DevOps Certification Roadmap

Stage 3: Kubernetes and infrastructure as code

This is the stage most roadmaps get wrong, so the internal ordering is worth spelling out.

The Kubernetes ladder, in order

The CNCF ladder has a designed sequence: KCNA → CKA or CKAD → CKS, with two associate exams (KCNA and KCSA) at the entry rung.

• Kubernetes and Cloud Native Associate (KCNA) is the true entry point — a 90-minute multiple-choice exam at $250 USD, no prerequisites, valid two years. A common misconception holds that the Certified Kubernetes Application Developer (CKAD) is "the beginner exam"; it is not. Both CKA and CKAD are intermediate, hands-on exams — KCNA is the actual on-ramp. Engineers already comfortable with containers can skip KCNA entirely; career-changers should not.
• CKA or CKAD next — pick by role, take one. The CKA (cluster administration: installation, troubleshooting, networking) suits ops and platform engineers; the CKAD (building, deploying and configuring applications on Kubernetes) suits developers. Both are two-hour, performance-based exams on live clusters, $445 USD each as of 2026, passing score 66%, based on Kubernetes v1.35 as of August 2026. For a DevOps roadmap specifically, the CKA is the correct default, for a sequencing reason: it is the sole prerequisite for the CKS. The CKAD gates nothing.
• CKS last, and only in Stage 4 (covered below), because it requires a current CKA — timing that interacts with expiry dates in a way we will get to.

Note the built-in retry economics when you plan this stage: CKA/CKAD/CKS purchases include a 12-month eligibility window, one free retake and two killer.sh simulator sessions, and the KCNA includes two attempts. A failed first attempt costs you weeks, not another fee — which argues for booking these exams earlier than you feel ready and letting a timed simulator run, or a set of free sample questions, decide whether you use the attempt.

One curriculum footnote for anyone using older study plans: the CKA syllabus was revised on 18 February 2025 — Gateway API, Helm and Kustomize, CRI/CSI/CNI troubleshooting and Pod Security Standards all came in. Material older than that revision will leave gaps.

Terraform: interleave, don't append

HashiCorp Certified: Terraform Associate (version 004 since January 2026, tested on Terraform 1.12) is a one-hour multiple-choice exam at $70.50 USD plus taxes — the cheapest meaningful credential on this entire roadmap. Slot it between your cloud associate and your Kubernetes hands-on exam, or in parallel with KCNA: infrastructure as code is lighter study than Kubernetes, and certifying it early means every subsequent lab you build (including your CKA practice clusters) can be Terraform-managed, turning study time into portfolio.

Make sure any prep targets 004 — the 003 exam was last delivered on 7 January 2026, and stale courses abound.

What NOT to put in Stage 3

The Docker Certified Associate. It was discontinued after Mirantis acquired Docker Enterprise and has no successor; container skills now route through the CNCF ladder. Any roadmap still listing the DCA predates 2026 realities — discard it whole.

Exit criteria: CKA (or CKAD) passed, Terraform Associate passed, and — the unwritten one — you have run Kubernetes and Terraform somewhere real, even a homelab, for a full stage.

Stage 4: Specialisation

Only now do professional-tier exams make sense, and the sequencing question becomes a fork, not a ladder. Choose one of three branch lines:

1. Cloud DevOps professional. Your primary provider's professional DevOps exam — AWS Certified DevOps Engineer – Professional (DOP-C02), Microsoft's AZ-400 (DevOps Engineer Expert), or Google's Professional Cloud DevOps Engineer. Sequencing note for Azure specifically: AZ-400 sits at Expert tier with an associate-level Azure cert expected in the pathway, so your Stage 2 choice already paid its toll. Confirm current prices on each provider's site — they change, and unlike the CNCF exams, cloud vendor exams generally include no free retake.
2. Kubernetes security. The CKS: two hours, performance-based, 67% passing score, $445 USD, valid two years. The timing rule that trips people: your CKA must still be current when you attempt CKS. If your CKA is 18 months old, either sit the CKS now or accept you are re-earning the CKA first — do not let the prerequisite expire mid-preparation. (The KCSA, despite its name, is not a CKS prerequisite; only the CKA is.)
3. Terraform professional. The HashiCorp Terraform Authoring and Operations Professional — four hours, labs plus multiple choice, $295 USD with a free retake included — for those whose specialisation is infrastructure as code itself.

Which branch, and which specific exams deserve an experienced engineer's money, is a ranking judgement outside this article's lane — the best DevOps certifications for experienced engineers makes those calls. How each branch maps to job titles is the territory of the DevOps certification career path.

The renewal loop: sequencing after the summit

A roadmap that ends at Stage 4 is incomplete, because 2026-era DevOps certs expire fast. CNCF certifications earned on or after 1 April 2024 are valid two years (older ones were grandfathered at three), and renewal is a full retake — no continuing-education shortcut. HashiCorp certs are likewise two-year credentials. That turns your certification list into a maintenance schedule:

• Stagger, don't cluster. Two hands-on CNCF exams passed the same quarter means two retakes due the same quarter two years later. Space Stage 3 and Stage 4 exams at least six months apart.
• Renew only what your role still touches. Letting a CKAD lapse when you have become a platform engineer is housekeeping, not failure.
• Mind the CKA→CKS chain at renewal time. Renewing the CKA first keeps your CKS eligibility alive if you ever need to retake it.

Completists should know the CNCF's Kubestronaut recognition exists for holding all five Kubernetes certs simultaneously (CKA, CKAD, CKS, KCNA, KCSA) — check the CNCF's Kubestronaut page for current details — but understand what the two-year validity maths implies: perpetual retakes across five exams. It is a trophy route, not a career route.

Five sequencing mistakes that wreck good roadmaps

The same ordering errors appear over and over in candidate plans. Each is cheap to avoid and expensive to make:

1. Buying Stage 4 exams with Stage 2 skills. Professional-tier cloud exams are written for people who have operated the platform for years; sitting one straight after an associate pass usually means paying twice. The stages exist because the exams assume them.
2. Taking CKA and CKAD both, early. They overlap heavily in tooling and environment, cost $445 USD each, and both start a two-year renewal clock. Take the one your role demands; add the other only if a job actually requires it. The hour you would spend deciding is well spent on a role-honest reading of the two domain lists — administration versus application delivery.
3. Letting the CKA expire before attempting CKS. The prerequisite must be current at attempt time. If you intend to specialise in Kubernetes security, treat CKA-plus-CKS as one continuous eighteen-month project, not two independent items on a someday list.
4. Preparing from material older than the exam. The February 2025 CKA revision and the January 2026 Terraform 004 transition both invalidated whole shelves of courses. Before starting any prep, check the material's stated exam version against the provider's current page — a five-minute check that saves a failed attempt.
5. Certifying ahead of practice. A credential earned two stages ahead of your hands-on reality decays before you can use it — you will be renewing it before a job ever tests it. The roadmap moves at the speed of what you can actually run, break and fix.

There is also a sixth, subtler error: sequencing for someone else's stack. A roadmap copied from a colleague at an Azure enterprise makes no sense at a GCP start-up. The four stages are universal; every branch-line choice inside them should come from the job specs you actually intend to answer, which you can sanity-check by browsing what employers ask for against the directory of certification exams in each provider's family.

The roadmap on one page

1. Stage 1 — Foundations: Linux fluency → cloud fundamentals (optional if experienced) → Git/GitHub Foundations (optional).
2. Stage 2 — Core: cloud associate in your primary provider → CI/CD fluency, optionally checkpointed with GitHub Actions (GH-200).
3. Stage 3 — Containers + IaC: Terraform Associate (early, cheap) → KCNA if new to Kubernetes → CKA (default) or CKAD (developers).
4. Stage 4 — Specialise (pick one branch): cloud DevOps professional, or CKS while the CKA is current, or Terraform Professional.
5. Loop: renew two-year certs on a staggered schedule; drop what your role has outgrown.

Frequently asked questions

Can I skip straight to the CKA without any cloud certification?

Formally yes — the CKA has no prerequisites. Practically, most people who struggle with it are fighting Linux and networking fundamentals, not Kubernetes. If you are already a competent sysadmin, skipping Stage 2's cloud associate is defensible; skipping Stage 1's fundamentals is not.

Should I do KCSA before CKS?

Only if you want a gentle, multiple-choice introduction to Kubernetes security concepts ($250 USD, 90 minutes, no prerequisites). It is not required for the CKS — the CKA is the only gate — so on a lean roadmap the KCSA is skippable.

What if my employer switches clouds mid-roadmap?

Only Stage 2 and the Stage 4 cloud branch are provider-specific. Your Kubernetes and Terraform credentials transfer untouched, which is exactly why Stage 3 is the roadmap's centre of gravity: it is the portable stage.

Is a certification roadmap even the right frame — shouldn't I just build things?

Both, in alternation. The roadmap's exit criteria deliberately mix exams with practice ("built a real pipeline", "run Kubernetes somewhere real") because exams verify floors while projects demonstrate ceilings. Whether the certification half of that pairing pays off at all in your specific situation is a fair, separate question — we weigh the cost-versus-experience argument in full in is a DevOps certification worth it?

Where do GitOps, observability and platform engineering certs fit?

Mostly in Stage 4, as flavours of specialisation rather than separate stages. The CNCF and vendors keep adding associate-level exams in these niches; the sequencing rule stays the same — nothing niche before the CKA-level core, because every one of those tools assumes Kubernetes fluency underneath. Add them where a role demands them, not because they exist.

How do I know I'm ready to book each exam?

Benchmark before you book. A timed, full-length run through a practice-test simulation against the current objectives — analysed by domain, not just total score — turns "I feel ready" into a per-domain gap list, and stops you spending an attempt to find out what a mock could have told you.

Your next station

Roadmaps fail from ambition, not ignorance: the engineer who books three exams for one quarter finishes none of them well. Identify which stage you are actually in — judged by exit criteria, not by what you have read about — and buy exactly one exam. When it is passed and its skills have survived contact with real work, the map above tells you the next station.