immanuwell/k16s-exam-simulator

A self-hosted CKA and CKS exam simulator. It runs a real kubeadm cluster, on any Linux VPS, or entirely on your own laptop, no VPS required.

One command to provision. Browser-based terminal. Timed mock exams, with per-question setup and automated grading.

Most Kubernetes practice labs run kind or lightweight k3s clusters. Neither matches the real exam environment:

• kind runs every node as a container inside one Docker daemon, no real node isolation, no systemctl, no kubelet config files, no crictl.
• k3s skips kubeadm-specific workflows entirely, no cluster init, no etcd backup, no static pod manifests, no certificate management.

K16S runs a real kubeadm cluster, with Incus LXC containers as worker nodes. Each worker is a full Linux system: its own init, systemd, containerd, kubelet. That's what the actual exam runs.

CKA - two full mock exams, 18 questions each, covering the 2026 CKA curriculum: troubleshooting, cluster architecture, networking, workloads, storage.

CKS - three full mock exams, covering the 2026 CKS curriculum: NetworkPolicy, AppArmor, seccomp, CIS benchmarks via kube-bench, API server and kubelet hardening, PKI.

Every question ships with a setup.sh that puts the cluster into the exam's broken/incomplete state, and a validate.sh that grades your fix against real cluster state.

Full question-by-question breakdown: DOCS.md § Exam content.

Pick one mode:

Full details per mode: DOCS.md § Requirements.

git clone https://github.com/immanuwell/k16s-exam-simulator.git
cd k16s-exam-simulator
bash install.sh --laptop

Boots a disposable Ubuntu VM with Lima and runs the same provisioner inside it, same kubeadm cluster, same Incus workers, same exam server. Your laptop's own OS is never touched. When it's done, open http://localhost:8080/.

Manage it afterward with local/k16s-local: stop / start / status / ssh / logs / reset / destroy. Full command reference: DOCS.md § Managing your environment.

git clone https://github.com/immanuwell/k16s-exam-simulator.git
cd k16s-exam-simulator
bash install.sh --lightweight

Runs entirely inside Docker via kind, no VM, nothing written to your host OS. Still a real kubeadm cluster underneath, not an approximation: static pods, etcd, and systemd-managed kubelet/containerd are structurally identical to the other two modes.

One trade-off: AppArmor doesn't work under Docker, and a couple of questions reach worker nodes directly via Incus, which doesn't exist in this mode either. 10 questions total are unavailable, the UI greys them out and excludes them from scoring, so 100% is still reachable. Everything else works the same.

Manage it with lightweight/k16s-lite, same command set as laptop mode.

git clone https://github.com/immanuwell/k16s-exam-simulator.git
cd k16s-exam-simulator
bash install.sh --host <your-vm-ip>

Installs containerd/kubeadm/kubelet, runs kubeadm init with Calico, joins two Incus LXC workers, and deploys the exam server behind nginx.

If <your-vm-ip> is a private/LAN address, open http://<your-vm-ip>/ directly. If it's a public IP, install.sh detects that automatically, keeps port 80 off the public internet, opens an SSH tunnel for you, and prints http://localhost:8080/ instead. Full flag reference (--tunnel, --port, reconnecting after a dropped tunnel, etc.): DOCS.md § Installer reference.

Re-running install.sh is always safe, every step is idempotent.

Pick an exam and a duration in the UI. Setup Env puts that question's environment into its broken/incomplete state. Work the problem in the built-in terminal: kubectl, helm, etcdctl, crictl all available, workers reachable via ssh node01 / ssh node02. Check Answer grades your fix against real cluster and filesystem state, not YAML syntax.

Full architecture, API reference, and runtime file layout: DOCS.md § Architecture.

Each question is one YAML file plus two scripts, setup.sh and validate.sh. Drop them into exams/<profile>/, re-run install.sh, no rebuild needed.

Full spec: DOCS.md § Adding custom questions.

bash uninstall.sh --host <your-vm-ip>    # removes the cluster, packages, and candidate user
bash uninstall.sh --laptop               # deletes the Lima VM
bash uninstall.sh --lightweight          # deletes the kind cluster

Laptop and lightweight mode are a clean teardown by construction. Details and dry-run mode: DOCS.md § Uninstalling.

Cluster showing NotReady after a reboot, a dropped SSH tunnel, or other common issues: DOCS.md § Troubleshooting.

PolyForm Noncommercial 1.0.0, free for personal and non-commercial use; commercial use (including SaaS or paid services built on top of this) requires a separate agreement.