At a mid-size SaaS company in 2023, the platform team needed two Kubernetes certifications — one for the developer who owned microservice deployments and one for the infrastructure engineer who managed the cluster. They bought both exams under a group discount and each person passed their respective certification on the first attempt. The developer's CKAD preparation took 9 weeks. The infrastructure engineer's CKA preparation took 11 weeks. When each candidate later studied for the other exam, both passed in 5 weeks — because the core kubectl fluency and mental model of Kubernetes transferred directly. The story illustrates the key insight: the two exams share enough foundation that passing one makes the other significantly more approachable, but they test genuinely different roles.
CKAD is for the developer who needs to deploy and configure applications on Kubernetes. CKA is for the engineer who needs to install, configure, and maintain the Kubernetes cluster itself. Both cost $395, both run for 2 hours in a live terminal, and both use the same performance-based format. The content overlap is about 20-25% — similar enough that passing one makes passing the other easier, different enough that they're not redundant.
What each exam actually tests
The clearest way to understand the difference is to look at who would need the skills each exam certifies.
A CKAD candidate is typically a software developer, DevOps engineer, or platform engineer who deploys applications to Kubernetes clusters they didn't build. They need to know how to write pod specs, configure liveness and readiness probes, manage ConfigMaps and Secrets, define resource requests and limits, set up services and ingress, and handle multi-container pod patterns.
A CKA candidate is typically an infrastructure engineer, SRE, or platform engineer who maintains the Kubernetes cluster itself. They need to know how to install clusters with kubeadm, back up and restore etcd, perform rolling upgrades, configure RBAC, troubleshoot broken nodes and failing schedulers, and manage persistent storage.
The practical test: if your job title contains "developer" or "software engineer" and you work with Kubernetes without administering the cluster, CKAD maps to your work. If your job title contains "infrastructure," "SRE," "platform engineer," or "DevOps" and you manage Kubernetes as infrastructure, CKA maps to your work.
Domain weights comparison
CKAD domain weights
| Domain | Weight |
|---|---|
| Application Design and Build | 20% |
| Application Deployment | 20% |
| Application Observability and Maintenance | 15% |
| Application Environment, Configuration and Security | 25% |
| Services and Networking | 20% |
CKA domain weights
| Domain | Weight |
|---|---|
| Storage | 10% |
| Troubleshooting | 30% |
| Workloads and Scheduling | 15% |
| Cluster Architecture, Installation and Configuration | 25% |
| Services and Networking | 20% |
The overlapping domain is Services and Networking (20% on both exams). Both exams test Services, Endpoints, and basic NetworkPolicies. The CKAD goes deeper on Ingress rules and application-layer network policy configuration. The CKA goes deeper on CNI plugins, CoreDNS troubleshooting, and diagnosing cluster networking failures.
CKA's Troubleshooting domain at 30% is the single largest domain of either exam. It tests diagnosing and fixing broken clusters — a skill set that requires deep knowledge of how every Kubernetes component works and can fail.
Specific kubectl commands each exam requires
kubectl commands CKAD tests most
The CKAD is fundamentally a YAML generation and editing exam. You write pod specs, deployment manifests, and service definitions against a running cluster. Commands you must know cold:
kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml > pod.yaml
kubectl create deployment web --image=nginx --replicas=3 --dry-run=client -o yaml
kubectl expose deployment web --port=80 --type=ClusterIP
kubectl create configmap app-config --from-literal=env=production
kubectl create secret generic db-secret --from-literal=password=secret123
kubectl set image deployment/web nginx=nginx:1.21
kubectl rollout status deployment/web
kubectl rollout undo deployment/web
kubectl exec -it pod-name -- /bin/sh
kubectl cp pod-name:/var/log/app.log ./app.log
The --dry-run=client -o yaml pattern is fundamental to CKAD speed. Generating YAML with that flag and editing the output is faster than writing manifests from scratch.
What CKAD probes section tests
The Application Observability and Maintenance domain (15%) includes a subsection specifically on health probe configuration. All three probe types appear on the exam:
Liveness probe — determines if the container is running. If it fails, the kubelet kills and restarts the container.
Readiness probe — determines if the container is ready to receive traffic. If it fails, the container is removed from Service endpoints but not restarted.
Startup probe — determines if the application has started. Useful for slow-starting applications — while startup probe is active, liveness and readiness probes are disabled, preventing premature restarts.
The CKAD tests the YAML syntax for each probe type:
livenessProbe:
httpGet:
path: /healthz
port: 8080
initialDelaySeconds: 10
periodSeconds: 5
failureThreshold: 3
readinessProbe:
exec:
command:
- cat
- /tmp/ready
initialDelaySeconds: 5
periodSeconds: 3
startupProbe:
httpGet:
path: /startup
port: 8080
failureThreshold: 30
periodSeconds: 10
Knowing which probe type solves a described symptom is the exam skill: containers restarting when they're under load but healthy? That's a liveness probe configured too aggressively. Traffic hitting pods that aren't ready? That's a missing readiness probe. Containers killed before a slow application finishes initializing? That's a missing startup probe.
kubectl commands CKA tests most
CKA troubleshooting requires commands that diagnose cluster-level failures, not just application-level issues:
kubectl get nodes -o wide
kubectl describe node node01
kubectl get pods -A --field-selector=status.phase=Failed
kubectl get events --sort-by='.lastTimestamp' -n default
kubectl logs -n kube-system kube-apiserver-controlplane
kubectl logs -n kube-system etcd-controlplane
systemctl status kubelet
journalctl -u kubelet -n 50
cat /etc/kubernetes/manifests/kube-apiserver.yaml
The journalctl -u kubelet command is essential for diagnosing kubelet failures. When a node reports NotReady, the troubleshooting sequence is: check kubectl describe node, then SSH to the node and check systemctl status kubelet, then read journalctl -u kubelet for the error. The most common CKA troubleshooting scenarios involve kubelet failing because a configuration file was changed or the --config flag points to a non-existent path.
CKA troubleshooting: NotReady node diagnosis
The CKA's 30% Troubleshooting domain requires diagnosing nodes in NotReady state. The diagnostic sequence:
kubectl describe node <nodename>— look for the condition that's False or UnknownSSH to the node
systemctl status kubelet— check if kubelet is runningIf kubelet is stopped:
journalctl -u kubelet -n 100— read the last 100 lines for error messagesCommon causes: kubelet config error, wrong
--cluster-dns, container runtime not running, network plugin missing
The etcd backup process appears on most CKA exams and must be practiced until automatic:
ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db \
--endpoints=https://127.0.0.1:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key
Developer vs infrastructure engineer: the decision
The job-function question is the primary determinant of which exam to take first.
Take CKAD first if:
Your primary role involves writing application code or deployment manifests
You work with Kubernetes day-to-day but someone else manages the cluster
Your employer requires or values CKAD for a developer role
You want a faster path to Kubernetes credentialing (CKAD content is more familiar to developers)
You're targeting roles like software engineer, application developer, or platform developer
Take CKA first if:
Your primary role involves infrastructure management, SRE, or platform engineering
You're responsible for cluster health and maintenance
Your organization needs someone to manage Kubernetes clusters, not just deploy to them
You're targeting roles like SRE, infrastructure engineer, platform engineer, or DevOps engineer managing infrastructure
Take both (the order question):
Community consensus is CKAD first, then CKA — because CKAD teaches Kubernetes application fundamentals that help contextualize CKA's cluster management
The counterargument: CKA first, then CKAD — because understanding cluster architecture helps debug application issues faster
In practice, people report slightly higher pass rates when doing CKAD first, possibly because the content is more accessible to the developer-heavy pool of Kubernetes candidates
Most candidates who've passed CKAD report needing about 4-6 additional weeks of targeted study for CKA, compared to 8-12 weeks if coming in cold.
Preparation resources comparison: KodeKloud vs killer.sh vs Killercoda
Three platforms dominate CKAD and CKA preparation, each serving a different purpose:
KodeKloud (kodekloud.com): Mumshad Mannambeth's courses are the most recommended starting point on Reddit and YouTube for both exams. The CKAD and CKA courses include practice labs embedded alongside video content. Cost is approximately $20/month for an individual subscription or $100-150 for standalone course purchases. KodeKloud labs replicate the exam environment closely and include mock exams at the end of each course. Start here if you're new to Kubernetes.
killer.sh (killer.sh): Both CKAD and CKA exam purchases include two killer.sh sessions, each available for 36 hours once activated. killer.sh questions are intentionally harder than the actual exam by design. Use this 1-2 weeks before your exam, not at the start of preparation.
"The killer.sh simulator is almost universally considered harder than the actual exam, which is by design. If you can complete 65% of killer.sh tasks, you're probably ready for the real exam. If you're struggling with killer.sh, you need more practice time." — James Strong, CNCF ambassador and Kubernetes instructor
Killercoda (killercoda.com): A free browser-based Kubernetes environment where the community shares scenario-based labs. Useful for additional hands-on practice between KodeKloud and killer.sh. The CKAD and CKA scenarios from the community are specifically designed to match exam task types.
The optimal preparation sequence:
KodeKloud course (6-8 weeks of daily practice for new Kubernetes learners, 4-5 weeks for those with some experience)
Killercoda scenarios for additional targeted practice
killer.sh sessions in the final 1-2 weeks before the exam
Preparation overlap: what studying for one gives you for the other
If you've studied for and passed CKAD, here's what you already have for CKA:
Services and Networking (20% of CKA — direct overlap)
Pod creation and management (part of Workloads and Scheduling)
RBAC basics (ServiceAccounts, basic Role and RoleBinding usage)
kubectlcommand fluency and the--dry-run=client -o yamlpattern
What you still need for CKA after CKAD:
etcdbackup and restorekubeadmcluster installation and upgrade step sequenceNode troubleshooting (kubelet, container runtime failures)
Cluster networking troubleshooting (CNI, CoreDNS)
Persistent volumes and storage class configuration
Comprehensive RBAC (ClusterRole, ClusterRoleBinding, permission boundaries across namespaces)
Cost and practical exam logistics
Both exams cost $395 at list price and include one free retake. The Linux Foundation runs occasional promotions (Black Friday, Kubernetes Birthday in late June) that reduce this to $295-$335.
A numbered checklist for exam day preparation:
Test your PSI browser 24 hours before the exam
Close all other applications and browser tabs before starting
Set up your workspace with adequate lighting for the webcam
Have your government ID ready for identity verification
Configure terminal aliases at the start of the exam:
alias k=kubectlandexport do="--dry-run=client -o yaml"Check your cluster contexts at the start:
kubectl config get-contextsVerify your context before every task:
kubectl config current-context
The context-switching step is critical for CKA specifically. Each task specifies which cluster to use, and forgetting to switch contexts is one of the most common causes of task failure on CKA.
Which exam is harder: community consensus
CKA has harder content — cluster installation, etcd operations, and troubleshooting broken clusters require deeper infrastructure knowledge
CKAD has more YAML to memorize — probe syntax, init containers, sidecar patterns, and the variety of application configuration options require broader manifest knowledge
Both have the same time pressure — 2 hours, approximately 15-17 tasks, performance-based format
The real difficulty factor is your background: developers find CKAD easier, ops engineers find CKA easier. Both require substantial hands-on practice regardless of background. Community surveys on Reddit and LinkedIn suggest similar first-attempt pass rates (65-70% for both) among candidates who've studied properly.
See also: CKA exam guide: the kubectl commands you must know cold, CKS Certified Kubernetes Security Specialist: hardest k8s cert explained
References
Linux Foundation. (2024). CKAD Exam Curriculum. https://github.com/cncf/curriculum
Linux Foundation. (2024). CKA Exam Curriculum. https://github.com/cncf/curriculum
Kubernetes. (2024). kubectl Reference Documentation. https://kubernetes.io/docs/reference/kubectl/
Mannambeth, M. (2023). Certified Kubernetes Application Developer (CKAD) with Tests. Kodekloud. https://kodekloud.com/courses/certified-kubernetes-application-developer-ckad/
Killer.sh. (2024). CKA/CKAD Exam Simulator. https://killer.sh
Burns, B., Beda, J., Hightower, K., & Tregenza Seabird, L. (2022). Kubernetes: Up and Running, 3rd Edition. O'Reilly Media. ISBN: 978-1098110208
Frequently Asked Questions
What is the difference between CKA and CKAD?
CKA (Certified Kubernetes Administrator) tests cluster management skills: kubeadm installation, etcd backup/restore, node maintenance, RBAC administration, and troubleshooting. CKAD (Certified Kubernetes Application Developer) tests application deployment skills: pod specs, deployments, services, ConfigMaps, probes, and resource management. CKA targets infrastructure engineers; CKAD targets developers and DevOps engineers.
Should I take CKA or CKAD first?
Community consensus slightly favors CKAD first because application deployment fundamentals are more accessible for the developer-heavy Kubernetes community and provide context for CKA's cluster management content. Developers typically find CKAD easier; infrastructure engineers typically find CKA easier. Your background should be the primary decision factor.
Does passing CKAD help with CKA?
Yes. The Services and Networking domain (20%) overlaps directly between both exams. CKAD also builds kubectl command fluency and YAML writing habits that accelerate CKA preparation. Most CKAD holders report needing only 4-6 additional weeks of targeted study for CKA, compared to 8-12 weeks for candidates with no Kubernetes certification background.
What is killer.sh and how should I use it?
Killer.sh is a Kubernetes exam simulator included with CKA and CKAD purchases, providing two 36-hour sessions in an environment that mirrors the actual PSI exam interface. The questions are intentionally harder than the real exam. Use it 1-2 weeks before your exam date, not at the start of preparation — both sessions are activated by you, so save them for when you're nearly ready.
How much does the CKA or CKAD exam cost?
Both CKA and CKAD cost \(395 at list price and include one free retake plus two killer.sh simulator sessions. The Linux Foundation runs periodic promotions during Kubernetes Birthday, KubeCon, and Black Friday that reduce the price to \)295-$335. Exam bundles (CKA + CKAD together) are sometimes available at a discount.