CNCF runs five Kubernetes certifications, and they split into two very different kinds of exam. KCNA and KCSA are 90-minute multiple-choice tests of what you understand about Kubernetes and its security model. CKA, CKAD and CKS put you in front of live clusters for two hours and grade what you build and fix. So where should you start? If you are planning all five for the Kubestronaut title, the order matters more than most guides admit, because every certificate earned today expires after two years and the renewal rules reward one sequence over the others.
We took every number in this comparison from the Linux Foundation product pages, the candidate handbook and the official curriculum files. We also checked the curriculum PDFs against the READMEs in the same repository, and they disagree for two of the exams. You will find the side-by-side table first, then KCNA vs CKA and where KCSA fits, the order we would take all five in, and what the full path costs.
Checked against the Linux Foundation and CNCF pages in October 2026; prices and renewal rules are as published that week.
1. Compare the five Kubernetes certifications side by side
The split that decides almost everything is format. The two associate exams are multiple choice and check what you know. The three professional exams are performance-based and check what you can do at a terminal, which is why they cost more, run longer and pass at a lower score:
| KCNA | KCSA | CKA | CKAD | CKS | |
|---|---|---|---|---|---|
| Format | Multiple choice | Multiple choice | Hands-on tasks | Hands-on tasks | Hands-on tasks |
| Length | 90 minutes, 60 questions | 90 minutes, 60 questions | 2 hours | 2 hours | 2 hours |
| Pass mark | 75% | 75% | 66% | 66% | 67% |
| Exam price | $250 | $250 | $445 | $445 | $445 |
| Prerequisite | None | None | None | None | A passed CKA |
| Practice simulator | None | None | killer.sh | killer.sh | killer.sh |
| Validity | 2 years | 2 years | 2 years | 2 years | 2 years |
| Kubernetes version | Not stated | Not stated | v1.37 | v1.37 | v1.35 |
The pass marks look backwards until you remember what is being graded. A 75% bar on recall questions is easier to plan for than 66% on live tasks, where the clock decides how many you finish. The CKA, CKAD and CKS candidate instructions put each hands-on exam at 15 to 20 tasks, so every task carries real weight. The simulator row matters just as much for preparation. A standard exam purchase includes one retake and 12 months to sit it, but only the professional exams come with killer.sh, so for KCNA and KCSA your practice questions have to come from somewhere else. The version row has a quirk of its own: CKS runs on Kubernetes v1.35 according to its product page, even though its curriculum PDF is still labelled v1.34. That gap in practice material is the reason we wrote our own free KCNA practice questions, each one with a written explanation.
One trap if you study straight from GitHub: the READMEs added to the cncf/curriculum repository in November 2025 list different domain weights for KCSA and CKS than the official PDFs sitting next to them. The Linux Foundation product pages match the PDF weights, so we treat the PDFs as the source for domains. For KCSA the README lists different domain names as well as different weights, while the PDF’s six domains run 14, 22, 22, 16, 16 and 10 percent. For CKS the names match but two weights are swapped, and the PDF gives Cluster Setup 15% and System Hardening 10%.
2. KCNA vs CKA: decide which comes first
Start with KCNA if Kubernetes is still new to you, or if your work touches the wider cloud native stack more than the cluster itself. Since the November 2025 update it has four domains: Kubernetes Fundamentals at 44%, Container Orchestration at 28%, Cloud Native Application Delivery at 16% and Cloud Native Architecture at 12%. The questions ask which object, component, project or command fits a situation, so you are tested on judgement across the whole ecosystem rather than on typing speed.
CKA asks you to do that work instead of choosing it from a list. Its curriculum gives 30% of the score to troubleshooting and 25% to cluster architecture, installation and configuration. Services and networking take 20%, workloads and scheduling 15% and storage 10%, and all of it happens in a terminal against the clock. KCNA also spends far more time than CKA on the ecosystem around the cluster, which is why we would not call it a watered-down CKA. In our question bank that means topics such as:
- Prometheus, OpenTelemetry and the observability signals
- GitOps principles, Argo CD and Flux
- Progressive delivery with tools such as Argo Rollouts
- CNCF governance and project maturity levels
- Serverless and service mesh projects
Do not read “associate” as “easy” either. A candidate who already held three cloud certifications posted on r/KubernetesCerts in April 2026 that KCNA was harder than a typical cloud practitioner exam, and advised studying how the components interact rather than memorising definitions. If you already run clusters at work and have no interest in Kubestronaut, go straight to CKA and spend the KCNA study time inside a kubeadm lab cluster instead.
3. Add KCSA if security is your lane
KCSA uses the same format, price and pass mark as KCNA, but every one of its six domains is about security. Kubernetes Cluster Component Security and Kubernetes Security Fundamentals carry 22% each, the Kubernetes Threat Model and Platform Security 16% each, the Overview of Cloud Native Security 14% and Compliance and Security Frameworks 10%. Our KCNA questions on the Security competency already cover RBAC, ServiceAccounts, Pod Security Admission and how Secrets are stored, so the first half of KCSA will feel familiar if you studied for KCNA properly.
The second half is new ground. Threat modelling, supply chain security, admission control, PKI and compliance frameworks get far more attention than anything in KCNA, and they overlap heavily with what CKS later tests hands-on, supply chain security above all. If you want a head start on the practical side, our guides to Kubernetes RBAC and ServiceAccounts and Pod Security Standards cover the controls both exams keep returning to.
4. Pick CKA or CKAD for hands-on work
Choose CKA if you run clusters and CKAD if you ship applications onto them. The two share a lot of kubectl, but the weighting tells you who each exam is for. CKAD gives 25% to application environment, configuration and security, 20% each to design and build, deployment, and services and networking, and 15% to observability and maintenance. You will not install or upgrade a cluster on CKAD, and you will spend far more time on Deployments, probes, ConfigMaps and multi-container Pods.
CKA has one advantage that matters if you plan to keep going: it is the only prerequisite in the whole family, because CKS requires a passed CKA before you can sit it. Whichever you pick, the skill that pays off on both is fast, accurate kubectl, and our kubectl cheat sheet is built around the commands those two exams lean on.
5. Plan the Kubestronaut order around CARE renewals
Kubestronaut requires all five certifications to be current at the same time, and with a two-year validity that used to mean racing the clock on the first one you passed. The Linux Foundation’s CARE program, in effect since January 1, 2026, changes the maths. Passing or recertifying CKA or CKAD renews your KCNA, and passing or recertifying CKS renews KCSA, CKA and KCNA in one step. It even reinstates a certificate that has already expired, as long as you passed it at some point. That makes the order we would take them in fairly clear:
- KCNA, to learn the vocabulary of the whole ecosystem
- CKA, the gate for CKS
- KCSA, as the theory half of CKS
- CKAD, close to CKS because nothing renews it
- CKS, last, so it renews three of the other four
The point of that order is that CKS resets three of your five clocks on the day you pass it. CKAD is the only one of the other four that a CKS pass does not renew, so taking it just before CKS lines its two-year clock up with the rest. The CNCF Kubestronaut FAQ says the title lasts until the end of the year in which your first certificate expires, so keeping it later comes down to recertifying CKS and CKAD each cycle. The CKA part of the cascade also only works forward, because CARE renews a CKA only when the CKS was earned or recertified on or after June 18, 2026, and a CKS passed before that date does not count.
6. Price the full path
Bought one at a time, the five exams cost $1,835 at list price: $250 each for KCNA and KCSA and $445 each for CKA, CKAD and CKS. The Kubestronaut bundle sells all five for $1,645, which saves $190, and the KCNA plus CKA bundle costs $645 against $695 bought separately. Each standard exam purchase includes one retake and 12 months to schedule and sit it, so check how the bundle applies that window before you buy five exams on one day.
List price is rarely what people pay. The Linux Foundation runs regular promotions, and on the day we checked the site was advertising up to 40% off for Cybersecurity Awareness Month. The banner said “up to”, so check which products a sale actually covers, but if your timeline can wait a few weeks, buying in one is the easiest saving on the whole path. If you want a book alongside the practice questions, our roundup of the best Kubernetes certification books covers the study guides worth buying for each exam.
Common misconceptions about Kubernetes certifications
A few beliefs keep coming up in study groups that the official pages do not support:
- KCNA is not required for CKA. Only CKS has a prerequisite, a passed CKA.
- KCNA has no separate Observability domain any more. It moved under Cloud Native Architecture in November 2025.
- An expired KCNA is not a dead end. CARE reinstates it when you pass CKA, CKAD or CKS.
- Kubestronaut is not about passing all five quickly. What counts is that all five are current on the day you qualify.
That last point is where CARE earns its keep. CNCF says every required certification must be unexpired when you are recognised as a Kubestronaut or a Golden Kubestronaut, and only the Golden title is then yours for life. One CKS pass can bring three lapsed certificates back to current within a few business days. When you are ready to start on the first exam, the KCNA study guide maps every domain to the guides and practice sets on this site.
