Kubernetes certification preparation works best when it starts with the responsibilities you want to perform. The Cloud Native Computing Foundation and The Linux Foundation offer credentials ranging from foundational knowledge to hands-on administration, application development and security. Some assessments use multiple-choice questions; others require candidates to solve real tasks from a command line under remote supervision. They cannot all be prepared for through the same question bank. This guide compares the current pathways and shows how to turn their official curricula into a practical study plan.<\/p>\n
The most important choice is between learning concepts and demonstrating operational ability. A beginner may first need to understand containers, Pods, clusters and networking. An application developer needs to deploy and troubleshoot workloads. A cluster administrator is expected to manage storage, scheduling, control-plane configuration and incidents. A security specialist must reason about hardening, image supply chains and runtime protections. Select the examination that matches those decisions before paying for a course or booking a date.<\/p>\n
The Kubernetes and Cloud Native Associate (KCNA) is an entry-level, online multiple-choice certification covering foundational Kubernetes and cloud-native concepts. It can be appropriate for students, support professionals and stakeholders who need an overview of the ecosystem before moving into hands-on administration or development. The Kubernetes and Cloud Security Associate (KCSA) also uses multiple-choice assessment, but concentrates on security fundamentals, risk, platform controls and governance. Neither certifies that an individual can operate a production cluster without guidance.<\/p>\n
The Certified Kubernetes Administrator (CKA) and Certified Kubernetes Application Developer (CKAD) are different: they are online, proctored, performance-based exams that require solving command-line tasks in two hours. CKA evaluates administration of clusters and the infrastructure that supports workloads. CKAD tests whether developers can design, configure, deploy, expose and troubleshoot cloud-native applications. The CKAD application practice<\/a> is valuable for someone building Services and Deployments, while CKA goes deeper into control-plane and cluster-level operations.<\/p>\n Certified Kubernetes Security Specialist (CKS) builds on Kubernetes knowledge and tests the ability to secure workloads, infrastructure and the software supply chain. The issuer requires candidates to have passed CKA before attempting CKS, although the CKA does not need to remain active for that prerequisite. The CKS is a two-hour performance exam and its credential is valid for two years. A newcomer interested in security can begin with KCSA, but that multiple-choice foundation is not a replacement for CKA and hands-on experience before a CKS attempt.<\/p>\n CNCF also lists project-focused credentials such as Prometheus Certified Associate, Cilium Certified Associate, Istio Certified Associate and GitOps Certified Associate. These are best considered when the corresponding technology is relevant to a current or desired role. They need not be collected in a fixed sequence. Official current certification pages determine exam format, availability, renewal and price; an older list can miss new credentials or include retired course names.<\/p>\n As published by CNCF in November 2026, CKA divides its examination into Cluster Architecture, Installation and Configuration (25%); Workloads and Scheduling (15%); Services and Networking (20%); Storage (10%); and Troubleshooting (30%). The percentages reflect exam coverage, not the difficulty of a real production incident. They also show why learning only how to create Deployments is insufficient for an administrator. Troubleshooting is the largest domain, and tasks can require diagnosing interactions across several components.<\/p>\n Create one lab for each domain. For cluster architecture, inspect control-plane components and practise configuration tasks in a disposable environment where cluster administration is authorized. For workloads, create a Deployment and diagnose a Pending Pod caused by resource requests or node constraints. For networking, expose a test Service, inspect EndpointSlices and investigate a deliberately mismatched selector. For storage, use a PersistentVolumeClaim and explain its driver and topology limitations. For troubleshooting, break a harmless workload and restore it using evidence from events, logs and resource status.<\/p>\n A useful CKA administrator study sequence<\/a> should also include etcd backup and restore where relevant to the exam environment, kubeadm-style cluster lifecycle concepts and the responsibilities of a CNI implementation. Do not treat a single cloud provider’s managed-cluster dashboard as equivalent to understanding Kubernetes. Learn the API objects and operational boundaries that remain meaningful across environments, then compare provider-specific behavior and support policies.<\/p>\n CKAD allocates 20% to Application Design and Build, 20% to Application Deployment, 15% to Application Observability and Maintenance, 25% to Application Environment, Configuration and Security, and 20% to Services and Networking. This curriculum suggests a coherent project: build a small HTTP application, package its container image, deploy it, inject configuration, expose it through an appropriate Service and test readiness. Add a Job or CronJob and a deliberately broken rollout to practise multiple resource types.<\/p>\n Test each task from a clean namespace, not just by replaying a saved script. Change labels, ports and image tags so that you must inspect the desired state and diagnose what actually happened. Create a least-privilege service account and verify that it can perform its intended action but not an adjacent forbidden operation. Compare ConfigMaps with Secrets and understand what the resource kind does not guarantee about storage encryption or safe logging. The readiness and liveness behavior<\/a> matters because a green Pod status is not the same thing as an application delivering useful responses.<\/p>\n CKAD involves operating within application boundaries rather than rebuilding every cluster component. A developer should understand resource requests, NetworkPolicies and storage behavior sufficiently to make safe application choices, but dedicated administrator responsibilities such as control-plane maintenance align more naturally with CKA. The common command-line skills transfer; the ownership and task depth differ. This is why a developer does not necessarily need to pass CKA before CKAD.<\/p>\n The current CKS guide covers Cluster Setup (10%), Cluster Hardening (15%), System Hardening (15%), Minimizing Microservice Vulnerabilities (20%), Supply Chain Security (20%), and Monitoring, Logging and Runtime Security (20%). These areas require practical understanding of workload permissions, admission policy, image origins, network controls and the evidence needed to investigate suspicious activity. They are not all solved by adding one security-scanning tool to a pipeline.<\/p>\n A safe CKS-oriented exercise might deploy a test Pod with unnecessary privileges and replace it with a suitably restricted configuration. Another could use a supported NetworkPolicy to allow a single application flow while denying another. A third could inspect an image’s build provenance or configure an admission control that rejects an unapproved workload. The Kubernetes workload protection concepts<\/a> provide context for evaluating whether a measure genuinely works; current Kubernetes documentation should govern the particular policy or API selected.<\/p>\n Certifications do not eliminate a security engineer’s responsibility to understand incident response, authorization and data protection. For example, Kubernetes RBAC permissions govern API actions, while an application may still expose private information through its own code. A Secret object is not a complete secret-management design, and a network policy needs an enforcing network plugin. Study why each boundary exists and test both an allowed and denied operation.<\/p>\n The best starting sources are the current CNCF exam pages, open-source curriculum outlines, the Linux Foundation Candidate Handbook and official Kubernetes task documentation. The issuer provides links to scheduling, exam policies and the available testing environment. Those details can change as Kubernetes updates, so a fixed screenshot in a 2024 article should not override the latest official instructions. For the current mainstream cluster project, Kubernetes lists 1.37, 1.36 and 1.35 as maintained branches in November 2026; exam environment versions are governed separately by the Linux Foundation.<\/p>\n A local or disposable cloud practice cluster can teach most foundational tasks. Choose a test environment whose cost and resources are manageable. Minikube, kind and other local solutions may work for application exercises, while selected cluster-administration tasks require an environment that exposes sufficient control-plane or node access. Do not assume every managed service will allow low-level administration. Document which tasks you cannot perform in the chosen lab and find an authorized environment or simulation for those gaps.<\/p>\nRead CKA’s current five domains as work you must perform<\/h2>\n
Use CKAD’s five domains to structure an application project<\/h2>\n
Treat CKS as applied security, not a vocabulary test<\/h2>\n
Set up practical study resources without relying on shortcuts<\/h2>\n