CKA · CKAD

What changed for the CKA and CKAD in Kubernetes 1.37

TL;DR

  • The syllabus did not move. The CKA v1.37 curriculum PDF is byte-identical to v1.35, and the CKAD v1.37 PDF is byte-identical to v1.34. Same domains, same weights.
  • No stable API stopped being served between 1.35 and 1.37. The YAML you already write for Ingress, NetworkPolicy, Deployments, HPA, RBAC and CRDs still applies.
  • kubectl exec needs -- before the command. The form without -- has failed since 1.31 (#125437). The 1.34 CKAD and 1.35 CKA curricula already included it.
  • CKA only: kubeadm 1.37 no longer loads kubeadm.k8s.io/v1beta3 config, kubectl get crd prints more columns, nodes ship etcd 3.7.0, and the kubelet can no longer be set to allow a static Pod that references API objects.
  • Unchanged: etcdutl snapshot restore still works, and kubeadm still writes iptables when the kube-proxy mode is empty.
Before and Kubernetes 1.37. kubeadm rejects kubeadm.k8s.io/v1beta3 with error: your configuration file uses an old API spec: kubeadm.k8s.io/v1beta3 (kind: ClusterConfiguration). kubectl get crd adds Namespaced and the storage version.
Measured on our 1.37 replays, 23 Oct 2026

Which Kubernetes version the exam runs

The Linux Foundation's CKA/CKAD/CKS FAQ says both the CKA and the CKAD environments run Kubernetes v1.37 (re-read on 23 Oct 2026).

The previous curriculum files were v1.35 for the CKA and v1.34 for the CKAD. This page covers the changes from 1.35 to 1.37 for the CKA and from 1.34 to 1.37 for the CKAD.

The FAQ says the exam environments are aligned with the most recent Kubernetes minor version within approximately 4 to 8 weeks of its release. We don't predict dates. When the exam moves to a new version, we add a page to this series.

The changes that affect what you type

Change Exam Exam task affected What to do differently
kubectl exec POD COMMAND is no longer supported (since 1.31, #125437) both CKAD: debugging. CKA: manage and evaluate container output streams Write kubectl exec POD -- COMMAND
kubectl get crd prints extra columns (1.37) CKA Understand CRDs, install and configure operators Don't parse a line as name + timestamp. Use -o name or -o jsonpath if you need one field
kubeadm removes the v1beta3 config API (1.37) CKA Create and manage clusters with kubeadm; cluster lifecycle Use apiVersion: kubeadm.k8s.io/v1beta4. Convert old files with kubeadm config migrate from a v1.36 kubeadm binary (#136016)
Default etcd image is v3.7.0 (1.37) CKA Troubleshoot cluster components (etcd backup and restore) Nothing for restore: etcdutl snapshot restore still works
An empty kube-proxy mode is still written as iptables (1.37) CKA kubeadm install; cluster networking Don't switch to nftables or ipvs unless the task says so
kubelet can no longer allow static Pod API references (1.37) CKA Troubleshoot clusters and nodes Put the data in the manifest file. Docs already forbid a Secret, ConfigMap, or ServiceAccount reference

Removed APIs: none that you write on the exam

The official Deprecated API Migration Guide has no entries after v1.32. Its newest "stopped serving" section is v1.32, which removed flowcontrol.apiserver.k8s.io/v1beta3. No stable API stopped being served in 1.35, 1.36 or 1.37.

So the versions you already use still hold:

Object apiVersion
Ingress, IngressClass, NetworkPolicy networking.k8s.io/v1
Deployment, ReplicaSet, DaemonSet, StatefulSet apps/v1
CronJob batch/v1
HorizontalPodAutoscaler autoscaling/v2
PodDisruptionBudget policy/v1
Role, RoleBinding, ClusterRole, ClusterRoleBinding rbac.authorization.k8s.io/v1
CustomResourceDefinition apiextensions.k8s.io/v1

The removals listed in the 1.35–1.37 changelogs are alpha APIs that aren't on the curriculum, plus the kubeadm config API covered below. One change on the client side: kubectl 1.35 also dropped its client code for four beta APIs that the server had already stopped serving (certificates/v1beta1, discovery/v1beta1, networking/v1beta1 Ingress, policy/v1beta1 PDB). If you were already writing v1, nothing changes for you.

kubectl changes

kubectl exec requires -- (since 1.31)

# no longer supported
kubectl exec mypod ls /data

# write this
kubectl exec mypod -- ls /data
A still-common trap since kubectl 1.31, not a 1.37 change. kubectl v1.37.0 still prints error: exec [POD] [COMMAND] is not supported anymore. Use exec [POD] -- [COMMAND] instead. Then kubectl exec mypod -- ls /data is accepted.
A still-common trap since kubectl 1.31. Real output, kubectl v1.37.0.

The form kubectl exec POD COMMAND without -- has failed since 1.31 (#125437). kubectl v1.34.0 already prints exec [POD] [COMMAND] is not supported anymore, and v1.37.0 still does, as in the figure. Write the -- before exam day.

kubectl get crd prints extra columns (1.37)

Before 1.37, kubectl get crd printed the name and a creation timestamp. In 1.37 it adds more columns (#131599). In our 1.37.1 cluster, one line read:

certificaterequests.cert-manager.io   Namespaced   v1(storage)   2026-10-23T02:55:44Z

If a task asks you to save CRD names to a file, don't cut columns out of the default table. Use kubectl get crd -o name or a jsonpath query instead. Both give the same result on any version.

kubeadm: v1beta3 config is gone (1.37, CKA only)

kubeadm 1.37 removes the kubeadm.k8s.io/v1beta3 config API, which has been deprecated since 1.31 (#136016). A v1beta3 ClusterConfiguration will no longer load.

  • Write apiVersion: kubeadm.k8s.io/v1beta4.
  • To convert an old file, run kubeadm config migrate with a v1.36 kubeadm binary, before upgrading to 1.37 (#136016). kubeadm v1.37.0 prints "Please use kubeadm v1.36 instead and run 'kubeadm config migrate ...'".
  • A placeholder v1 API exists. It is experimental and can't be used yet.

The upgrade procedure itself is unchanged: one minor version at a time, kubeadm upgrade apply on the control plane, then kubeadm upgrade node on each worker.

etcd 3.7.0: restore still works (CKA)

Kubernetes 1.37 sets the default etcd image to v3.7.0, so the etcdutl and etcdctl on a 1.37 node are 3.7.0. The usual backup-and-restore task still works: in our 1.37.1 run, the graded solution used etcdutl snapshot restore and passed.

Our grader for etcdutl snapshot status -w table did need adapting, because the 1.37 table format differs from the one it expected. If you check a snapshot, read the REVISION and TOTAL KEYS values. Don't depend on how the table is drawn.

kube-proxy: an empty mode still means iptables (CKA)

In 1.37, when the kube-proxy mode is empty, kubeadm fills in iptables. kube-proxy now warns when the mode is unset, because a future release plans to make nftables the default. That has not happened in 1.37. ipvs has been deprecated since 1.35. Unless the question names a mode, leave the default.

Static Pod API references stay forbidden (1.37, CKA)

A static Pod spec cannot refer to other API objects. The static Pod docs already say so, and name ServiceAccount, ConfigMap, and Secret. NodeRestriction on the API server refuses the mirror Pod when the spec references those objects.

Since 1.34 the kubelet has refused to run such a manifest as well. The check sits behind PreventStaticPodAPIReferences, on by default, and that gate could be turned off (#131837). In 1.37 the gate is gone (#140226, 1.37 changelog). The kubelet always rejects the file with static pods may not reference …. Put the values in the manifest.

How we verified

We replayed KubeLab's mock exam questions on both Kubernetes versions on 23 Oct 2026. These are regression runs on a QA host, not production figures.

  • CKA papers (four mocks), on 1.35.9 and 1.37.1: two graders failed on 1.37 because of output format, not because a solution was wrong. One parsed the kubectl get crd columns, the other the etcdutl snapshot status table. After we adapted those two graders, each paper's total of passing questions on 1.37.1 matched 1.35.9.

  • CKAD, Helm and Kustomize (111 questions), on k3s 1.34.1 and 1.37.1 (our CKAD lab sandboxes run k3s; the CKA curriculum says candidates create and manage clusters using kubeadm): every question gave the same verdict on both versions.

On the CKA papers, a question counts as passing when all its checks fail before the solution and all of them pass after it. On the CKAD side, every unsolved question failed at least one check and every solved question passed all of them, on both versions.

What did NOT change

The official CNCF curriculum PDFs are unchanged.

sha256 of the curriculum PDFs

CKA v1.35 and v1.37: 634b793704485c2ac424a90902e0f8b28f7348a49814393434f808e3e78ec18c. CKAD v1.34 and v1.37: 7736d2f0291239d62e9fc618304413ee9b6e53fc4580aac70bf4328203c1c210.

CKA

Domain Weight
Troubleshooting 30%
Cluster Architecture, Installation and Configuration 25%
Servicing and Networking 20%
Workloads and Scheduling 15%
Storage 10%

CKAD

Domain Weight
Application Design and Build 20%
Application Deployment 20%
Application Observability and Maintenance 15%
Application Environment, Configuration and Security 25%
Services and Networking 20%

The domain names are copied as printed, including "Servicing" in the CKA PDF.

Also unchanged:

  • The apiVersions for the objects you write, as listed above.
  • The kubeadm upgrade sequence.
  • kubectl apply -f, delete, scale, rollout, auth can-i and expose: the 1.35–1.37 changelogs list no behavior change for them beyond the items above.
  • Native sidecar containers (restartPolicy: Always in an init container) are not new in 1.37. Their feature gate was removed because the feature has been on since 1.33.

Practice

To check your speed on the CKAD tasks, KubeLab's free mock, CKAD · Mission 01 · Sillage, runs on its own cluster in your browser, with live grading. No card.

Last verified: 23 Oct 2026.

The exam runs 1.37; KubeLab's CKA labs currently run 1.35.9.

Sources

KubeLab is not affiliated with the CNCF or the Linux Foundation.

CKAD · Mission 01 · Sillage