Golden Kubestronaut: open-source self-hosted simulator for CNCF certification prep

What it is

According to a dev.to post published on 18 October, a developer who had just re-passed the CKA exam has released Golden Kubestronaut 2026, a self-hosted practice simulator for the CNCF certification path. The code lives on GitHub under the name Willey2003/golden-kubestronaut and carries an Apache-2.0 licence.

The author is blunt about what it is and is not: a practice tool rather than a shortcut. Every question is original material written against published exam objectives, the project is not affiliated with or endorsed by the Linux Foundation or the CNCF, and nothing in the banks is taken from or claimed to mirror the real exams.

What is in the box

The project has four parts. The engine is a small Python service split into a facilitator (web UI and JSON API) and a conductor (the grader), alongside a bank loader, a validator and a ga command-line wrapper. Question banks live one folder per certification, with an exam.yaml holding duration, pass mark and domain weights, and one YAML file per question. A curriculum of seven Markdown modules runs from foundations through networking to cost, with exercises meant for your own cluster. Deployment is via Docker Compose locally, or Kubernetes manifests for a lab cluster.

In total there are 16 banks and 274 questions, 48 of them hands-on tasks; the rest are single-answer multiple choice with a written explanation for every option. The core Kubernetes banks are small but practical-heavy: CKA, CKAD and CKS each hold 16 questions, of which 10 or 11 are hands-on. The other banks cover security associates, Linux system administration, Prometheus and PromQL, OpenTelemetry, Istio, Argo CD, GitOps, Cilium networking (48 questions across three labels), general cloud concepts and Kubernetes cost.

Known gaps in version one

The author lists several mismatches. The Cilium material sits under the labels cba, cnpa and cnpe, even though the real Cilium certification code is CCA, and the project's cca bank actually holds general cloud-computing questions. There is no Backstage (CBA), Kyverno (KCA) or platform engineering (CNPA/CNPE) content yet, with kca currently covering Kubernetes cost allocation instead. The labs folder is empty, so hands-on practice lives in the curriculum exercises and inside the hands-on bank questions. As of this release, the CKA, CKAD, CKS, KCNA, KCSA, LFCS, PCA, OTCA, ICA, CAPA and CGOA banks line up with their syllabi; fixing the labels and writing the missing banks is next on the roadmap.

How grading works

Multiple-choice answers are marked right or wrong against the answer key. Hands-on questions carry a list of checks, each a shell command paired with an expected result using operators such as equals, contains, regex match or exit-success. The conductor runs those commands against your cluster and divides the points evenly across the checks, so partial credit is possible. An etcd backup task, for example, verifies that a snapshot file exists at the required path and is not empty; the grader never inspects what you typed.

There are three modes. Training shows every question with no timer and reveals answers immediately, while Mastery and Exam draw a timed attempt and hold answers back until grading. Each attempt ends with a per-domain breakdown, weakest domain first, to point you at what to study next.

Running it

You need Docker with Compose, plus Python 3 and PyYAML for local validation. The workflow is ga validate to check every bank parses, ga doctor for preflight, and ga up to build and start the containers; the web UI then listens on 127.0.0.1 port 8902. There is no authentication, and the service binds to localhost by default, so if you use ga expose to reach it from your LAN, keep it on a private network.

For hands-on grading, the conductor mounts ~/.kube read-only, overridable with KUBECONFIG_DIR, and runs kubectl from inside the container. The author offers two cautions: point it at a throwaway practice cluster, never a real one, because the checks execute commands with that kubeconfig; and make sure the cluster's API address is reachable from the container. One quirk: doctor shares preflight code with the author's OpenShift project, so it complains about a missing oc client and less than 8 GB of RAM even on plain Kubernetes.

An earlier sibling repository, Willey2003/kubestronaut, runs the same engine and shares six banks (CKA, CKAD, CKS, KCNA, KCSA and PCA). It adds a Grafana bank and a combined Prometheus-plus-Grafana monitoring track, which are skill tracks rather than Linux Foundation certifications.

Why it matters

Preparation for the performance-based CNCF exams usually means paid mock-exam sites or assembling your own drills across a dozen tabs. This project is a free, self-hosted alternative, and its distinguishing feature is automated grading of hands-on tasks against a real cluster with partial credit, far closer to how exams like the CKA actually test candidates than multiple-choice flashcards. The version-one caveats are real, so candidates should verify which bank matches the certificate they are chasing. But with a plain-YAML bank format validated in CI on every push, the barrier to contributing fixes and new banks is low, which is exactly what an independent project needs to close those gaps.