Certifications · KCNA to CKS

Kubernetes Certifications

The CNCF publishes fifteen certifications plus the Linux Foundation's LFCS, and exactly five of them test Kubernetes itself: KCNA, KCSA, CKA, CKAD, and CKS. This course is built around that complete core-Kubernetes ladder — from an entry-level multiple-choice exam through a hardening specialization gated behind a passed CKA. This page is the hub: a master table of all five with their official domains and weights taken straight from the CNCF curricula, the associate-versus-performance-based split that should shape how you study, three recommended paths depending on where you're starting from, and the Kubestronaut program you qualify for by holding all five at once. The other ten CNCF certifications — the platform-engineering pair (CNPA, CNPE) and eight project-specific associates (CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA, PCA) — plus LFCS live in this platform's sibling courses; you'll find links out below rather than duplicated content.

The five-exam core-Kubernetes ladder

☺ Like you're 10: Two of these five ask you to pick the right answer. Three of them hand you a broken computer and a clock.

The ladder splits into two tiers, and the split matters more than any individual exam name. Associate exams (KCNA, KCSA) are knowledge-based, multiple choice, no terminal, no cluster — they check whether you hold a correct mental model. Professional and specialist exams (CKA, CKAD, CKS) are performance-based — you're dropped into a browser terminal against real, disposable clusters and graded purely on the state you leave behind when time runs out. Only one formal gate exists anywhere on this shelf: CKS requires an active, non-expired CKA before you can even register. Everything else can be booked in any order, though the order below is the one that actually makes each subsequent exam easier.

All five certifications, in one table

☺ Like you're 10: Here's the whole shelf on one page — what each badge is called, how hard it is, whether you type or click, and what's actually being tested.

Domain names and weights below are transcribed from the official CNCF curriculum for each exam. Every row sums to exactly 100%, and if this table ever disagrees with a curriculum PDF, trust the PDF — they live openly in the cncf/curriculum repository and are revised without ceremony. Each row links to this course's own breakdown of that exam.

Jump to any certification

The official domains, exam by exam

☺ Like you're 10: Here's what's actually hiding behind each percentage — not just the number, but what it's a number of.

🦉 KCNA — Kubernetes and Cloud Native Associate

Thirteen published competencies across four domains. Fundamentals (44%) is core concepts, administration, scheduling and containerization — by far the largest slice, and the reason nobody should sit KCNA without having actually run a Pod at least once. Container Orchestration (28%) moves into networking, security, troubleshooting and storage. Cloud Native Application Delivery (16%) covers application delivery and debugging. Cloud Native Architecture (12%, the smallest) is the widest-reading domain: observability, the cloud native ecosystem and its principles, and cloud native community and collaboration — including the CNCF's own project maturity ladder, Sandbox → Incubating → Graduated, which shows up in more interviews than its 12% weight would suggest.

🛡️ KCSA — Kubernetes and Cloud Native Security Associate

Forty-two published competencies across six domains — the densest curriculum of the five, and knowledge-based, so it rewards reading over doing. Cluster Component Security (22%, tied for largest) is the API server, controller manager, scheduler, kubelet, container runtime, kube-proxy, Pod, etcd, container networking, client security and storage — name the attack surface of every control-plane and node component. Security Fundamentals (22%) is Pod Security Standards and Admission, authentication, Secrets, isolation and segmentation, audit logging and NetworkPolicy. Threat Model (16%) is trust boundaries and data flow, persistence, denial of service, malicious code execution, an attacker already on the network, access to sensitive data, and privilege escalation. Platform Security (16%) is supply chain security, the image repository, observability, service mesh, PKI, connectivity and admission control. Overview of Cloud Native Security (14%) is the 4Cs — Cloud, Cluster, Container, Code — plus cloud-provider and infrastructure security, controls and frameworks, isolation techniques, artifact-repository and image security, and workload and application code security. Compliance and Security Frameworks (10%, the smallest) is compliance frameworks such as CIS, NIST, PCI-DSS, SOC 2 and ISO 27001, threat-modeling frameworks such as STRIDE and MITRE ATT&CK for Containers, supply-chain compliance, and automation and tooling.

🩺 CKA — Certified Kubernetes Administrator

Troubleshooting (30%) alone outweighs Storage and Workloads and Scheduling combined — cluster and node troubleshooting, cluster component troubleshooting, monitoring resource usage, reading container output streams, and troubleshooting services and networking. Cluster Architecture, Installation and Configuration (25%) is RBAC, bootstrapping and lifecycle-managing a cluster with kubeadm, running a highly-available control plane, using Helm and Kustomize to install cluster components, the CNI/CSI/CRI extension interfaces, and CRDs and operators. Servicing and Networking (20% — the curriculum's own spelling for this domain) is Pod-to-Pod connectivity, NetworkPolicy, Service types including the Gateway API, Ingress, and CoreDNS. Workloads and Scheduling (15%) is Deployments and their rolling updates and rollbacks, ConfigMaps and Secrets, workload autoscaling, the self-healing primitives, and Pod admission and scheduling including affinity and taints. Storage (10%, the smallest) is StorageClasses and dynamic provisioning, volume types, access modes and reclaim policy, and PersistentVolumes and PersistentVolumeClaims. That's 27 published competencies across the five domains, and this course teaches every one of them at full depth across five dedicated pages in the Exam Blueprint group, starting with Cluster Architecture, Installation and Configuration. A full plan lives on the CKA study plan, with timed reps on CKA practice tasks and a full mock exam.

🧩 CKAD — Certified Kubernetes Application Developer

Twenty-four published competencies, and CKAD is the exam pointed at the half of Kubernetes your platform's users actually touch. Application Environment, Configuration and Security (25%, the largest) is discovering and using CRDs and Operators, authentication, authorization and admission control, resource requests/limits/quotas, ConfigMaps, Secrets, ServiceAccounts, and SecurityContexts and Capabilities. Application Design and Build (20%) is building and modifying container images, choosing the right workload resource, multi-container Pod patterns such as sidecars and init containers, and persistent and ephemeral volumes. Application Deployment (20%) is deployment strategies such as blue/green and canary built from primitives, Deployments and rolling updates, using Helm to deploy packages, and Kustomize. Services and Networking (20% — spelled this way in CKAD's own curriculum) is NetworkPolicy basics, Services including troubleshooting access to one, and Ingress. Application Observability and Maintenance (15%, the smallest) is API deprecations, probes and health checks, CLI monitoring tools, container logs, and debugging. Unlike CKS, CKAD has no formal prerequisite of its own. Study it on the CKAD study plan and practice tasks.

🔗 CKS — Certified Kubernetes Security Specialist

Three domains tie for the largest slice at 20% each. Minimize Microservice Vulnerabilities is Pod Security Standards and Admission, Kubernetes Secrets management, isolation techniques including sandboxed runtimes like gVisor and Kata, and pod-to-pod encryption via a mesh such as Cilium or Istio. Supply Chain Security is minimizing a base image's footprint, SBOMs across CI/CD and artifact repositories, permitted registries plus signing and validating artifacts with cosign, and static analysis with tools like Kubesec or KubeLinter. Monitoring, Logging and Runtime Security is behavioral analytics, threat detection across infrastructure, applications, network, data, users and workloads, identifying the phase of an attack, and container immutability at runtime, plus the Kubernetes audit logs. Cluster Setup and Cluster Hardening tie at 15% each — network security policy, a CIS benchmark review with kube-bench, Ingress TLS, protecting node metadata and endpoints, and verifying platform binaries for the former; RBAC least-exposure, cautious ServiceAccount use including disabling auto-mount, restricting API access, and upgrading Kubernetes to stay ahead of CVEs for the latter. System Hardening (10%, the smallest) is minimizing the host OS footprint, least-privilege IAM, minimizing external network access, and seccomp/AppArmor.

Three starting points, three study paths

☺ Like you're 10: Where you should start on this ladder depends on where you're already standing, not on which exam sounds most impressive.

None of these are official CNCF sequences — they're the routes that make sense given how the five curricula actually overlap. In every one, skip a step your day job already covers; a certification is a proof, not a lesson.

Path 1 — Complete beginner: new to Kubernetes and cloud native

1. KCNA — the vocabulary of the whole ecosystem first. Cheap, short, knowledge-based, and it makes every later curriculum readable instead of alien.
2. CKA — the first real one. This is where you stop reading about clusters and start running them, and it's the single biggest step in this list.
3. KCSA (optional) — a cheap, quick pass at the security vocabulary once the cluster itself makes sense.
4. CKAD or CKS — pick based on direction: CKAD if you're heading toward building applications on the cluster, CKS if you're heading toward defending it.

Start reading with What Is Kubernetes, and Why while you decide, and use how to study to build the actual plan.

Path 2 — Developer: already ships applications, wants to own how they run

1. CKAD — start where you're already strong. It's hands-on, so it builds terminal reflexes early, and it certifies the exact experience you already have as an app author.
2. KCNA (optional) — fills the ecosystem-vocabulary gaps fast if job interviews keep surfacing terms you don't quite have pinned down.
3. CKA — the uncomfortable one, and the one that most changes how you're seen. Owning what a workload does is not the same as owning the cluster it runs on.
4. CKS (optional) — worth it once CKA is in hand, if security is where you want to specialize next.

Path 3 — Ops or SRE: already runs production infrastructure

1. KCNA (optional, skip if already fluent) — a fast, cheap confirmation of baseline vocabulary; most experienced operators can skim past it.
2. CKA — the fastest return on existing operational instincts. For most SREs this is a formality with a few weeks of drilling; for everyone else it's the quickest way to prove fluency you already have on the job.
3. CKS — the natural next step given a hardening-and-incident background, and one you can now register for. Goes far deeper than day-to-day ops usually does.
4. CKAD (optional) — worth adding for empathy with what your platform's application-developer users actually experience.

Kubestronaut, Golden Kubestronaut, and the other ten

☺ Like you're 10: Collect a whole set of badges and have them all valid at the same moment, and the CNCF gives you a special title — and a jacket.

Beyond the individual exams, the CNCF runs a recognition program for people who hold several certifications at once. It isn't an exam you register for — you qualify automatically by holding the required certifications simultaneously and in good standing, and the CNCF invites you in. Kubestronaut recognizes exactly the five certifications on this page — KCNA, KCSA, CKA, CKAD, and CKS — all active at the same time. Recipients get a title, a digital badge, and the well-known jacket, plus community perks. It has to be maintained: per the CNCF's own FAQ, the title lapses at the end of the calendar year your earliest certification expires, which makes it a genuine recurring commitment rather than a one-off achievement.

Golden Kubestronaut is the considerably harder tier above it: every one of the CNCF's fifteen certifications — this course's five, the platform-engineering pair (CNPA, CNPE), and the eight project-specific associates (CGOA, CAPA, CBA, CCA, ICA, KCA, OTCA, PCA) — plus the Linux Foundation's LFCS. Sixteen exams in total, and unlike plain Kubestronaut it's described as kept for life once earned. This course teaches only the five that test Kubernetes itself; the other ten CNCF certifications, LFCS, and the full Kubestronaut and Golden Kubestronaut program rules live in the sibling Golden Astronaut course. If your interest is specifically the platform-engineering pair, they're covered in depth — with their own study plans — in the sibling Platform Engineering certifications hub.

Exam logistics — and why you must verify them yourself

☺ Like you're 10: Prices, timings and pass marks move. Read the real page before you pay for anything.

This is an independent, unofficial study resource — not affiliated with or endorsed by the CNCF or the Linux Foundation. The shape below is generally consistent across the associate and performance-based tiers, but the exact price, question count, pass mark, retake policy and permitted-documentation allowlist have all changed at some point in each exam's history, and each certification's own blueprint page carries its own detailed logistics table.

Check your answers

1. Knowledge-based: KCNA and KCSA. Performance-based: CKA, CKAD, and CKS.
2. CKS requires an active, non-expired CKA before you can register — the only formal gate on the ladder.
3. Troubleshooting, at 30% — larger than Storage and Workloads and Scheduling combined.
4. All five: KCNA, KCSA, CKA, CKAD, and CKS, all active at the same time.
5. Storage (10%) and Workloads and Scheduling (15%) sum to 25% — still five points short of Troubleshooting's 30%.
6. The sibling Golden Astronaut course covers the remaining ten CNCF certifications, LFCS, and the full Kubestronaut/Golden Kubestronaut program; the platform-engineering pair (CNPA, CNPE) specifically also has its own deep coverage in the Platform Engineering certifications hub.