The Sixteen-Exam Ladder
Golden Kubestronaut is not one exam, or even one program stacked on another — it's sixteen individual certifications, drawn from four different corners of the CNCF and Linux Foundation catalogue, every one of which has to be valid at the same moment for the title to be granted. This page is the master inventory: all sixteen, sorted into the four families that actually matter for planning — the five-exam Kubernetes core you're assumed to already hold, the two-exam Platform pair that sits at the top of the ladder, the eight-exam belt of project-specific associates that is this course's own curriculum, and the one Linux exam underneath all of it. Treat it as a checklist, not a syllabus: tick off what you've already passed, see exactly what's left, and use the links below to jump straight to wherever each exam is actually taught.
Imagine a very specific kind of passport. To earn it, you need sixteen visa stamps, and they all have to be valid on the same day you show up to collect it — not sixteen stamps gathered over your whole life, sixteen that haven't expired yet. The stamps come from four different consulates: one big one for “general cloud-native travel” that alone gets you five stamps, a tiny elite one for “you can run the whole embassy” that's worth two, a busy one that stamps you separately for every country you've visited — eight stamps, one per tool — and one for “you can survive without room service,” worth one stamp, for Linux. This page is the wall chart tracking which of the sixteen you already have.
The four families, at a glance
☺ Like you're 10: Four different exam-makers, one shared finish line — sixteen stamps, four separate counters ticking toward it.
Every one of the sixteen belongs to exactly one of four families, and which family it's in tells you two useful things immediately: how it's tested, and which course on this site actually teaches it.
- Kubernetes core — 5 exams. KCNA, KCSA, CKA, CKAD, CKS. These five are also the entire requirement for the separate, older Kubestronaut title on their own — Golden Kubestronaut assumes you hold, or will separately earn, all five of them. This course references them constantly and re-teaches none of them; the depth lives on the sibling Kubernetes course.
- Platform — 2 exams. CNPA and CNPE, the associate/professional pair for the platform-engineering discipline itself. Taught in full on the sibling Platform Engineering course, which builds its entire curriculum around this pair.
- Project associates — 8 exams. CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA, PCA — one exam per CNCF project, mostly knowledge-based. This is the belt this course exists to teach: every one of the eight gets a full blueprint, study plan, practice set and two mock exams under Certifications.
- Linux — 1 exam. LFCS, the Linux Foundation's own system-administration credential — the only one of the sixteen that isn't a CNCF exam at all. Also taught on this course, since it's the one outlier the Golden Kubestronaut list tacks on beyond the CNCF's fifteen.
Five plus two plus eight plus one is sixteen, and that's the entire published CNCF certification catalogue at time of writing, plus LFCS — not a curated subset. Golden Kubestronaut isn't “pick your favorites”; it's “pass all of them.” That also means the target moves: every time the CNCF ships a new project associate, the list this page describes gets one exam longer for anyone who hasn't finished yet.
Family 1 — the five-exam Kubernetes core
☺ Like you're 10: These five are the entrance fee. This course assumes you already have them, or are getting them somewhere else — it never re-teaches them here.
KCNA (Kubernetes and Cloud Native Associate) and KCSA (Kubernetes and Cloud Native Security Associate) are both knowledge-based, multiple-choice, roughly 90-minute exams — the vocabulary and the threat-model layer, respectively. CKA (Certified Kubernetes Administrator), CKAD (Certified Kubernetes Application Developer) and CKS (Certified Kubernetes Security Specialist) are the performance-based trio: two hours each, live clusters, graded on the state you leave behind rather than the answer you picked. CKS is the one exam anywhere on this entire sixteen-exam list with a formal prerequisite — the Linux Foundation requires a currently passed CKA before you can sit it.
These five, held simultaneously, already earn the plain Kubestronaut title on their own — jacket included — well before Golden Kubestronaut enters the picture. All five are taught in depth on the sibling Kubernetes course; this course's own Kubernetes Baseline You Need page describes exactly how much of that fluency you're assumed to be carrying before the project-associate material here starts to make sense.
Family 2 — the two-exam Platform pair
☺ Like you're 10: Only two exams in this family, but they're the hardest two on the whole ladder — one is a real, timed, hands-on build.
CNPA (Certified Cloud Native Platform Engineering Associate) is knowledge-based and gets a slightly longer 120-minute sitting than the other associates. CNPE (Certified Cloud Native Platform Engineer) is performance-based, two hours, and sits at the top of the CNCF's whole certification shelf — the summit both this course's own Why Pursue Golden Kubestronaut page and the sibling course treat as the natural capstone. Both exams span the entire discipline of platform engineering — golden paths, self-service platform APIs, GitOps delivery, observability, and security-and-policy — rather than any single tool.
Neither exam is taught here; the sibling Platform Engineering course is built entirely around this pair, including its own ten-week CNPE study plan and a full CNPA sub-course. If you land on this ladder from the Kubernetes side and platform engineering is new vocabulary, that course's certification landscape hub is the fastest way to see how CNPA and CNPE relate to everything else in the catalogue.
Family 3 — the eight-exam project-associate belt
☺ Like you're 10: Eight badges, one per tool, and every single one of them is taught right here on this course — this is the belt Golden Astronaut exists to get you through.
Each of these eight is knowledge-based except ICA, and each one certifies fluency in exactly one CNCF project rather than the discipline as a whole:
| Cert | Project | Top-weighted domain | Full guide on this course |
|---|---|---|---|
| CGOA | GitOps (Argo CD / Flux principles) | GitOps Principles — 30% | CGOA — the exam |
| CAPA | Argo (Workflows, CD, Rollouts, Events) | Argo Workflows — 36% | CAPA — the exam |
| CBA | Backstage (the developer portal) | Customizing Backstage — 32% | CBA — the exam |
| CCA | Cilium (eBPF networking & mesh) | Architecture — 20% | CCA — the exam |
| ICA | Istio (service mesh) | Traffic Management — 35% | ICA — the exam |
| KCA | Kyverno (policy as code) | Writing Policies — 32% | KCA — the exam |
| OTCA | OpenTelemetry (instrumentation) | API & SDK — 46% | OTCA — the exam |
| PCA | Prometheus (metrics & alerting) | PromQL — 28% | PCA — the exam |
Note the format exception buried in that list: ICA is the odd one out. The Linux Foundation's own listing describes it as performance-based — a mix of hands-on and multiple-choice tasks — even though it's priced and badged alongside the knowledge-based associates. Study for it the way you'd study for CKA, not the way you'd study for CGOA.
This family is where the overlap with the sibling Platform Engineering course is real and worth using deliberately: several of these eight — especially CGOA and CAPA — map directly onto the 25% GitOps & Continuous Delivery domain of the CNPE. If you're chasing CNPE as well as Golden Kubestronaut, sitting those two isn't wasted parallel effort; it's shared preparation.
Family 4 — the one Linux exam
☺ Like you're 10: Every Pod is secretly just a Linux process wearing a costume. This exam tests whether you can find your way around underneath the costume.
LFCS (Linux Foundation Certified SysAdmin) is performance-based, two hours, and — unlike the other fifteen — issued by the Linux Foundation with no CNCF curriculum behind it at all. It covers Operations Deployment, Networking, Storage, Essential Commands, and Users and Groups: the systemd units, cgroups, filesystems and networking plumbing that every Kubernetes node is quietly standing on. It's the sixteenth requirement precisely because the CNCF's own fifteen assume that layer rather than testing it.
Full coverage of it lives on this course at LFCS — the exam, with a matching study plan, practice tasks, and three mock exam sets.
The master checklist — all sixteen in one table
☺ Like you're 10: One long list, every stamp in your passport, with a box you can mentally tick as you go.
Every row below links to where that exam is actually taught, not to a generic search result. Format, duration and price are the shape published by the Linux Foundation for each tier — read the individual guide page for the specifics of any one exam before you plan your evenings around it.
| # | Cert | Family | Format | Typical sitting | Learn it |
|---|---|---|---|---|---|
| 1 | KCNA | Kubernetes core | Knowledge-based | 90 min · $250 | Kubernetes course |
| 2 | KCSA | Kubernetes core | Knowledge-based | 90 min · $250 | Kubernetes course |
| 3 | CKA | Kubernetes core | Performance-based | 2 hr · $445 | Kubernetes course |
| 4 | CKAD | Kubernetes core | Performance-based | 2 hr · $445 | Kubernetes course |
| 5 | CKS (needs a passed CKA) | Kubernetes core | Performance-based | 2 hr · $445 | Kubernetes course |
| 6 | CNPA | Platform | Knowledge-based | 120 min · $250 | Platform Engineering course |
| 7 | CNPE | Platform | Performance-based | 2 hr · $445 | Platform Engineering course |
| 8 | CGOA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 9 | CAPA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 10 | CBA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 11 | CCA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 12 | ICA | Project associate | Performance-based (hybrid) | 2 hr · $250 | This course |
| 13 | KCA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 14 | OTCA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 15 | PCA | Project associate | Knowledge-based | 90 min · $250 | This course |
| 16 | LFCS | Linux | Performance-based | 2 hr · $445 | This course |
Every price, duration and format above is a snapshot of what the Linux Foundation publishes today. Exam logistics change without much ceremony — durations shift, prices move, and question counts get published and then quietly un-published. Before you register for any of the sixteen, confirm the current price, duration, format and pass mark on the Linux Foundation certification catalog directly. This is an independent, unofficial study resource, not affiliated with the CNCF or the Linux Foundation — it is not the source of truth for any of these numbers.
“I tried to hold the whole list in my head for about a month before I gave up and made a spreadsheet: one row per exam, a pass date, an expiry date, a status column. The moment I could see it as sixteen rows instead of one enormous vague goal, it stopped being intimidating — it was just a list of things to do in some order, and a couple of them I'd already half-finished without noticing.”
Open a blank page and write all sixteen exam codes from the table above, in four groups. Next to each one you've already passed, write the date it expires — not the date you passed it. Next to each one you haven't taken, leave it blank for now; you'll fill that in on The Order of Attack. What you'll have at the end is not a study plan yet, just an honest inventory — which is exactly what this page is for, and exactly what most people chasing this title never actually write down until months in.
What this page isn't
☺ Like you're 10: This page tells you what the sixteen are. It doesn't tell you what order to take them in — that's a different page, on purpose.
Deliberately, this is an inventory, not a sequence. Sixteen exams with zero cross-family prerequisites (CKS aside) can be attempted in almost any order, and the right order depends heavily on where you're starting from — a Kubernetes veteran and a GitOps-first platform engineer should not follow the same path through this list. That reasoning lives on The Order of Attack, and the case for bothering with any of this at all — beyond the badge — lives on Why Pursue Golden Kubestronaut. Read this page first to know what you're counting; read those two next to know what to do about it.
Nutty: Sixteen. Not fifteen — people always guess fifteen, because that's the CNCF's own catalogue. Golden Kubestronaut tacks LFCS on top.
Foxy: Sixteen sounds like a number someone made up to sound impressive. Where does it actually come from?
Nutty: Four drawers, and I keep a receipt for every item in every one. Five in the Kubernetes-core drawer. Two in the Platform drawer. Eight in the project-associate drawer. One lonely LFCS in the Linux drawer. Five plus two plus eight plus one.
Gizmo: Or — hear me out — get someone who already has the jacket to send you a photo of it, and just... claim you did all sixteen. Nobody's cross-checking sixteen transcripts.
Timmy: The CNCF is cross-checking sixteen transcripts, Gizmo. It's not a vibe-based title — it's verified against your actual Linux Foundation record, all sixteen active at once.
Nutty: Which is the whole point of this page. It's not a study guide — it's the ledger. You only cross an item off when it's still actually valid, not just once passed and forgotten.
Foxy: So what do I do with the ledger once it's full?
Nutty: Then you've earned a jacket. Until then, you've earned a spreadsheet.
1. How many total exams does Golden Kubestronaut require, and which single one of them isn't a CNCF exam at all? 2. Name all five exams in the Kubernetes-core family. 3. Which two exams make up the Platform family, and which sibling course teaches them in depth? 4. How many exams are in the project-associate belt, and which course teaches all eight of them? 5. Which one Kubernetes-core exam carries a formal prerequisite, and what is it? 6. True or false: once the CNCF adds a new certification to its catalogue, everyone who already earned Golden Kubestronaut loses the title until they pass the new one too.
Check your answers
- Sixteen. LFCS is the one exam on the list that isn't a CNCF exam — it's issued directly by the Linux Foundation, with no CNCF curriculum behind it.
- KCNA, KCSA, CKA, CKAD, CKS.
- CNPA and CNPE, taught in depth on the sibling Platform Engineering course.
- Eight — CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA, PCA — and this course teaches all eight of them.
- CKS is the only one with a formal prerequisite: a currently passed CKA.
- False. Per the CNCF's own program rules, a new certification launching after you've already earned Golden Kubestronaut does not retroactively revoke your title.