Best Kubernetes certification: CKA vs CKAD vs CKS

For most people the best first Kubernetes certification is the CKA (Certified Kubernetes Administrator) if you run clusters, or the CKAD (Certified Kubernetes Application Developer) if you deploy applications onto them. The CKS (Certified Kubernetes Security Specialist) comes after the CKA, because you have to pass the CKA first. All three cost 445 USD each as of October 2026.

This guide compares the three exams fact by fact, covers the two entry-level exams (KCNA and KCSA) for people who aren't ready for a hands-on test, explains how they differ, and recommends an order by role. It also covers what they really cost, including the free retake and practice simulator that come with each one. Every fact was checked on the Linux Foundation's certification pages and FAQ on October 21, 2026.

How Kubernetes certifications are organised

The Linux Foundation and the CNCF run five Kubernetes certifications, in two kinds:

Hands-on exams: CKA, CKAD and CKS. Two hours at a live command line, solving tasks on real clusters. 445 USD each.
Multiple-choice exams: KCNA (Kubernetes and Cloud Native Associate) and KCSA (Kubernetes and Cloud Native Security Associate). 90 minutes, entry level, 250 USD each.

All five are taken online with a remote proctor (the hands-on three run on PSI's exam platform), and all five are valid for two years. A CKA or CKAD earned before April 1, 2024 kept the old three-year validity. To renew, you pass the exam again, which gives you two more years from the date you pass. Anyone who holds all five and keeps them current is called a Kubestronaut.

The cloud providers test their managed Kubernetes services inside their own certifications: EKS is in scope for AWS's CloudOps Engineer exam, AKS for Microsoft's AI-200, and GKE Autopilot for Google's Associate Cloud Engineer. For a vendor-neutral Kubernetes credential, these five are the ones to look at.

CKA: Certified Kubernetes Administrator

Who it's for: people who install, configure and manage production Kubernetes clusters.
Prerequisites: none.
Format: two hours, performance-based, with 15 to 20 tasks on a command line, as of October 2026.
Passing score: 66%.
Kubernetes version: the CKA page says the exam is based on Kubernetes v1.37. The Linux Foundation moves exams to a new minor version within about four to eight weeks of its release.
Price: 445 USD, including one free retake and two killer.sh simulator sessions.
Validity: two years.
Domains: troubleshooting (30%), cluster architecture, installation and configuration (25%), services and networking (20%), workloads and scheduling (15%), and storage (10%).

Troubleshooting is the largest domain, so you need to be quick at reading events and logs. This practice question on a pod stuck in Pending shows the kind of scheduler message you'll have to decode. Cluster upgrades are the other classic task, as in this practice question on upgrading kubeadm worker nodes. The CKA practice test covers all five domains.

CKAD: Certified Kubernetes Application Developer

Who it's for: developers who design, build, configure and expose applications on Kubernetes.
Prerequisites: none.
Format: two hours, performance-based, with 15 to 20 tasks on a command line, as of October 2026.
Passing score: 66%.
Kubernetes version: v1.37, according to the CKAD page.
Price: 445 USD, including one free retake and two killer.sh simulator sessions.
Validity: two years.
Domains: application environment, configuration and security (25%), application design and build (20%), application deployment (20%), services and networking (20%), and application observability and maintenance (15%).

CKAD questions are about getting an application to run well: probes, resources, rollouts and Services. This practice question on a startup probe for a slow-starting app and this practice question on a Service with no endpoints are typical. Try the full CKAD practice test as well. The guide to Kubernetes Service types covers an area both the CKA and CKAD test.

CKS: Certified Kubernetes Security Specialist

Who it's for: people who secure container applications and Kubernetes platforms.
Prerequisites: you must pass the CKA first. The Linux Foundation's pages say you must have "taken and passed" the CKA, while kubernetes.io says you must "hold a current" CKA, so plan to sit the CKS while your CKA is still valid.
Format: two hours, performance-based, as of October 2026. The task count isn't stated.
Passing score: 67%.
Kubernetes version: the CKS page says v1.35.
Price: 445 USD, including one free retake and two killer.sh simulator sessions.
Validity: two years.
Domains: minimising microservice vulnerabilities (20%), supply chain security (20%), monitoring, logging and runtime security (20%), cluster setup (15%), cluster hardening (15%), and system hardening (10%).

The CKS builds on the CKA, which it requires, and asks you to lock a cluster down: Pod Security Admission, RBAC, Secrets encryption, audit logging and image policy. This practice question on Pod Security Admission covers a behaviour that surprises many people, and this practice question on encrypting Secrets at rest covers another. The CKS practice test has the full set, and the guide to Kubernetes network policies covers a topic that appears in both CKA and CKS.

KCNA and KCSA: the entry-level exams

KCNA and KCSA are multiple-choice, 90 minutes, 250 USD each, and valid for two years, with no prerequisites and one free retake.

KCNA covers Kubernetes fundamentals (44%), container orchestration (28%), cloud native application delivery (16%) and cloud native architecture (12%).
KCSA covers cluster component security and Kubernetes security fundamentals (22% each), the threat model and platform security (16% each), cloud native security (14%), and compliance and frameworks (10%).

They make sense if you're new to Kubernetes and want a structured first step, or if your role needs the concepts without the command line, such as a manager, a pre-sales engineer or a security analyst. If you already use kubectl at work, skip them and go straight to the CKA or CKAD.

How CKA, CKAD and CKS differ

Focus: the CKA runs the cluster. The CKAD runs applications on the cluster. The CKS secures both.
Prerequisite: the CKA and CKAD have none. The CKS needs a pass on the CKA.
Biggest domain: for the CKA it's troubleshooting (30%). For the CKAD it's application environment, configuration and security (25%). For the CKS, three domains tie at 20%: microservice vulnerabilities, supply chain, and runtime security.
Passing score: the CKA and CKAD need 66%. The CKS needs 67%.
Kubernetes version (as of October 2026): the CKA and CKAD test v1.37. The CKS tests v1.35.
Price and format: the same for all three: 445 USD, two hours, hands-on, one retake and two simulator sessions.

Which Kubernetes certification should you take first

Platform, DevOps or SRE engineer: the CKA first. It covers the cluster from the inside, and it unlocks the CKS.
Application developer: the CKAD first. It matches what you do and is narrower than the CKA. Add the CKA later if you start running clusters.
Security engineer: the CKA, then the CKS. There's no shortcut, since the CKS requires the CKA. If you need something sooner, the KCSA is multiple-choice and has no prerequisite.
New to Kubernetes: the KCNA, or skip straight to the CKAD after some hands-on practice. The CKAD's scope is smaller than the CKA's, which makes it a gentler first hands-on exam.
Aiming for Kubestronaut: the KCNA and KCSA early, the CKAD and CKA next, and the CKS last.

Whichever you pick, plan the CKS while your CKA is still valid. The Linux Foundation's FAQ adds a bonus: if you earn or recertify the CKS on or after June 18, 2026, your CKA's expiry date is extended to match the new CKS expiry.

Kubernetes certification cost and preparation

As of October 2026, the Linux Foundation's list prices are:

CKA, CKAD or CKS: 445 USD each, exam only.
KCNA or KCSA: 250 USD each.
CKA, CKAD or CKS with a course: 645 USD (CKA with LFS258, CKAD with LFD259, CKS with LFS260).
Kubestronaut bundle: all five exams for 1,645 USD. The three hands-on exams bought separately come to 1,335 USD.

The Linux Foundation lists prices in US dollars only. Its pages often show sale banners (such as "save up to 40%"), but the terms aren't stated as a standing discount, so check the price on the day you buy.

Each purchase includes more than the exam:

One free retake. The Linux Foundation counts it as two attempts. You must take the exam within 12 months of buying it.
Two killer.sh simulator sessions for the CKA, CKAD and CKS: 36 hours each from activation, with 17 graded questions in a realistic environment. These aren't included in the "-SINGLE" registrations.
Results by email within 24 hours.

A few exam-day rules catch people out: one monitor only, no virtual machines, no other apps or browser windows, a private quiet room, your camera on throughout, and an original government photo ID whose name exactly matches your registration.

To prepare, read the curriculum for your exam's Kubernetes version in the CNCF curriculum repository on GitHub, then practise against a real cluster until the common tasks are muscle memory. Use the killer.sh sessions late in your preparation, as a timed rehearsal. For quick self-checks between lab sessions, the practice questions here cover all three exams: see the CKA question list, the CKAD question list and the CKS question list.

Frequently asked questions

Which Kubernetes certification should I get first?

The CKA if you run clusters or want the CKS later, the CKAD if you're a developer. Choose the KCNA only if you want a multiple-choice introduction first.

How much does Kubernetes certification cost?

As of October 2026: 445 USD each for the CKA, CKAD and CKS, and 250 USD each for the KCNA and KCSA. Each includes one free retake. The five-exam Kubestronaut bundle is 1,645 USD.

Is the CKA harder than the CKAD?

The CKA covers more ground: cluster architecture, installation and upgrades, plus troubleshooting, its largest domain. The CKAD is narrower and focuses on applications. Both are two-hour hands-on exams with a 66% passing score, so the difficulty depends on what you do day to day.

Do I need the CKA before the CKS?

Yes. The Linux Foundation requires you to pass the CKA before you can take the CKS, and kubernetes.io describes it as holding a current CKA. Take the CKS while your CKA is still valid.

How long are Kubernetes certifications valid?

Two years for certifications earned since April 1, 2024. A CKA or CKAD earned before that date is valid for three years. You renew by passing the exam again.

Is a Kubernetes certification worth it?

It's worth it if Kubernetes is part of your job or the job you want. The hands-on format means passing proves you can do the work, not just recognise the terms, and the included retake and simulator sessions lower the risk of paying twice.