The CNCF offers three performance-based Kubernetes certifications: CKA (Certified Kubernetes Administrator) for cluster operators, CKAD (Certified Kubernetes Application Developer) for engineers deploying apps on Kubernetes, and CKS (Certified Kubernetes Security Specialist) for hardening production clusters. All three are 2-hour hands-on exams taken in a live terminal. CKS requires an active CKA as a prerequisite.
The three CNCF Kubernetes certifications at a glance
The Cloud Native Computing Foundation, in partnership with the Linux Foundation, administers CKA, CKAD, and CKS. These are not multiple-choice tests. You get a live terminal, a set of real Kubernetes clusters, and tasks like "configure an Ingress that routes /api to this Service" or "find and fix the misconfigured NetworkPolicy blocking pod-to-pod traffic." You solve them in kubectl, YAML, and the occasional shell one-liner.
All three exams run for 2 hours, are proctored online through PSI, cost $445 at list price (frequently discounted to around $300 during Linux Foundation sales), and remain valid for 2 years. A single free retake is included. The current exam versions track Kubernetes v1.31 as of late 2025, and the Linux Foundation refreshes the curriculum roughly every 6-12 months to stay within one or two minor releases of upstream.
If you're mapping these onto a broader career plan, our DevOps certifications roadmap covers how Kubernetes credentials sit alongside Terraform Associate, AWS DevOps Pro, and GitOps-focused certs.
CKA: the cluster administrator exam
CKA is the foundational credential for anyone who runs Kubernetes rather than just deploys to it. The current CKA curriculum weights the domains as follows:
- Cluster Architecture, Installation & Configuration: 25%
- Workloads & Scheduling: 15%
- Services & Networking: 20%
- Storage: 10%
- Troubleshooting: 30%
That 30% troubleshooting slice is where most candidates lose points. You'll be asked to diagnose a broken kubelet, a CNI plugin that silently drops traffic, an etcd backup that needs restoring, or a node stuck in NotReady. You need fluency in journalctl, crictl, kubectl describe, and reading raw YAML on a cluster you did not build.
Typical candidates: SREs, platform engineers, infrastructure engineers, and anyone operating self-managed clusters or deeply customized EKS/GKE/AKS environments. If your day job involves kubeadm, upgrades, backup/restore of etcd, or writing admission webhooks, this is your exam.
CKAD: the application developer exam
CKAD assumes the cluster already works. Your job is to ship workloads to it correctly. The domain weights are:
- Application Design and Build: 20%
- Application Deployment: 20%
- Application Observability and Maintenance: 15%
- Application Environment, Configuration and Security: 25%
- Services and Networking: 20%
Tasks center on writing Deployment, Job, CronJob, and StatefulSet manifests; wiring up ConfigMaps and Secrets; defining readiness and liveness probes; using multi-container pod patterns (sidecar, ambassador, adapter); and understanding Helm basics. You'll build and update rolling deployments, configure Horizontal Pod Autoscalers, and debug a crashlooping pod using kubectl logs --previous and kubectl exec.
Typical candidates: backend developers, full-stack engineers building microservices, and application platform teams who own services end-to-end but don't manage the control plane. If you spend your days in Go, Python, or Java and your deliverable is a container image plus a Helm chart, CKAD matches your actual work.
CKS: the security specialist exam
CKS is the only one of the three with a hard prerequisite: you must hold an active, non-expired CKA before you can sit CKS. The domain weights:
- Cluster Setup: 15%
- Cluster Hardening: 15%
- System Hardening: 10%
- Minimize Microservice Vulnerabilities: 20%
- Supply Chain Security: 20%
- Monitoring, Logging and Runtime Security: 20%
Expected tooling fluency includes Falco for runtime detection, Trivy for image scanning, OPA Gatekeeper or Kyverno for policy, AppArmor and seccomp profiles for syscall restriction, and kube-bench for CIS benchmark auditing. You should be comfortable reading a NetworkPolicy, writing a PodSecurity Standard enforcement, rotating certificates, and locking down the API server with audit policies and OIDC.
Typical candidates: DevSecOps engineers, security architects, and senior platform engineers responsible for compliance (SOC 2, PCI, FedRAMP) in Kubernetes environments.
Which is tougher, CKA or CKAD?
CKA is harder for most candidates, and the data from community pass-rate surveys consistently supports this. CKA covers a wider surface area (cluster internals, networking, storage, troubleshooting) and gives you less time per task because many problems require inspecting multiple nodes. CKAD is narrower, more pattern-driven, and the tasks map cleanly to writing or editing YAML. Developers who already use Kubernetes at work often clear CKAD in 4-6 weeks of prep. CKA typically takes 8-12 weeks unless you administer clusters daily.
CKS is the most difficult of the three in absolute terms because it assumes CKA-level fluency and layers on security tooling that most engineers haven't touched. The exam itself is not conceptually harder than CKA; it just has a steeper floor.
Can I take CKS without CKA?
No. The Linux Foundation enforces an active CKA certification as a prerequisite to register for CKS. Your CKA must be valid (within its 2-year window) on the day you sit CKS. If your CKA has expired, you'll need to renew it before scheduling. This is a policy constraint, not just a recommendation: the exam registration system blocks checkout without a verified CKA on your Linux Foundation account.
Which Kubernetes certification is best?
There is no single "best" one. The right choice depends on your role:
- You operate clusters or want an SRE/platform role: start with CKA, then add CKS once you have 6-12 months of cluster operations under your belt.
- You build applications that run on Kubernetes: start with CKAD. You can add CKA later if you move toward platform work.
- You own security or compliance in a Kubernetes shop: CKA first (required), then CKS. CKAD is optional.
- You're a generalist DevOps engineer early in your Kubernetes journey: CKA gives you the broadest foundation and unlocks CKS later. It's the most common first exam.
If you want a deeper breakdown of how these credentials map to job titles and salary bands, our writeup on the top Kubernetes certifications that accelerate your DevOps career goes further into hiring signals.
Is CKA hard to crack?
CKA is challenging but very passable with structured preparation. The exam is hard not because the concepts are obscure, but because you must solve real tasks under time pressure in an unfamiliar terminal environment with only the official Kubernetes documentation open as a reference.
The three things that trip up most first-time candidates: not aliasing kubectl to k and setting up kubectl autocomplete in the first 60 seconds, not practicing kubectl explain and the official docs search enough to find YAML examples fast, and spending too long on a single high-point question instead of flagging it and moving on.
Cost, format, and logistics
| Exam | List price | Duration | Pass mark | Validity | Prerequisite |
|---|---|---|---|---|---|
| CKA | $445 | 2 hours | 66% | 2 years | None |
| CKAD | $445 | 2 hours | 66% | 2 years | None |
| CKS | $445 | 2 hours | 67% | 2 years | Active CKA |
All three are delivered online through PSI's proctoring platform. You need a quiet room, a clean desk, a webcam, and a stable internet connection. The exam environment is browser-based with a Linux terminal to the exam clusters. You're allowed one tab open to the official Kubernetes documentation at kubernetes.io/docs, and for CKS, additional allowed references include the Falco, Trivy, and AppArmor docs.
The Linux Foundation frequently runs bundle discounts (CKA + CKAD, or all three) and seasonal sales. Buying during Black Friday or KubeCon weeks can cut the price by 30-40%.
A realistic study timeline
Q&A: How long should I prepare for CKA?
Plan 8-12 weeks of focused study if you have 6+ months of general Kubernetes exposure. Spend the first 3 weeks reading the official curriculum and kubernetes.io concepts docs, weeks 4-8 doing hands-on labs on a real cluster (kind, k3s, or kubeadm on three VMs), and the final 2-3 weeks on timed practice exams. Killer.sh gives you two full simulator sessions with your exam purchase; use them.
Q&A: Should I take CKA or CKAD first if I do both application and infrastructure work?
Take CKA first. CKA covers roughly 60% of what CKAD tests (Services, Networking, Workloads, ConfigMaps, Secrets) plus the cluster internals CKAD skips. After passing CKA, most candidates clear CKAD with 2-3 additional weeks focused on multi-container patterns, Helm, and observability tooling. Reversing the order means re-learning the same primitives from a narrower starting point.
Q&A: Do these certifications actually help with hiring?
Yes, especially at mid-level and for consultancies. Kubernetes certifications are explicit filters on job postings at Red Hat, VMware, major cloud consultancies, and most managed-services providers. They matter less at FAANG-tier companies where the interview loop supersedes credentials, and they matter more in government, finance, and healthcare where procurement or compliance requirements list CNCF certifications by name. CKS in particular commands a measurable premium in DevSecOps roles.
Which exam order to pick
The pragmatic sequence for most engineers in 2026 is CKA, then CKS if your role touches security or compliance, and CKAD if you also build the applications. Don't collect all three for the sake of it. Each requires renewal every 2 years, which means a Continuing Education or re-exam cycle. Pick the ones that match the work you actually do, or the work you want to do next.
Written by the Refonte Learning engineering team. Refonte Learning builds practitioner-led courses in cloud, Kubernetes, DevOps, and AI engineering. Refonte Learning is operated by Refonte Infini Infiniment Grand (SIREN 949 841 605, France), with an operational office at 1 Poulton Close, Dover, Kent CT17 0HL, United Kingdom.