The project certifications
Golden Kubestronaut asks for sixteen exams, and this course does not re-teach eleven of them: the five core Kubernetes certifications — KCNA, KCSA, CKA, CKAD, CKS — live in the sibling Kubernetes course, and the two platform-engineering exams — CNPA and CNPE — live in Platform Engineering. What's left is the nine credentials this page is actually about: eight CNCF project-specific associates built around one tool each, plus one credential that isn't CNCF at all — the Linux Foundation's LFCS. Eight of the nine are ninety-minute knowledge-based multiple choice; one, ICA, mixes hands-on tasks with multiple choice; LFCS is fully performance-based, on a live terminal, for two hours. This page puts all nine in one table with their official domains and weights, explains what those three formats actually change about how you study, and gives you a few sane orders to sit them in depending on which part of the stack is your job.
Imagine a merit-badge sash with sixteen pockets. Five of the pockets belong to one troop leader who only teaches Kubernetes itself. Two more belong to a different troop leader who teaches you to run the whole camp. This page is the other nine pockets — nine small badges, each earned by proving you understand one specific tool really well: the robot that keeps deployments matching a to-do list, the traffic cop for network requests, the guard who checks every backpack at the gate. You don't need all nine to be a good camper. You need the ones that match the camp you're actually running.
Nine credentials, and where they sit next to the other seven
☺ Like you're 10: This course only teaches nine of the sixteen badges. The other seven live in two different courses, and this page tells you where to find them.
It matters which nine, because it's easy to assume this course teaches the whole Golden Kubestronaut catalogue. It doesn't, on purpose — the split exists so each course can go deep instead of skimming sixteen curricula shallowly. CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA, PCA and LFCS are the nine covered here, each with its own blueprint, study plan, practice questions and mock exams elsewhere in this course. If you're here for the five core Kubernetes exams, the Kubernetes course's own certifications page covers KCNA, KCSA, CKA, CKAD and CKS in the depth they deserve. If you're here for the platform-engineering pair, CNPA and CNPE have full exam guides in Platform Engineering. Read What Is Kubestronaut? and The Sixteen-Exam Ladder first if you haven't already — they explain how all sixteen fit together and in what order, which this page assumes.
Every one of these nine is a project-specific credential — Argo, Backstage, Cilium, Istio, Kyverno, OpenTelemetry, Prometheus, and Linux itself. None of them are broad surveys of cloud native the way KCNA is, and none of them are a platform-engineering role exam the way CNPE is. They test one tool, deeply, and the CNCF publishes every domain weight openly — nothing on this shelf is a mystery exam.
The master table — all nine, official domains and weights
☺ Like you're 10: Here is the whole shelf on one page — what each badge is called, how long it takes, and exactly what it asks you about, straight from the people who wrote it.
Domain names and weights below are exactly what's published in each certification's official curriculum — nothing rounded, nothing invented — and every row sums to 100%. Format and duration come from the same official pages. Prerequisites are the same answer for all nine: none formally required. Each row links to that certification's full blueprint on this course, where the competency lists, worked examples and a study plan live.
| Cert | Level · format | Duration | Official domains & weights | Blueprint |
|---|---|---|---|---|
| CGOA Certified GitOps Associate | Associate · knowledge-based (MCQ) | 90 min | GitOps Principles 30% · GitOps Terminology 20% · GitOps Patterns 20% · Related Practices 16% · Tooling 14% | CGOA → |
| CAPA Certified Argo Project Associate | Associate · knowledge-based (MCQ) | 90 min | Argo Workflows 36% · Argo CD 34% · Argo Rollouts 18% · Argo Events 12% | CAPA → |
| CBA Certified Backstage Associate | Associate · knowledge-based (MCQ) | 90 min | Customizing Backstage 32% · Development Workflow 24% · Infrastructure 22% · Catalog 22% | CBA → |
| CCA Cilium Certified Associate | Associate · knowledge-based (MCQ) | 90 min | Architecture 20% · Network Policy 18% · Service Mesh 16% · Network Observability 10% · Installation & Config 10% · Cluster Mesh 10% · eBPF 10% · BGP & External Networking 6% | CCA → |
| ICA Istio Certified Associate | Associate-badged · hybrid (hands-on + MCQ) | ~2 hours | Traffic Management 35% · Securing Workloads 25% · Installation, Upgrades & Config 20% · Troubleshooting 20% | ICA → |
| KCA Kyverno Certified Associate | Associate · knowledge-based (MCQ) | 90 min | Writing Policies 32% · Fundamentals of Kyverno 18% · Installation, Config & Upgrades 18% · Kyverno CLI 12% · Applying Policies 10% · Policy Management 10% | KCA → |
| OTCA OpenTelemetry Certified Associate | Associate · knowledge-based (MCQ) | 90 min | OpenTelemetry API & SDK 46% · The Collector 26% · Fundamentals of Observability 18% · Maintaining & Debugging Pipelines 10% | OTCA → |
| PCA Prometheus Certified Associate | Associate · knowledge-based (MCQ) | 90 min | PromQL 28% · Prometheus Fundamentals 20% · Observability Concepts 18% · Alerting & Dashboarding 18% · Instrumentation & Exporters 16% | PCA → |
| LFCS Linux Foundation Certified SysAdmin | Linux Foundation · performance-based | 2 hours | Operations Deployment 25% · Networking 25% · Storage 20% · Essential Commands 20% · Users & Groups 10% | LFCS → |
Reading the shelf as six families, not nine strangers
☺ Like you're 10: Nine badges sounds like a lot to remember. It's really six small groups, and the tools in each group talk to each other.
Nobody studies nine curricula as nine unrelated lists — they cluster by what part of the platform they cover, and studying one member of a family makes the next one faster because half the mental model is already built.
GitOps & Continuous Delivery (CGOA, CAPA) is the reconciliation loop and everything built on it — read GitOps Philosophy and The Argo Ecosystem for the concepts underneath both. Networking & Service Mesh (CCA, ICA) is the data plane — eBPF & the Cilium Datapath and Service Mesh Architecture cover the mechanics. Observability (OTCA, PCA) is telemetry end to end — see The OpenTelemetry Data Model and The Prometheus Model. Policy & Security is KCA alone, backed by Policy-as-Code Philosophy. Developer Portal is CBA alone, backed by The Backstage Portal Model. And Linux Substrate — LFCS — sits underneath all of it, which is why it's drawn as the foundation rather than a sixth peer; see Linux Fundamentals for Platform Engineers.
Format changes how you study more than topic does
☺ Like you're 10: Eight of these nine are pick-the-right-answer tests. One mixes in real typing. One is only real typing. Guess wrong about which kind you're studying for and you'll waste your evenings.
Tier and format are different questions, and this shelf makes that easy to see because eight of the nine sit in exactly one bucket. Knowledge-based means multiple choice, no terminal, no cluster — you're tested on whether you hold a correct mental model, and the study regime is retrieval: definitions, failure-mode recognition, drilled recall. Hybrid — ICA alone here — means some tasks are performed at a real command line and some are picked from a list; you cannot cram your way through the hands-on half. Performance-based — LFCS alone here — means every question is "do the task," graded on the end state of a real machine; recall doesn't transfer, muscle memory does.
"I'd passed four of these knowledge-based ones back to back and felt unstoppable — then I sat the ICA practice tasks and froze on a live istioctl prompt. Knowing that a DestinationRule configures traffic policy and actually writing one correctly under a clock are not the same skill, and nothing in the multiple-choice run had trained the second one."
Recommended sequencing for four starting points
☺ Like you're 10: Where you start should depend on what your team already runs, not on alphabetical order.
None of these nine gate each other — there's no formal prerequisite anywhere on this table — so the order below is about momentum, not permission. Pick the row closest to your actual stack.
| If your situation is… | Sequence | Why |
|---|---|---|
| Your stack is GitOps-heavy — Argo CD or Flux already runs your deployments | CGOA → CAPA | CGOA is the specification (declarative, pulled, reconciled); CAPA is the implementation you're already running day to day. CGOA's vocabulary makes CAPA's deeper Argo curriculum click faster. |
| Observability is your job — dashboards, alerts and telemetry pipelines | OTCA and/or PCA | OTCA if you're standardising instrumentation on OpenTelemetry; PCA if you live in PromQL and Alertmanager. Do both if your pipeline is OTLP-in, Prometheus-out — that's the common shape. |
| Your shell fluency is shaky, or you've only ever worked one layer above the OS | LFCS first, before anything else on this shelf | Every one of the other eight assumes you're comfortable at a terminal. LFCS is also the only performance-based exam here, so it doubles as a rehearsal for the format before ICA raises the stakes. |
| You own the data plane — network policy, mesh traffic, or both | CCA → ICA | CCA's eBPF and identity-based policy model is the foundation Istio's sidecar or ambient data plane sits on top of; ICA is by far the harder exam of the two, so bank the easier win first. |
Before picking a row above, write down which of these nine tools your team already runs in production, right now. Circle those. A certification for a tool you already operate is the cheapest, fastest badge on this entire shelf — you're studying vocabulary for muscle memory you already have. Everything uncircled is a genuine new skill, and deserves the fuller sequencing table, not a rushed weekend.
How these nine complete the sixteen
☺ Like you're 10: Nine badges from this page, five from the Kubernetes course, two from Platform Engineering. Nine plus five plus two is sixteen — that's the whole set.
Golden Kubestronaut is defined by holding the CNCF's entire certification catalogue plus LFCS, all active at the same time — see What Is Kubestronaut? for the full rules on qualifying and staying qualified, and The Sixteen-Exam Ladder for a recommended order across all sixteen, not just these nine. The arithmetic is simple and worth holding in your head: five core Kubernetes exams (KCNA, KCSA, CKA, CKAD, CKS — in the Kubernetes course) plus two platform-engineering exams (CNPA and CNPE, in Platform Engineering) plus the nine on this page equals sixteen. None of the three groups gates another — you can work them in parallel — but the sequencing groups above only make sense once you've read the wider ladder, because a GitOps-heavy stack usually means you want CNPE eventually too, and CGOA is explicitly a quarter of that exam's blueprint.
Every number on this page — price, question count where published, pass mark, eligibility window, certification validity — comes from the vendor's own materials at the time of writing, and every one of them is the kind of figure the Linux Foundation and CNCF revise without much notice. This is an independent, unofficial study resource, not affiliated with the CNCF or The Linux Foundation. Before you register or pay for anything, read the current official page for that specific exam — each blueprint page linked from the table above links out to it — and treat any figure here that disagrees with the official page as stale.
Jump to any certification
☺ Like you're 10: Nine cards, one per badge — click through to the full guide for whichever one you're starting with.
CGOA
GitOps Associate — principles, terminology, patterns and tooling behind reconciliation itself.
🐙 · Associate · knowledgeCAPA
Argo Project Associate — Workflows, CD, Rollouts and Events across the whole Argo family.
🦋 · Associate · knowledgeCBA
Backstage Associate — the developer portal, its catalog, its plugins, real TypeScript and React.
🐦 · Associate · knowledgeCCA
Cilium Certified Associate — eBPF, identity-based policy, Hubble and Cluster Mesh.
🕸️ · Hybrid · hands-onICA
Istio Certified Associate — traffic management, workload identity, install, troubleshooting.
🐢 · Associate · knowledgeKCA
Kyverno Certified Associate — validate, mutate, generate, verifyImages, the CLI, policy reports.
📡 · Associate · knowledgeOTCA
OpenTelemetry Associate — the API and SDK, the Collector pipeline, debugging telemetry that vanishes.
📈 · Associate · knowledgePCA
Prometheus Certified Associate — PromQL, scraping, recording and alerting rules, Alertmanager.
🐧 · Linux Foundation · hands-onLFCS
Linux Foundation Certified SysAdmin — the substrate under every one of the other eight.
Professor Owl: Nine curricula, and here's the thing nobody tells you at the start — they're not nine separate subjects. They're six families, and knowing one member speeds up the next.
Nutty: I filed all nine by domain weight last night. Did you know OTCA's biggest domain alone — the API and SDK — is worth more than CGOA's top two domains combined?
Foxy: Okay but which one do I actually sit first? I run Argo CD at work and that's about it.
Gizmo: Book all nine for the same week! Cram every night, ride the momentum, collect the whole set before anyone notices you skipped sleeping! 😈
Timmy: One of those nine is performance-based and one is hybrid, Gizmo — you can't cram muscle memory the night before. That plan fails on exam two.
Professor Owl: Foxy, start with CGOA — it's the specification behind what you already run. Then CAPA, because half the vocabulary is already yours.
Nutty: And I'll be here filing the other seven for whenever you're ready to widen out.
1. How many certifications does this page cover, and which two groups of exams make up the rest of the sixteen for Golden Kubestronaut? 2. Which certification on this shelf is the only hybrid-format one, and what does "hybrid" mean here? 3. Which certification is the only fully performance-based one, how long does it run, and what does that change about how you'd study for it versus the other eight? 4. Name the two certifications in the "GitOps & Continuous Delivery" family and each one's single heaviest domain. 5. If observability is your day job, which two certifications should you look at, and how do you choose between them? 6. Why does LFCS get drawn as a foundation underneath the other five families in the schematic, rather than as a sixth family beside them? 7. What should you always do before registering for any exam on this page, no matter how confident this page's numbers look?
Check your answers
- Nine. The rest of the sixteen are the five core Kubernetes certifications (KCNA, KCSA, CKA, CKAD, CKS) in the sibling Kubernetes course, and the two platform-engineering exams (CNPA, CNPE) in Platform Engineering.
- ICA (Istio Certified Associate) — hybrid means the exam mixes hands-on, performance-based tasks at a command line with multiple-choice questions in the same sitting.
- LFCS — two hours, fully performance-based on a live terminal. Because there's no multiple choice to fall back on, retrieval-style studying (flashcards, definitions) doesn't transfer; you need repetition at a real keyboard instead.
- CGOA (heaviest domain: GitOps Principles, 30%) and CAPA (heaviest domain: Argo Workflows, 36%).
- OTCA and PCA. Choose OTCA if you're standardising instrumentation on OpenTelemetry, PCA if you live in Prometheus and PromQL — or study both if your pipeline runs OTLP in and Prometheus out, which is common.
- Because every one of the other eight tools — Argo, Backstage, Cilium, Istio, Kyverno, OpenTelemetry, Prometheus, and the mesh/GitOps layers above them — ultimately runs as Linux processes in cgroups, on a systemd-managed host. LFCS is what all eight are built on top of, not a peer skill beside them.
- Verify the current official page for that specific exam — price, question counts, pass marks, eligibility windows and validity periods are all the kind of figures the Linux Foundation and CNCF revise without much notice, and this is an independent, unofficial resource, not the vendor.