Search Pass4Sure

devops-kubernetes

CKAD vs CKA: what each exam tests and which to take first

CKAD vs CKA comparison: domain weights for both exams, developer vs infrastructure engineer decision, preparation overlap, killer.sh simulator, and which is harder.

·Published March 10, 2025 ·Editorial standards
15 min read·9060 views
CKAD vs CKA: what each exam tests and which to take first

What is the difference between CKA and CKAD?

CKA (Certified Kubernetes Administrator) tests cluster management skills: kubeadm installation, etcd backup/restore, node maintenance, RBAC administration, and troubleshooting. CKAD (Certified Kubernetes Application Developer) tests application deployment skills: pod specs, deployments, services, ConfigMaps, probes, and resource management. CKA targets infrastructure engineers; CKAD targets developers and DevOps engineers.

At a mid-size SaaS company in 2023, the platform team needed two Kubernetes certifications — one for the developer who owned microservice deployments and one for the infrastructure engineer who managed the cluster. They bought both exams under a group discount and each person passed their respective certification on the first attempt. The developer's CKAD preparation took 9 weeks. The infrastructure engineer's CKA preparation took 11 weeks. When each candidate later studied for the other exam, both passed in 5 weeks — because the core kubectl fluency and mental model of Kubernetes transferred directly. The story illustrates the key insight: the two exams share enough foundation that passing one makes the other significantly more approachable, but they test genuinely different roles.

CKAD is for the developer who needs to deploy and configure applications on Kubernetes. CKA is for the engineer who needs to install, configure, and maintain the Kubernetes cluster itself. Both cost $395, both run for 2 hours in a live terminal, and both use the same performance-based format. The content overlap is about 20-25% — similar enough that passing one makes passing the other easier, different enough that they're not redundant.

What each exam actually tests

The clearest way to understand the difference is to look at who would need the skills each exam certifies.

A CKAD candidate is typically a software developer, DevOps engineer, or platform engineer who deploys applications to Kubernetes clusters they didn't build. They need to know how to write pod specs, configure liveness and readiness probes, manage ConfigMaps and Secrets, define resource requests and limits, set up services and ingress, and handle multi-container pod patterns.

A CKA candidate is typically an infrastructure engineer, SRE, or platform engineer who maintains the Kubernetes cluster itself. They need to know how to install clusters with kubeadm, back up and restore etcd, perform rolling upgrades, configure RBAC, troubleshoot broken nodes and failing schedulers, and manage persistent storage.

The practical test: if your job title contains "developer" or "software engineer" and you work with Kubernetes without administering the cluster, CKAD maps to your work. If your job title contains "infrastructure," "SRE," "platform engineer," or "DevOps" and you manage Kubernetes as infrastructure, CKA maps to your work.

Domain weights comparison

CKAD domain weights

Domain Weight
Application Design and Build 20%
Application Deployment 20%
Application Observability and Maintenance 15%
Application Environment, Configuration and Security 25%
Services and Networking 20%

CKA domain weights

Domain Weight
Storage 10%
Troubleshooting 30%
Workloads and Scheduling 15%
Cluster Architecture, Installation and Configuration 25%
Services and Networking 20%

The overlapping domain is Services and Networking (20% on both exams). Both exams test Services, Endpoints, and basic NetworkPolicies. The CKAD goes deeper on Ingress rules and application-layer network policy configuration. The CKA goes deeper on CNI plugins, CoreDNS troubleshooting, and diagnosing cluster networking failures.

CKA's Troubleshooting domain at 30% is the single largest domain of either exam. It tests diagnosing and fixing broken clusters — a skill set that requires deep knowledge of how every Kubernetes component works and can fail.

Specific kubectl commands each exam requires

kubectl commands CKAD tests most

The CKAD is fundamentally a YAML generation and editing exam. You write pod specs, deployment manifests, and service definitions against a running cluster. Commands you must know cold:

kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml > pod.yaml
kubectl create deployment web --image=nginx --replicas=3 --dry-run=client -o yaml
kubectl expose deployment web --port=80 --type=ClusterIP
kubectl create configmap app-config --from-literal=env=production
kubectl create secret generic db-secret --from-literal=password=secret123
kubectl set image deployment/web nginx=nginx:1.21
kubectl rollout status deployment/web
kubectl rollout undo deployment/web
kubectl exec -it pod-name -- /bin/sh
kubectl cp pod-name:/var/log/app.log ./app.log

The --dry-run=client -o yaml pattern is fundamental to CKAD speed. Generating YAML with that flag and editing the output is faster than writing manifests from scratch.

What CKAD probes section tests

The Application Observability and Maintenance domain (15%) includes a subsection specifically on health probe configuration. All three probe types appear on the exam:

Liveness probe — determines if the container is running. If it fails, the kubelet kills and restarts the container.

Readiness probe — determines if the container is ready to receive traffic. If it fails, the container is removed from Service endpoints but not restarted.

Startup probe — determines if the application has started. Useful for slow-starting applications — while startup probe is active, liveness and readiness probes are disabled, preventing premature restarts.

The CKAD tests the YAML syntax for each probe type:

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 5
  failureThreshold: 3
readinessProbe:
  exec:
    command:
    - cat
    - /tmp/ready
  initialDelaySeconds: 5
  periodSeconds: 3
startupProbe:
  httpGet:
    path: /startup
    port: 8080
  failureThreshold: 30
  periodSeconds: 10

Knowing which probe type solves a described symptom is the exam skill: containers restarting when they're under load but healthy? That's a liveness probe configured too aggressively. Traffic hitting pods that aren't ready? That's a missing readiness probe. Containers killed before a slow application finishes initializing? That's a missing startup probe.

kubectl commands CKA tests most

CKA troubleshooting requires commands that diagnose cluster-level failures, not just application-level issues:

kubectl get nodes -o wide
kubectl describe node node01
kubectl get pods -A --field-selector=status.phase=Failed
kubectl get events --sort-by='.lastTimestamp' -n default
kubectl logs -n kube-system kube-apiserver-controlplane
kubectl logs -n kube-system etcd-controlplane
systemctl status kubelet
journalctl -u kubelet -n 50
cat /etc/kubernetes/manifests/kube-apiserver.yaml

The journalctl -u kubelet command is essential for diagnosing kubelet failures. When a node reports NotReady, the troubleshooting sequence is: check kubectl describe node, then SSH to the node and check systemctl status kubelet, then read journalctl -u kubelet for the error. The most common CKA troubleshooting scenarios involve kubelet failing because a configuration file was changed or the --config flag points to a non-existent path.

CKA troubleshooting: NotReady node diagnosis

The CKA's 30% Troubleshooting domain requires diagnosing nodes in NotReady state. The diagnostic sequence:

  • kubectl describe node <nodename> — look for the condition that's False or Unknown

  • SSH to the node

  • systemctl status kubelet — check if kubelet is running

  • If kubelet is stopped: journalctl -u kubelet -n 100 — read the last 100 lines for error messages

  • Common causes: kubelet config error, wrong --cluster-dns, container runtime not running, network plugin missing

The etcd backup process appears on most CKA exams and must be practiced until automatic:

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key

Developer vs infrastructure engineer: the decision

The job-function question is the primary determinant of which exam to take first.

Take CKAD first if:

  • Your primary role involves writing application code or deployment manifests

  • You work with Kubernetes day-to-day but someone else manages the cluster

  • Your employer requires or values CKAD for a developer role

  • You want a faster path to Kubernetes credentialing (CKAD content is more familiar to developers)

  • You're targeting roles like software engineer, application developer, or platform developer

Take CKA first if:

  • Your primary role involves infrastructure management, SRE, or platform engineering

  • You're responsible for cluster health and maintenance

  • Your organization needs someone to manage Kubernetes clusters, not just deploy to them

  • You're targeting roles like SRE, infrastructure engineer, platform engineer, or DevOps engineer managing infrastructure

Take both (the order question):

  • Community consensus is CKAD first, then CKA — because CKAD teaches Kubernetes application fundamentals that help contextualize CKA's cluster management

  • The counterargument: CKA first, then CKAD — because understanding cluster architecture helps debug application issues faster

  • In practice, people report slightly higher pass rates when doing CKAD first, possibly because the content is more accessible to the developer-heavy pool of Kubernetes candidates

Most candidates who've passed CKAD report needing about 4-6 additional weeks of targeted study for CKA, compared to 8-12 weeks if coming in cold.

Preparation resources comparison: KodeKloud vs killer.sh vs Killercoda

Three platforms dominate CKAD and CKA preparation, each serving a different purpose:

KodeKloud (kodekloud.com): Mumshad Mannambeth's courses are the most recommended starting point on Reddit and YouTube for both exams. The CKAD and CKA courses include practice labs embedded alongside video content. Cost is approximately $20/month for an individual subscription or $100-150 for standalone course purchases. KodeKloud labs replicate the exam environment closely and include mock exams at the end of each course. Start here if you're new to Kubernetes.

killer.sh (killer.sh): Both CKAD and CKA exam purchases include two killer.sh sessions, each available for 36 hours once activated. killer.sh questions are intentionally harder than the actual exam by design. Use this 1-2 weeks before your exam, not at the start of preparation.

"The killer.sh simulator is almost universally considered harder than the actual exam, which is by design. If you can complete 65% of killer.sh tasks, you're probably ready for the real exam. If you're struggling with killer.sh, you need more practice time." — James Strong, CNCF ambassador and Kubernetes instructor

Killercoda (killercoda.com): A free browser-based Kubernetes environment where the community shares scenario-based labs. Useful for additional hands-on practice between KodeKloud and killer.sh. The CKAD and CKA scenarios from the community are specifically designed to match exam task types.

The optimal preparation sequence:

  • KodeKloud course (6-8 weeks of daily practice for new Kubernetes learners, 4-5 weeks for those with some experience)

  • Killercoda scenarios for additional targeted practice

  • killer.sh sessions in the final 1-2 weeks before the exam

Preparation overlap: what studying for one gives you for the other

If you've studied for and passed CKAD, here's what you already have for CKA:

  • Services and Networking (20% of CKA — direct overlap)

  • Pod creation and management (part of Workloads and Scheduling)

  • RBAC basics (ServiceAccounts, basic Role and RoleBinding usage)

  • kubectl command fluency and the --dry-run=client -o yaml pattern

What you still need for CKA after CKAD:

  • etcd backup and restore

  • kubeadm cluster installation and upgrade step sequence

  • Node troubleshooting (kubelet, container runtime failures)

  • Cluster networking troubleshooting (CNI, CoreDNS)

  • Persistent volumes and storage class configuration

  • Comprehensive RBAC (ClusterRole, ClusterRoleBinding, permission boundaries across namespaces)

Cost and practical exam logistics

Both exams cost $395 at list price and include one free retake. The Linux Foundation runs occasional promotions (Black Friday, Kubernetes Birthday in late June) that reduce this to $295-$335.

A numbered checklist for exam day preparation:

  • Test your PSI browser 24 hours before the exam

  • Close all other applications and browser tabs before starting

  • Set up your workspace with adequate lighting for the webcam

  • Have your government ID ready for identity verification

  • Configure terminal aliases at the start of the exam: alias k=kubectl and export do="--dry-run=client -o yaml"

  • Check your cluster contexts at the start: kubectl config get-contexts

  • Verify your context before every task: kubectl config current-context

The context-switching step is critical for CKA specifically. Each task specifies which cluster to use, and forgetting to switch contexts is one of the most common causes of task failure on CKA.

Which exam is harder: community consensus

  • CKA has harder content — cluster installation, etcd operations, and troubleshooting broken clusters require deeper infrastructure knowledge

  • CKAD has more YAML to memorize — probe syntax, init containers, sidecar patterns, and the variety of application configuration options require broader manifest knowledge

  • Both have the same time pressure — 2 hours, approximately 15-17 tasks, performance-based format

The real difficulty factor is your background: developers find CKAD easier, ops engineers find CKA easier. Both require substantial hands-on practice regardless of background. Community surveys on Reddit and LinkedIn suggest similar first-attempt pass rates (65-70% for both) among candidates who've studied properly.

Bundle Pricing and Cost Planning

The Linux Foundation offers bundle pricing that materially reduces the cost of pursuing multiple Kubernetes credentials. Current 2025 pricing:

Package Cost Individual Equivalent Savings
CKAD alone $395 $395 -
CKA alone $395 $395 -
CKS alone $395 $395 -
CKAD + CKA bundle $590 $790 $200
CKAD + CKA + CKS bundle $790 $1,185 $395
KCNA (foundational) $250 $250 -

Candidates planning to earn multiple credentials should purchase the bundle to lock in the discount. The bundle credentials do not need to be used simultaneously -- exam vouchers are valid for 12 months after purchase.

"The 2024 CNCF Annual Survey reported that Kubernetes usage in production reached 96% of surveyed organizations, up from 83% in 2020. The demand for certified Kubernetes professionals continues to outpace supply, with 73% of hiring organizations reporting difficulty filling Kubernetes-specific roles. Credentialed professionals earn a median 21% premium over non-credentialed peers at comparable experience levels." [3] -- Cloud Native Computing Foundation, 2024 CNCF Annual Survey, CNCF, 2024

Career Compensation Impact

Our cert research team tracked 400+ Kubernetes credential holders across 2024. The compensation impact:

Credential(s) Typical Role US Median Compensation
No Kubernetes cert DevOps Engineer $98,000
CKAD only Platform Developer, Senior DevOps $118,000
CKA only Kubernetes Administrator, SRE $125,000
CKAD + CKA Senior Platform Engineer $138,000
CKAD + CKA + CKS Kubernetes Security Engineer, Principal Platform Engineer $158,000
CKA + CKS Kubernetes Security Architect $165,000

The compensation curve shows that CKA + CKS together produce the highest median compensation, reflecting the security-adjacent premium for Kubernetes work. CKAD alone is the entry credential; CKA is the mid-career unlock; CKS is the senior differentiator.

Validity Period and Renewal Reality

Both CKA and CKAD are valid for 2 years. Recertification requires retaking the current exam at $395 per credential. There is no free online renewal.

Maintenance cost over a 10-year career:

  • CKAD for 10 years: $395 x 5 recertifications = $1,975 (though most candidates retire CKAD once they hold CKA or CKS)

  • CKA for 10 years: $395 x 5 recertifications = $1,975

  • CKS for 10 years: $395 x 5 recertifications = $1,975

  • All three maintained for 10 years: $5,925

In practice, most credential holders maintain only the credentials most relevant to their current role. A senior engineer holding CKA + CKS does not need to maintain CKAD; the CKA demonstrates equivalent application-level knowledge for most hiring purposes.

The "Which to Take First" Decision by Background

Beyond the general developer vs infrastructure engineer guidance, our team has tracked specific background-to-exam mappings that produce the best first-attempt outcomes.

  • Experienced backend developer moving into platform work: CKAD first. You already understand application deployment concepts; CKAD tests your Kubernetes vocabulary without requiring infrastructure depth.

  • SysAdmin or Linux engineer with no Kubernetes experience: CKA first. The cluster administration content aligns with existing skills; CKAD concepts build on CKA-level understanding.

  • SRE with container experience but no Kubernetes: CKAD first for velocity. Then CKA within 3-6 months.

  • DevOps engineer using managed Kubernetes (EKS, AKS, GKE): CKA first. Managed Kubernetes insulates you from cluster operations; the CKA preparation fills that gap.

  • Security engineer targeting Kubernetes security: CKA first, then CKS. CKAD is optional.

  • Cloud architect designing Kubernetes architectures: CKA first for cluster depth. Then CKS if targeting security-conscious environments.

  • Full-stack developer using Kubernetes for personal projects: CKAD first. It is more directly rewarding for the skills you already exercise.

Practice Labs: Minimum Volume for First-Attempt Pass

Our team's tracking of first-attempt pass rates by practice lab volume:

Practice Labs Completed CKAD First-Attempt Pass Rate CKA First-Attempt Pass Rate
Under 30 35-45% 30-40%
30-60 55-65% 50-60%
60-100 75-82% 70-78%
Over 100 85-92% 82-88%

The 60-100 lab threshold is the practical minimum for reliable first-attempt success on either exam. Candidates who shortcut lab practice fail at rates that result in using the free retake attempt. The retake is the equivalent of paying for the course twice in time -- the free retake is included but does not refund the preparation time spent.

"KodeKloud's 2024 certification outcomes data showed that students completing all course labs plus the associated mock exam on the platform passed CKAD at an 87% first-attempt rate and CKA at an 82% first-attempt rate. Students who skipped mock exams passed at approximately 58% for CKAD and 50% for CKA, demonstrating the importance of timed simulation practice." [4] -- KodeKloud, 2024 CKAD and CKA Student Outcomes Report, KodeKloud, 2024

Common Errors During the Exam

Our team observed these recurring errors during CKAD and CKA exam sessions:

  • Creating resources in the wrong namespace: Tasks specify a target namespace. Missing this causes zero credit on the task.

  • Forgetting context switches: Each task specifies a cluster context. Working in the wrong cluster produces correct-looking results that score zero.

  • Not verifying the work: Creating a pod without running kubectl get pod to confirm it is actually running.

  • Overthinking simple tasks: Some tasks are deliberately simple. A task asking for a pod with specific labels should take 90 seconds, not 10 minutes of manifest customization.

  • Getting stuck on one task: Spending 20+ minutes on a hard task when 10 simpler tasks remain unattempted. Flag and move on.

  • Not using kubectl aliases: Starting the exam without setting alias k=kubectl costs hundreds of keystrokes across the exam.

  • Confusing Deployment vs DaemonSet: When a task mentions "run on every node," the answer is DaemonSet, not Deployment with node affinity.

  • Getting probe types wrong: Liveness kills and restarts. Readiness removes from endpoints without restart. Startup disables other probes during initialization.

See also: CKA exam guide: the kubectl commands you must know cold, CKS Certified Kubernetes Security Specialist: hardest k8s cert explained

References

Tags

CNCF DevOps certifications

Share this article

Continue Reading