Kubernetes Certifications Explained

KCSA: the security-minded sibling

The Kubernetes and Cloud Native Security Associate mirrors the KCNA's format — 90 minutes, multiple-choice, $250 USD, no prerequisites — but points at security: cluster component security, the Kubernetes threat model, platform security, and compliance frameworks. Like KCNA, its passing score is not officially published.

Who it serves: security analysts and engineers who need to speak Kubernetes credibly without administering clusters, and aspiring security specialists testing their interest before committing to the long road toward CKS. Note the common misconception here: KCSA is not required for CKS, and does not qualify you for it. Only the CKA does.

CKA: the administrator's credential

The Certified Kubernetes Administrator is the flagship. It is a two-hour, performance-based exam in live clusters, testing cluster architecture and installation, workloads and scheduling, networking, storage, and — weighted heaviest — troubleshooting. The passing score is 66%, the 2026 exam tracks Kubernetes v1.35, and the $445 USD fee includes one free retake and two sessions on the killer.sh exam simulator.

Who it serves: platform engineers, DevOps engineers, site reliability engineers and systems administrators — anyone responsible for clusters themselves rather than just the applications on them. It is also the mandatory gateway to CKS, which makes it the default choice for anyone with security ambitions. The full picture of its domains, the February 2025 curriculum revision and registration logistics lives in our Certified Kubernetes Administrator guide, and its notorious difficulty gets an honest assessment in how hard is the CKA exam.

CKAD: the developer's credential

The Certified Kubernetes Application Developer shares the CKA's machinery — two hours, live clusters, 66% to pass, $445 USD with a retake and simulator sessions, Kubernetes v1.35 — but tests a different job: designing, building, deploying, configuring and observing applications on Kubernetes. Its domains centre on the application lifecycle rather than the cluster underneath it.

Who it serves: software developers who ship to Kubernetes and want to prove they can do so fluently without pretending to be cluster operators. Despite a persistent myth, CKAD is not "the easy one" or "the beginner one" — it is an intermediate exam with a reputation for intense time pressure. Exam facts and curriculum details are in the Certified Kubernetes Application Developer guide. If you are weighing this credential against the CKA, that head-to-head decision — role fit, overlap, difficulty — is the subject of CKA vs CKAD, and the narrower question of sequencing both is handled in CKAD vs CKA: which exam first.

CKS: the security summit

The Certified Kubernetes Security Specialist is the most advanced credential of the five and the only one with an enforced prerequisite: a current, non-expired CKA. It is another two-hour performance-based exam (passing score 67%, slightly higher than its siblings) covering cluster setup and hardening, system hardening, minimising microservice vulnerabilities, supply chain security, and runtime monitoring.

Who it serves: experienced administrators and platform engineers taking ownership of cluster security, and security professionals who have crossed into cloud native operations. Because of the prerequisite, "getting the CKS" is really a two-certification project for anyone starting fresh. The exam's six domains, costs and readiness signals are unpacked in our Certified Kubernetes Security Specialist guide.

Which Kubernetes certification should you get?

There is no universally correct answer — only a correct answer for your role, experience and direction. Use the framework below, built on three questions.

Question 1: Have you worked with Kubernetes hands-on?

If not — or only lightly — the associate tier exists for you. Choose KCNA for a general grounding, or KCSA if your career is already security-shaped. If you use Kubernetes regularly at work, skip the associate tier entirely and enter at the performance-based level; the multiple-choice exams will certify things you already know.

Question 2: Do you run clusters or run on clusters?

This is the CKA/CKAD fork, and it is about your job description, not your ability. If your responsibility is the platform — provisioning, upgrades, networking, storage, fixing broken clusters at 2 a.m. — the CKA matches your work. If your responsibility is applications — building, deploying, configuring and debugging workloads that someone else's cluster hosts — the CKAD matches it. Engineers who genuinely straddle both (common in small teams) should weigh the fuller comparison in CKA vs CKAD rather than defaulting to either.

Question 3: Is security your destination?

If yes, your route is fixed by the prerequisite: CKA first, then CKS, with KCSA as an optional conceptual warm-up early on. Plan the validity windows together — the CKA must still be current when you sit the CKS.

Three quick persona examples

• A second-year backend developer whose team deploys to a managed cluster: CKAD, directly. An associate exam would add little, and cluster administration is not their job.
• A systems administrator moving from VMs to containers: KCNA if the concepts are new, then CKA — the natural translation of their existing operational role.
• A security engineer told to "own Kubernetes security" this year: KCSA now for immediate vocabulary and threat-model fluency, then the CKA-to-CKS climb as the year's main project.

How these credentials sequence into a multi-year progression tied to job titles and seniority is its own topic, covered in the Kubernetes certification career path; and if your question is what the certifications do to your earning power, the Kubernetes certification salary guide is the place for that.

What the exams cost in combination

Individually, the performance-based exams list at $445 USD each and the associate exams at $250 USD each as of 2026, with course and subscription bundles available at higher prices. Two purchasing facts are worth knowing before you pay list price.

First, the Linux Foundation sells a CKA + CKAD + CKS bundle at $1,245 USD — a $90 saving over buying the three separately — with one retake per exam, simulator access and a twelve-month eligibility window on each. Second, sitewide sales are frequent, particularly around major shopping periods; if your timeline allows waiting for one, the saving can be substantial, though no specific discount is guaranteed.

Every performance-based purchase includes one free retake within its twelve-month window (the KCNA includes two attempts), which meaningfully lowers the cost of a failed first sitting compared with certification programmes that include no retake at all.

Common misconceptions about the CNCF ladder

A few persistent errors circulate in older articles and forum threads. Correcting them saves real money and time.

• "Kubernetes certifications last three years." Outdated. Anything earned on or after 1 April 2024 is valid for two years; only pre-existing certifications kept three. Renewal is a full retake of the current exam — there is no continuing-education option.
• "CKAD is the beginner exam." No — both CKA and CKAD are intermediate. KCNA is the actual entry-level Kubernetes certification.
• "You need KCSA before CKS." False. The CKS prerequisite is a current CKA, full stop.
• "You must take them in order." Apart from the CKA-before-CKS rule, there is no order. Plenty of developers earn CKAD as their first and only CNCF certification.
• "The Docker Certified Associate is a good companion credential." The DCA was discontinued after Mirantis acquired Docker Enterprise and has no successor; any list still recommending it is stale. The CNCF ladder is where container credentialing now lives.

The Kubestronaut programme

CNCF operates a recognition programme called Kubestronaut for individuals who hold all five certifications — CKA, CKAD, CKS, KCNA and KCSA — concurrently. For most engineers it is a stretch goal rather than a plan; the two-year validity windows mean keeping all five current requires ongoing retakes. If completionism appeals to you, the details and current perks are on the CNCF Kubestronaut page.

Frequently asked questions

Are there any official Kubernetes certifications not from CNCF?

No. Cloud vendors offer certifications that include Kubernetes content (for their managed services), but the five CNCF/Linux Foundation credentials are the only official Kubernetes certifications.

Can I take CKA and CKAD close together?

Yes — there is no dependency between them, and their exam environments share the same Kubernetes version, so preparation overlaps. Whether doing both is worth it, and in which order, depends on your role; see the sequencing discussion linked above.

Do the exams change when Kubernetes releases a new version?

Yes. The performance-based exam environments are updated to the newest minor Kubernetes version within four to eight weeks of each release (v1.35 as of August 2026), so always check which version is live when you book.

Where can I try realistic questions before committing to an exam?

ExamPractice hosts free sample questions for the CNCF exams on its CNCF exams hub, with fuller question sets and a timed practice-test simulation available to subscribers — a low-cost way to gauge which level of the ladder matches your current knowledge before you spend $250–$445 on a booking.

Mapping your own route

The Kubernetes certification landscape looks crowded from the outside but resolves into a simple shape once you see it: two multiple-choice on-ramps, two hands-on peer credentials split by role, and one security summit gated behind the administrator's exam. Start from your job, not from the list — pick the tier that matches your experience, the track that matches your responsibilities, and treat everything else as optional scenery. Whichever exam you land on, its dedicated guide linked above holds the detail this overview deliberately left out.