Start here · Welcome

Welcome to Golden Astronaut

Golden Kubestronaut is the CNCF's hardest recognition programme: sixteen certifications, held (or, for the top tier, ever passed) across a campaign that usually runs years rather than months. This course is your guide to the back nine of that ladder — CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA and PCA, the eight CNCF project-specific associates, plus the Linux Foundation's LFCS — the GitOps, service-mesh, policy, networking, observability, developer-portal and Linux-fundamentals exams that sit on top of the Kubernetes basics you've likely already earned. Nothing here is a mystery: every domain and weight below is published by the people who wrote the exam, and every lesson is built to teach the underlying skill, not just the multiple-choice answer.

Kubestronaut: the base tier, held at the same time

☺ Like you're 10: It's like frequent-flyer status — you get it by holding five badges at once, and the airline quietly takes it back if you let the oldest one expire.

Neither Kubestronaut programme has its own exam — both are the CNCF's way of recognizing people who already hold a whole set of its other certifications, awarded automatically the moment the Linux Foundation's records show you qualify; there's no form to fill in. Kubestronaut is the base tier: hold the five core Kubernetes certifications — KCNA, KCSA, CKA, CKAD and CKS — active at the same time, not merely passed at some point, and you get the title, a digital badge, the well-known jacket, a private community channel, and ongoing exam discounts. It also lapses: the moment the earliest of your five certifications expires and you haven't renewed it, Kubestronaut status quietly ends at the close of that same calendar year. That "held together" clause is the part people underestimate — spread the five out over too many years and you can find yourself re-sitting the first one before you've finished the last.

Golden Kubestronaut: the entire catalogue, kept for life

☺ Like you're 10: It's like a black belt — far more work to earn than the base tier, but once you have it, nobody takes it back, ever.

Golden Kubestronaut is the much larger undertaking built on top of Kubestronaut: pass the CNCF's entire certification catalogue — currently fifteen exams — plus the Linux Foundation's LFCS, sixteen in total, and the title is yours for life, with no renewal clock attached. That fifteen isn't fixed either — the CNCF periodically adds new certifications, and each one folds straight into the requirement list, but only for candidates still qualifying: a certification added after you've already earned Golden status does not revoke it. What you get for finishing goes well beyond the base jacket: exclusive Golden-tier gear, a wellness subscription, free KCD tickets, heavier KubeCon and certification discounts, and — from 2026 — a professional recommendation letter. The full mechanics, the lapse trap, and exactly what each tier gets you live on What Is Kubestronaut? — read that first if you're new to either programme, then The Sixteen-Exam Ladder and The Order of Attack turn the theory into an actual sequence to sit them in.

The nine credentials this course covers

☺ Like you're 10: Nine specific badges, each with its own study plan, practice questions, and timed mock exams — plus a lot of "why does this tool exist" explained properly, not just memorized.

This course does not re-teach the five Kubernetes exams or the two platform-engineering exams — those live in sibling courses, pointed to below. What it covers, in real depth, is the nine remaining credentials Golden Kubestronaut asks for: CGOA (GitOps principles and patterns), CAPA (the Argo project — CD, Rollouts, Workflows, Events), CBA (Backstage, the developer portal), CCA (Cilium, eBPF-powered networking), ICA (Istio, service mesh), KCA (Kyverno, policy-as-code), OTCA (OpenTelemetry, the vendor-neutral telemetry standard), PCA (Prometheus, metrics and alerting), and LFCS (Linux Foundation Certified System Administrator — the shell fluency underneath every cluster you'll ever operate). Each one gets its own blueprint (official domains and weights), a study plan, a practice-question bank, and two or three full timed mock exams.

The Project Certifications is the one page that puts all nine side by side, with the official domain weights behind each.

The deep layer underneath the nine exam guides

☺ Like you're 10: Passing the test is one thing. This is the "why does this tool actually exist" layer, so the idea survives long after the exam is over.

Underneath the nine exam guides sits a second, deeper track — fourteen long-form lessons on the ideas each exam is really testing, written to survive a real production incident, not just a multiple-choice question:

• GitOps Philosophy and the Argo ecosystem it runs on
• eBPF & the Cilium datapath and service mesh architecture
• Policy-as-code philosophy
• The OpenTelemetry data model and the Prometheus model
• The Backstage portal model
• Linux fundamentals for platform engineers
• CNCF project maturity & graduation and multi-project platform thinking
• The economics of certification, building a study system for many exams, and community & open-source contribution

Who this course is for

☺ Like you're 10: You don't need to be an expert already — you need to already be comfortable with basic Kubernetes and want to go wider across the platform stack around it.

This course assumes you're comfortable with core Kubernetes concepts — pods, deployments, services, namespaces — whether or not you've formally sat KCNA/CKA/CKAD/CKS/KCSA yet. It's written for platform engineers, SREs, and DevOps practitioners who already run clusters and now want the layers built on top of one: continuous delivery via GitOps, a service mesh for traffic between services, policy enforcement at admission time, a real observability pipeline, a self-service developer portal, and the Linux fluency that underpins all of it. It's equally useful as a standalone reference for any one of those nine tools — you don't have to be chasing all sixteen Golden Kubestronaut exams to get value from, say, just the Cilium or Kyverno material — but the course is organized end to end for candidates actually running the multi-year campaign.

How the course is built

☺ Like you're 10: First you learn what the badges are and why they're worth chasing. Then you master each one. Then you practice until it sticks.

What's inside

☺ Like you're 10: The sidebar has ten shelves. Here's what's on each one.

Meet the crew, and how the ELI10 device works

☺ Like you're 10: The same cartoon cast shows up in every lesson, and every big idea gets explained twice — once properly, once like you're ten.

Every lesson in this course is hosted by a member of a recurring cast — Mission Control introduces all fourteen of them, from Professor Owl (who draws the reference architecture) to Timmy the Turtle (who won't let a manifest apply until a policy has checked it) to Ellie the Elephant (who never drops a metric, log, or trace). Learn the character once and the concept travels with them for the rest of the course — spot the turtle and you know policy admission is about to come up; spot the hummingbird and traffic is about to move across the mesh. Alongside the cast, every page opens with a "☺ Explain it like I'm 10" callout — the idea in its simplest possible form before the full technical explanation — and repeats the trick at each major heading with a short "☺ Like you're 10" note. Between the two, you get the plain-English version and the exam-ready version of every idea, side by side, without one standing in for the other.

That's a preview of six of the fourteen — the full roster, every specialty, and the whole cast in one scene together is on Mission Control.

The other two-thirds of Golden Kubestronaut

☺ Like you're 10: Sixteen badges, three different courses. This is the middle third — the other two live right next door.

This course deliberately does not re-teach the seven exams that belong elsewhere, so it can go deep on its own nine instead of skimming sixteen shallowly. The five core Kubernetes certifications — KCNA, KCSA, CKA, CKAD and CKS — that Kubestronaut itself is built from, and that Golden Kubestronaut assumes as its foundation, are covered in full in the sibling Kubernetes course. The two platform-engineering exams — CNPA and CNPE — have their own complete blueprints, study plans and mock exams in the sibling Platform Engineering course. Between the three courses — Kubernetes, Platform Engineering, and this one — every exam Golden Kubestronaut currently requires is covered somewhere on this platform, each in the depth it deserves rather than compressed into one course that tries to do all sixteen at once.

Ready? Meet the cast at Mission Control, or jump straight into What Is Kubestronaut?.