Golden Kubestronaut 2026: a self-hosted practice simulator for the CNCF path

After passing the CKA again this year, I wanted one place to practise for the rest of the CNCF list without juggling a dozen browser tabs and paid mock-exam sites. So I built a small, self-hosted simulator and put it on GitHub: Golden Kubestronaut 2026.

It is a practice tool, not a shortcut. Every question is original practice material written against the published exam objectives, and the project is independent: it is not affiliated with or endorsed by the Linux Foundation or the CNCF, and the questions are not taken from, and do not claim to mirror, the real exams.

Repo: github.com/Willey2003/golden-kubestronaut

What is in the box

The project has four parts:

• Engine. A small Python service split into a facilitator (web UI and JSON API) and a conductor (the grader), plus a bank loader, a validator and a ga command-line wrapper.
• Question banks. One folder per certification: an exam.yaml with duration, pass mark and domain weights, and one YAML file per question.
• Curriculum. Seven Markdown modules, from foundations to networking and cost, with exercises to run on your own cluster.
• Deployment. A Docker Compose file for running it locally, and Kubernetes manifests if you prefer to host it in a lab cluster.

The banks

There are 16 banks and 274 questions in total. 48 of them are hands-on tasks; the rest are single-answer multiple choice with a written explanation for every option.

Bank	Focus	Questions	Hands-on
cka	Cluster administration	16	10
ckad	Application development	16	11
cks	Security	16	11
kcna	Cloud native fundamentals	24	0
kcsa	Security concepts	16	4
lfcs	Linux system administration	18	4
pca	Prometheus and PromQL	18	0
otca	OpenTelemetry	18	0
ica	Istio service mesh	18	0
capa	Argo CD, Workflows, Events, Rollouts	16	0
cgoa	GitOps principles and practice	16	0
cba, cnpa, cnpe	Cilium networking, basic to advanced	48	8
cca	General cloud concepts	18	0
kca	Kubernetes cost and FinOps	16	0

Known gaps

This is version one and I would rather be upfront about it. Several bank IDs do not yet match the content of the certification that carries that code:

• The Cilium material currently lives under cba, cnpa and cnpe. The real Cilium certification is CCA, but the cca bank holds general cloud-computing questions instead.
• There is no Backstage (CBA), Kyverno (KCA) or platform engineering (CNPA/CNPE) content yet. The kca bank covers Kubernetes cost allocation instead.
• The labs/ folder is empty. The hands-on practice currently lives in the curriculum exercises and in the hands-on bank questions.

So today, the CKA, CKAD, CKS, KCNA, KCSA, LFCS, PCA, OTCA, ICA, CAPA and CGOA banks line up with their syllabi, and Cilium is well covered under the wrong labels. Fixing the labels and writing the missing banks is next on my list.

How grading works

Multiple-choice questions are marked right or wrong against the answer key.

Hands-on questions are where the project earns its keep. Each one has a list of checks: a shell command plus an expected result (equals, contains, a regex matches, exit-success and so on). The conductor runs those commands against your cluster and splits the points evenly across the checks, so you get partial credit. For example, the etcd backup task checks that the snapshot file exists at the required path and is not empty. It doesn’t look at what you typed.

There are three modes:

• Training shows every question in the bank with no timer, and reveals answers and solutions straight away.
• Mastery and Exam draw a timed attempt and hide answers until grading.

After each attempt you get a per-domain breakdown, weakest domain first, which tells you what to study next.

Running it

You need Docker with Compose. For local validation you also need Python 3 and PyYAML.

git clone https://github.com/Willey2003/golden-kubestronaut.git
cd golden-kubestronaut
./ga validate      # check every bank parses and is well-formed
./ga doctor        # preflight (python, docker, oc, kubectl, RAM)
./ga up            # build and start the containers

Then open http://127.0.0.1:8902. By default it binds to localhost only. There is no authentication, so if you use ./ga expose to reach it from your LAN, keep it on a private network.

For hands-on grading, the conductor container mounts your ~/.kube read-only (override with KUBECONFIG_DIR) and runs kubectl from inside the container. Two practical notes:

• Point it at a throwaway practice cluster, never a real one, because the checks execute commands with that kubeconfig.
• The cluster’s API address must be reachable from inside the container.

One rough edge: doctor shares preflight code with my OpenShift project, so it flags a missing oc client and less than 8 GB of RAM. Ignore those on a plain Kubernetes setup.

The smaller sibling: kubestronaut

There is also an earlier repo, Willey2003/kubestronaut. It runs the same engine and shares six identical banks with this one: CKA, CKAD, CKS, KCNA, KCSA and PCA. It adds two banks you won’t find here:

• a Grafana bank (dashboards, data sources, alerting, provisioning)
• a combined Prometheus-plus-Grafana monitoring track (cpna)

Neither of those is a Linux Foundation certification; they are skill tracks. Use it if you want that Grafana practice. For everything else, use the golden repo.

Get it

• Repo: github.com/Willey2003/golden-kubestronaut
• Licence: Apache-2.0
• Not affiliated with or endorsed by the Linux Foundation or CNCF. Certification names are trademarks of their owners.

If you spot a wrong answer or want to help write the missing banks, open an issue or a pull request. The bank format is plain YAML, and ./ga validate runs in CI on every push.