.
Are KCNA and KCSA also performance-based?
No — KCNA and KCSA are multiple-choice exams, not hands-on. But understanding the terminal workflow still deepens the conceptual knowledge those exams test, and if you’re pursuing the full KubeAstronaut title you’ll need the hands-on skills for CKA, CKAD, and CKS regardless.
Final Thoughts
Kubernetes knowledge gets you into the exam. Terminal fluency gets you out of it with a passing score. The candidates who earn the KubeAstronaut title aren’t necessarily the ones who know the most about Kubernetes — they’re the ones who turned kubectl, Vim, and the shell into instinct, so they could spend their two hours solving problems instead of fighting the keyboard.
Set up your shell in the first 90 seconds. Generate instead of type. Always verify. Drill it under real time pressure with realistic performance-based mock exams until it’s automatic. Do that, and the clock stops being your enemy.