Kubestronaut / Current
CKA
Current First: CKA is the hardest of the core cluster-administration exams, gates CKS, and is the credential hiring managers actually filter on. Execution is delegated to the existing first-principles road engine at cka-vim-first-principles/, which owns the CKA lab sequence and evidence validation rather than duplicating it here.
Evidence required to unlock certificate
A verifiable CKA certificate ID or official result record, with the completed private road-engine journal and evidence at cka-vim-first-principles/ referenced as supporting proof; the credential remains supplemental to repository-level engineering evidence.
Kubestronaut / Locked
CKS
Locked Second: CKS requires an ACTIVE CKA because that is a CNCF exam requirement, and it builds directly on the same cluster-administration territory—RBAC, network policies, admission control, etcd encryption, and kubelet hardening—so CKA knowledge stays fresh. As the hardest exam and the one most likely to need its included free retake, it is placed early so the remaining year-end slack is available.
Evidence required to unlock certificate
A verifiable CKS certificate ID or official result record saved in the private evidence directory, with the associated security-lab notes or repository link; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Depends on: CKA
Kubestronaut / Available
CKAD
Available Third by deliberate sequence despite being unblocked: CKAD is developer-focused, covering probes, jobs, ConfigMaps, and multi-container patterns, and uses a different mode of work from CKA and CKS. It is the cheapest of the three performance-based exams, so it absorbs the least risk at the end; CKS is earlier because it is the hardest and most likely to need its included free retake.
Evidence required to unlock certificate
A verifiable CKAD certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Kubestronaut / Available
KCNA
Available A multiple-choice associate exam, crammable and collected last as low-cost mop-up filler; it has no prerequisite.
Evidence required to unlock certificate
A verifiable KCNA certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Kubestronaut / Available
KCSA
Available A multiple-choice associate exam, crammable and collected last as low-cost mop-up filler; it has no prerequisite.
Evidence required to unlock certificate
A verifiable KCSA certificate ID or official result record saved in the private evidence directory; retain this credential proof alongside, not instead of, the repositories, traces, and reproducible measurements in the other tracks.
Bare-metal Kubernetes / Current
Stage 1 VM lab substrate
Current Stage 1 prerequisite: on the MacBook Pro M5 (arm64, 10-core, 24 GB RAM, 1 TB SSD), install a macOS ARM hypervisor and stand up the VM substrate. NO virtualization tooling is currently installed. The binding constraint is 78 GB free disk, not 24 GB of RAM. Multipass or Lima are natural choices; UTM is a heavier GUI alternative. Suggested sizing is one control plane at 2 vCPU / 2.5 GB / 20 GB and two workers at 1 vCPU / 2 GB / 15 GB each (roughly 50 GB total); they may need to free space or drop to two workers of 12 GB. Preserve the existing minikube profile.
Evidence required to unlock vm-substrate-record
A repository-linked record naming the chosen hypervisor and why; the VM definitions or exact launch commands; free and df output from inside each VM; and measured host disk consumed by the substrate. The record must show the 78 GB free-disk constraint and whether the suggested or reduced sizing was used.
Bare-metal Kubernetes / Locked
Stage 1 multi-node kubeadm cluster
Locked Stage 1 proper: use kubeadm init on one VM and kubeadm join on the other VMs, with containerd and a CNI, to produce a genuine multi-node cluster. This exists because minikube is already running on this Mac as a single-node cluster with the Docker driver and hides kubeadm init/join, etcd, PKI, kubelet configuration, node join, and upgrades—a large share of CKA's cluster-administration domain. Do not disturb minikube.
Evidence required to unlock kubeadm-cluster-bootstrap
The exact kubeadm configuration used; an unedited transcript containing kubectl get nodes -o wide for the control plane and workers; the containerd setup; the chosen CNI with its reason; and notes on every bootstrap failure and repair.
Depends on: Stage 1 VM lab substrate
Bare-metal Kubernetes / Locked
etcd backup and restore
Locked Take an etcd snapshot, deliberately destroy the cluster state, and restore it so the recovery boundary is understood rather than assumed.
Evidence required to unlock etcd-recovery-transcript
A full command transcript from etcd snapshot creation through deliberate cluster-state destruction and restore, including snapshot metadata or checksum, an inventory of what was lost versus recovered, and a measured restore duration supported by timer output or start and end timestamps.
Depends on: Stage 1 multi-node kubeadm cluster
Bare-metal Kubernetes / Locked
Minor-version cluster upgrade
Locked Perform a kubeadm upgrade across a Kubernetes minor version in the required order: control plane first, then workers, draining and uncordoning workers as part of the procedure.
Evidence required to unlock kubeadm-upgrade-transcript
A before-and-after version record for Kubernetes, kubeadm, kubelet, and kubectl on every node, the ordered procedure actually followed with the exact commands and drain and uncordon output for each worker, and a written account of anything that broke with its repair.
Depends on: Stage 1 multi-node kubeadm cluster
Bare-metal Kubernetes / Locked
Kubernetes break-fix drills
Locked Deliberately inject at least five distinct failures—kubelet down, expired certificate, misconfigured static pod, CNI failure, and disk-pressure eviction—and diagnose each from its first symptom to its first broken layer. This follows the deliberate-failure discipline in cka-vim-first-principles/LEARNING_CONTRACT.md.
Evidence required to unlock breakfix-drill-records
A per-drill record for at least five distinct failures, including kubelet down, expired certificate, misconfigured static pod, CNI failure, and disk-pressure eviction; every record must state the first symptom, hypothesis, first broken layer identified, minimal repair, and verification output.
Depends on: Stage 1 multi-node kubeadm cluster
Bare-metal Kubernetes / Locked
Stage 2 physical multi-node cluster
Locked Stage 2: after the Stage 1 evidence is complete, build a TRUE bare-metal multi-node cluster across separate physical machines named homelab1, homelab2, and workstation, using x86_64 systems and real NICs. Probe and record each host's identity, CPU, RAM, disk, and KVM readiness before allocation; unverified host specs must not be assumed. This teaches what VMs on one host cannot: real network topology and MTU, LoadBalancer/MetalLB or equivalent, real storage, genuine node and link failure, and x86_64 parity with the exam environment.
Evidence required to unlock physical-cluster-comparison
A node inventory with verified CPU, RAM, disk, architecture, NIC, and KVM readiness for homelab1, homelab2, and workstation; the physical network topology and MTU; the exact kubeadm join procedure across physical hosts; evidence of the LoadBalancer/MetalLB or equivalent and real-storage behavior; and an explicit written comparison of what differed from the Stage 1 VM build, including a genuine node or link failure.
Depends on: etcd backup and restore · Minor-version cluster upgrade · Kubernetes break-fix drills
Systems foundations / Current
Modern C++ CPU tensor library
Current Build a deliberately small Tensor2D<float> library with contiguous row-major storage, shape and stride handling, elementwise addition, transpose, matrix multiplication, softmax, and RMSNorm.
Evidence required to unlock repository
A versioned repository containing a CMake-built Tensor2D<float> implementation with unit tests, Debug and Release builds, sanitizer output, NumPy or PyTorch correctness comparisons, and benchmark output across multiple matrix sizes.
Systems foundations / Locked
Optimized matmul report
Locked Explain the performance effects of loop ordering, cache blocking, compiler optimization, SIMD, and multithreading on the tensor library's matrix multiplication.
Evidence required to unlock benchmark-report
A versioned repository plus benchmark report comparing naive, loop-reordered, tiled, SIMD, and multithreaded matmul; the report names hardware and compiler, records runtime and GFLOP/s at multiple sizes, shows thread scaling and correctness, and explains the bottleneck behind each change.
Depends on: Modern C++ CPU tensor library
Systems foundations / Locked
Linux perf profiling study
Locked Use Linux perf and compiler output to locate the hot loop and connect cache, vectorization, and instruction-level evidence to the optimized CPU result.
Evidence required to unlock profiling-study
A repository-linked study with raw perf stat and perf record/report output plus an annotated assembly or flamegraph artifact for the matmul workload, including command lines, hardware and software context, baseline-versus-optimized measurements, and a causal explanation.
Depends on: Optimized matmul report
MLOps and GPU serving / Current
GPU Operator cluster
Current Operate a Kubernetes cluster with the GPU Operator, device plugin, monitoring components, and a reproducible GPU workload.
Evidence required to unlock repository-and-deployment-log
A versioned infrastructure repository with manifests or Helm values, successful GPU Operator installation evidence, kubectl output for driver, device-plugin, and DCGM pods, and a reproducible workload log proving a scheduled GPU allocation.
MLOps and GPU serving / Locked
Autoscaled model serving deployment
Locked Deploy a model-serving workload on the GPU cluster and make scaling respond to measured demand rather than a fixed replica count.
Evidence required to unlock deployment-and-load-test
A versioned deployment repository and reproducible load-test report showing the model endpoint scaling on GPU-utilization or queue/request metrics, with workload details, replica transitions, throughput, TTFT, TPOT, and p99 latency recorded.
Depends on: GPU Operator cluster
MLOps and GPU serving / Locked
Observability and cost-per-token dashboard
Locked Make serving behavior legible by connecting request metrics, token counts, GPU utilization, and accelerator cost in one operational view.
Evidence required to unlock dashboard-definition-and-export
A versioned dashboard definition and exported view that joins request, GPU-utilization, token-count, and accelerator-cost data to show throughput, TTFT, TPOT, p99, utilization, and cost per output token, with query and reproduction instructions.
Depends on: Autoscaled model serving deployment
MLOps and GPU serving / Locked
Model CI/CD
Locked Automate model artifact validation, image or package publication, staged serving rollout, and a tested rollback path.
Evidence required to unlock ci-workflow-and-rollout-log
A versioned CI workflow with model checksum or immutable version checks, correctness and smoke tests, reproducible image or package build, staging deployment evidence, and a demonstrated rollback or promotion record without embedded secrets.
Depends on: Autoscaled model serving deployment
Inference infrastructure / Current
CUDA kernel ladder
Current Implement and measure vector add, reduction, tiled matmul, softmax, and RMSNorm kernels from first principles before relying on higher-level kernel DSLs.
Evidence required to unlock repository-and-profiler-traces
A versioned CUDA repository containing vector-add, reduction, matmul, softmax, and RMSNorm kernels with correctness tests across multiple shapes, warmup and repeated measurements, and profiler traces that classify each result as compute-, memory-, synchronization-, or launch-bound.
Inference infrastructure / Locked
Quantization and KV-cache study
Locked Measure the bridge-role vocabulary across FP8 and INT4 weight and activation quantization, AWQ and GPTQ, paged attention, KV-cache management, and chunked prefill.
Evidence required to unlock repository-quantization-and-serving-study
A repository-linked study using a named model and hardware that measures accuracy delta against a reference, memory footprint, and throughput change across FP8 and INT4 weight/activation quantization, with AWQ/GPTQ, paged attention, KV-cache management, and chunked prefill configurations; include reproducible commands.
Depends on: CUDA kernel ladder
Inference infrastructure / Locked
Non-trivial Triton kernel
Locked Build a non-trivial fused Triton kernel, such as RMSNorm plus quantization, and show where it wins and loses across realistic inputs.
Evidence required to unlock repository-benchmark-and-trace
A versioned Triton repository with reference-based correctness tests, a shape and dtype sweep covering batch and sequence variation, benchmark tables with named hardware and software versions, an exported profiler trace, and documented loss cases.
Depends on: CUDA kernel ladder
Inference infrastructure / Locked
vLLM or SGLang internals patch
Locked Change a real inference-runtime mechanism—such as scheduling, KV-cache allocation, batching, quantized execution, or CUDA-graph behavior—instead of only wrapping an endpoint.
Evidence required to unlock reviewable-runtime-patch
A reviewable commit or pull-request URL in a vLLM or SGLang fork that changes a real runtime path, with passing correctness or regression tests, a reproducible benchmark command, and a short explanation of the affected mechanism.
Depends on: Non-trivial Triton kernel
Inference infrastructure / Locked
Serving optimization report
Locked Prove an end-to-end serving improvement from a runtime or kernel change under a stated workload and realistic concurrency.
Evidence required to unlock before-after-serving-report
A repository-linked before-and-after load-test report naming hardware, model, workload, concurrency, warmup and repetition method, and exact commands; it must report TTFT, TPOT, output-token throughput, request throughput, p99 latency, memory use, and the causal bottleneck analysis.
Depends on: Quantization and KV-cache study
Inference infrastructure / Locked
Multi-GPU scaling-efficiency study
Locked Measure how distributed inference loses efficiency through collectives, topology, synchronization, or stragglers rather than reporting only aggregate throughput.
Evidence required to unlock scaling-study-and-traces
A repository-linked study with single- and multi-GPU measurements, an explicit scaling-efficiency calculation, per-rank NCCL or Nsight Systems traces, throughput and communication-overhead tables, hardware topology context, and reproducible commands.
Depends on: Serving optimization report
Inference infrastructure / Locked
Submitted upstream contribution
Locked Contribute a production-quality inference, kernel, compiler, or portability improvement and engage maintainer review; merge is a documented bonus, not an unlock condition.
Evidence required to unlock submitted-pull-request-with-review
A SUBMITTED upstream pull request URL with genuine review engagement: a documented maintainer response, review comments addressed, CI passing, and a reproducible performance or correctness result documented; a later merge may be recorded as a bonus but is not required for unlock.
Depends on: vLLM or SGLang internals patch