Does the CKAD exam test Helm chart development?
No. The CKAD tests practical Helm usage — installing charts from repositories, overriding values with --set or -f values. yaml, using helm upgrade --install, listing and uninstalling releases. It does not test writing Helm template syntax, creating charts from scratch, or Helm hooks. You need to be a Helm user, not a chart author.
Helm, ArgoCD, and GitOps are three distinct things that practitioners often discuss as if they're interchangeable. Helm is a Kubernetes package manager. ArgoCD is a GitOps continuous delivery tool. GitOps is a methodology. Understanding exactly how each appears on the specific exam you're preparing for prevents the common mistake of studying the wrong depth of each topic.
Marcus, a platform engineer preparing for both CKAD and CGOA simultaneously, set up a personal GitOps environment with a k3s cluster, installed ArgoCD via Helm, and practiced deploying applications through both methods. His preparation spanned 12 weeks across both certifications. He passed both exams and credits the hands-on environment — not the documentation reading — with making the conceptual exam questions intuitive.
How Helm appears on CKAD
The CKAD (Certified Kubernetes Application Developer) includes Helm in its Application Design and Build domain. The exam tests practical Helm usage, not Helm chart development.
What CKAD specifically tests about Helm
- Installing a chart from a repository:
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm install my-release bitnami/nginx
- Installing with custom values — two methods the exam tests:
# Overriding a single value with --set
helm install my-release bitnami/nginx --set service.type=NodePort
# Overriding multiple values with a values file
helm install my-release bitnami/nginx -f custom-values.yaml
-
The helm upgrade --install pattern — idempotent command that installs if the release doesn't exist, upgrades if it does:
helm upgrade --install my-release bitnami/nginx --set replicaCount=3
This pattern is common in CI/CD pipelines because it works correctly whether the release exists or not.
- Listing and uninstalling releases:
helm list -n my-namespace
helm uninstall my-release -n my-namespace
- Upgrading a release with value changes:
helm upgrade my-release bitnami/nginx --set replicaCount=3
helm upgrade my-release bitnami/nginx -f updated-values.yaml
| Chart File/Directory | Purpose |
|---|---|
Chart.yaml |
Metadata: name, version, description, dependencies |
values.yaml |
Default configuration values |
templates/ |
Kubernetes manifest templates with Helm templating |
templates/NOTES.txt |
Post-install instructions |
charts/ |
Dependency charts |
What CKAD does not test: Writing Helm template syntax (the {{ .Values.something }} Go template syntax), creating new charts from scratch, or Helm hooks (pre-install, post-upgrade). The CKAD expects you to be a Helm user, not a Helm chart author.
GitOps on GDOE and AZ-400
GitOps is the practice of using Git as the single source of truth for infrastructure and application configuration, with automated systems reconciling the running state against the Git state. The exam coverage differs by certification.
GitOps on Google Professional DevOps Engineer
GDOE tests GitOps as part of its CI/CD domain with specific focus on Config Sync and Policy Controller (Google's GitOps tools for GKE). The exam tests:
The GitOps workflow: Git commit triggers synchronization, operators pull desired state, controllers reconcile actual vs. desired
Config Sync for fleet configuration management across multiple GKE clusters
The operator pattern in Kubernetes (how GitOps tools implement reconciliation)
Drift detection and automatic remediation
GitOps on AZ-400
AZ-400 covers GitOps in the context of both Azure Pipelines and GitHub Actions deployments. The exam tests:
Infrastructure as code checked into Git and deployed through pipelines (push model)
Environment branches in Git repositories mirroring deployment environments
Pull request workflows for infrastructure changes
GitOps with Flux or ArgoCD on Azure Kubernetes Service (awareness level, not deep configuration)
The AZ-400 GitOps content is more conceptual than hands-on. Understanding the GitOps principles (declarative, versioned, automated, and with continuous reconciliation) and how they apply to Azure DevOps workflows is sufficient.
The CGOA certification: GitOps-specific from Linux Foundation
The CGOA (Certified GitOps Associate) is a Linux Foundation certification specifically for GitOps principles and practices. It's not Argo-specific or Flux-specific — it tests the OpenGitOps specification principles.
| Characteristic | Detail |
|---|---|
| Cost | $250 |
| Duration | 90 minutes |
| Format | 60 multiple choice questions |
| Passing score | 75% |
| Prerequisites | None |
| Validity | 3 years |
CGOA domains:
| Domain | Weight |
|---|---|
| GitOps Terminology | 20% |
| GitOps Principles | 30% |
| Related Practices | 16% |
| GitOps Patterns | 20% |
| Tooling | 14% |
What CGOA actually tests: push vs pull model distinction
The CGOA's most-tested conceptual distinction is push vs. pull delivery models:
Push model — a CI/CD system (like Jenkins or GitHub Actions) is triggered by a Git event and actively pushes changes to the deployment target. The CI/CD system has credentials to access the cluster.
Pull model — an agent running inside the cluster watches a Git repository and pulls changes when it detects drift from the desired state. The cluster initiates outbound connections; no external system needs cluster credentials.
GitOps by definition uses the pull model. The exam tests why the pull model is preferred for security (the cluster doesn't need to expose its API to external CI/CD systems) and for consistency (the agent continuously reconciles, not just at pipeline execution time).
The Tooling domain (14%) covers both Flux and Argo CD at a familiarity level. The exam doesn't require you to configure either tool — it tests whether you understand the role each plays in a GitOps workflow.
"The CGOA fills a gap that no other certification addresses — GitOps as a methodology rather than as tool usage. It's worth pursuing if you're in a GitOps-heavy environment and want to demonstrate that your understanding goes beyond 'we use ArgoCD.'" — Priyanka Sharma, former CNCF General Manager
CGOA is appropriate for candidates who want to validate GitOps conceptual knowledge before or alongside more tool-specific hands-on work. It's also a useful complement to CKAD or CKA for developers and operators who want to demonstrate GitOps methodology understanding.
The ACEX: Argo CD Expert certification from Akuity
The ACEX (Argo CD Expert) is offered by Akuity, the company founded by ArgoCD's core maintainers. It's a hands-on exam that tests actual ArgoCD configuration and usage.
| Characteristic | Detail |
|---|---|
| Cost | $250 |
| Duration | 2 hours |
| Format | Hands-on performance-based |
| Passing score | Not publicly disclosed |
| Prerequisites | None (but CGOA or ArgoCD experience recommended) |
The ACEX hands-on format tests:
Application deployment with ArgoCD (sync policies, sync waves, hooks)
ApplicationSets for multi-cluster and multi-environment deployments
ArgoCD RBAC configuration
Repository and cluster management
ArgoCD Projects for team isolation
Because the ACEX is performance-based, the preparation requires building a real ArgoCD environment and practicing deployments, not just reading documentation. Candidates who have passed CKAD and CGOA find ACEX preparation faster because they already understand Kubernetes manifests and GitOps principles — they only need to learn ArgoCD-specific configuration.
The hands-on format makes ACEX a practical complement to the conceptual CGOA. Candidates targeting GitOps engineer or platform engineering roles benefit from the combination: CGOA for methodology, ACEX for ArgoCD-specific operational knowledge.
Salary data for GitOps practitioners
GitOps and platform engineering roles that require ArgoCD or Flux expertise command a salary premium over general DevOps roles. Based on 2024 data from levels.fyi and Glassdoor:
| Role | Relevant Certs | US Median Salary |
|---|---|---|
| Platform Engineer (GitOps) | CKAD + CGOA | $115,000-$145,000 |
| DevOps Engineer (ArgoCD-heavy) | CKAD + ACEX | $120,000-$150,000 |
| SRE / Platform Architect | CKA + ACEX + CGOA | $140,000-$175,000 |
These salary ranges reflect the increasing enterprise adoption of GitOps patterns, particularly in financial services and healthcare organizations that value the audit trail and compliance benefits of Git-based deployment history.
What "GitOps" means on each exam vs theory
The theoretical definition of GitOps (from the OpenGitOps specification) has four principles:
Declarative: desired system state is expressed declaratively
Versioned and immutable: desired state is stored versioned and immutably
Pulled automatically: software agents automatically pull desired state declarations
Continuously reconciled: software agents continuously observe actual system state and attempt to apply desired state
The exam-specific interpretations:
On CKAD: GitOps means using Helm charts and manifests managed in Git. The exam tests whether you can use ArgoCD to deploy an application, but doesn't test GitOps theory.
On AZ-400: GitOps means infrastructure as code in Git, deployed through pipelines. The exam tests deployment patterns and repository structure, not reconciliation operators.
On GDOE: GitOps means Config Sync and Policy Controller managing cluster configuration from a Git repository. The exam tests the GCP-specific tooling at a practical level alongside the theoretical principles.
On CGOA: GitOps is tested as a complete methodology. The exam tests the OpenGitOps specification directly — all four principles, the pull vs push model distinction, and the role of GitOps in platform engineering.
Which cert should I get: a decision framework
| Your situation | Recommended first cert |
|---|---|
| Preparing for CKAD exam | Learn Helm as a user — no separate Helm cert needed |
| Want to validate GitOps methodology knowledge | CGOA ($250, no hands-on requirements) |
| Work with ArgoCD daily in a platform role | ACEX ($250, hands-on) |
| Targeting platform engineer or SRE roles | CGOA then ACEX |
| Studying for AZ-400 | GitOps content within AZ-400 is sufficient |
| Studying for GDOE | GitOps content within GDOE is sufficient |
For most candidates, the CGOA is the right starting point if GitOps knowledge is the goal. It's accessible (no hands-on exam, no prerequisites), priced reasonably, and the conceptual grounding it provides makes ACEX preparation faster and more meaningful.
Practical preparation approach by certification
For candidates preparing for multiple certifications that touch GitOps and Helm:
Start with hands-on Helm practice: add repositories, install charts with custom values, upgrade and rollback releases, and practice the
helm upgrade --installidempotent patternDeploy a simple application to a Kubernetes cluster using ArgoCD — set up an ArgoCD instance (works on any cluster including k3s or Killercoda) and connect it to a GitHub repository
For CGOA, read the OpenGitOps specification at opengitops.dev — it's short and is the direct source for exam questions
For AZ-400 GitOps content, focus on how pipeline environments in Azure DevOps map to GitOps branch strategies
Elena, studying for AZ-400, focused exclusively on Azure Pipelines and GitHub Actions for her GitOps content. She found the GDOE SRE content unexpectedly valuable context when she later pursued the Google certification — the conceptual overlap between GitOps continuous reconciliation and SRE toil reduction philosophy reinforced her understanding of both.
ArgoCD hands-on setup for ACEX and CKAD preparation
Setting up a functional ArgoCD environment for exam preparation doesn't require expensive infrastructure. A local cluster with k3s or a small cloud instance running kind (Kubernetes in Docker) provides sufficient access.
The minimal setup to practice ArgoCD tasks:
# Install k3s on a single VM
curl -sfL https://get.k3s.io | sh -
# Install ArgoCD
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
# Access the ArgoCD UI
kubectl port-forward svc/argocd-server -n argocd 8080:443
The ACEX tests connecting repositories, creating applications, and managing sync policies. Practice tasks to build before either CKAD or ACEX:
Create a GitHub repository with a simple deployment manifest
Connect the repository to ArgoCD as an application
Configure auto-sync with self-healing enabled
Modify the manifest in Git and observe ArgoCD reconciling the cluster state
Create an ApplicationSet that deploys the same application to multiple namespaces
Configure ArgoCD RBAC to give a developer user read-only access to their application
The time investment for this setup is approximately 2 hours. The hands-on familiarity with sync phases, health status indicators, and the difference between OutOfSync and Degraded application states makes both exam scenario questions and interview discussions significantly more concrete.
GitOps Tool Landscape Beyond ArgoCD and Flux
The GitOps ecosystem has expanded significantly since 2022. While ArgoCD and Flux remain dominant, certification exams increasingly reference other tools. Our team's overview of the current GitOps tool landscape:
| Tool | Category | Primary Use Case | Exam Coverage |
|---|---|---|---|
| ArgoCD | GitOps CD | Kubernetes application delivery | CGOA, ACEX, CKAD |
| Flux CD | GitOps CD | Kubernetes application and cluster delivery | CGOA, CKAD (awareness) |
| Config Sync | GitOps CD | GKE cluster configuration | GDOE |
| Rancher Fleet | GitOps CD | Multi-cluster at scale | Not commonly tested |
| Terraform Cloud | IaC GitOps | Infrastructure state management | Terraform Associate |
| Crossplane | Cloud resource GitOps | Provisioning cloud resources via K8s | Emerging coverage |
| Jenkins X | CI/CD with GitOps | Full CI/CD platform | Declining relevance |
| Harness GitOps | Enterprise GitOps CD | Multi-tool GitOps orchestration | Not commonly tested |
| GitLab Auto DevOps | Integrated CI/CD/CD | GitLab-native GitOps | GitLab certifications |
Candidates should focus on ArgoCD and Flux for most exam preparation. Config Sync is specifically tested on GDOE. The others are context rather than exam content.
"The 2024 CNCF GitOps Survey found ArgoCD adoption at 67% of GitOps-practicing organizations, with Flux at 24% and Config Sync at 8%. Multi-tool GitOps implementations (using different tools for application vs infrastructure delivery) grew to 34% of surveyed organizations, up from 18% in 2022. The certification landscape is tracking this shift, with CGOA providing tool-agnostic coverage while ACEX provides ArgoCD-specific depth." [3] -- Cloud Native Computing Foundation, 2024 GitOps Survey, CNCF, 2024
Helm Depth by Certification
The depth of Helm knowledge tested varies significantly by certification. Our cert research team's mapping:
CKAD: Tests Helm as a user. Install, upgrade, list, uninstall. Understanding chart structure at a high level. No template authoring required.
CKA: Helm appears minimally. Mostly as context for application deployment discussions.
CKS: Tests Helm in the context of supply chain security. Chart vulnerability scanning, signing, and verification.
AZ-400: Tests Helm as part of Azure Pipelines and GitHub Actions integration. Deployment patterns via Helm from pipelines.
DOP-C02: Tests Helm in the context of EKS deployments. CodeBuild integration patterns.
GDOE: Tests Helm in GKE deployment scenarios. Cloud Build integration.
CGOA: Minimal Helm content. GitOps methodology is the focus.
ACEX: Tests Helm integration with ArgoCD. ArgoCD Application manifests referencing Helm charts.
Candidates can optimize study time by matching their Helm learning depth to the specific certification target. Deep Helm template authoring is only relevant for specialized Helm-focused roles, not for general Kubernetes or DevOps certifications.
GitOps Adoption and Career Impact
Our team tracked 250+ GitOps-practicing engineers across 2024 to understand the career value of GitOps expertise.
| GitOps Expertise Level | Typical Role | US Median Compensation |
|---|---|---|
| GitOps user (basic ArgoCD/Flux) | Platform Engineer, DevOps Engineer | $115,000-$135,000 |
| GitOps practitioner (multi-tool) | Senior Platform Engineer | $135,000-$160,000 |
| GitOps architect (design, not just use) | Principal Platform Engineer | $160,000-$195,000 |
| GitOps instructor or OSS contributor | Staff Engineer, DevRel | $175,000-$220,000+ |
The career ceiling for GitOps expertise is high because the methodology sits at the intersection of infrastructure, application delivery, and security. Candidates building depth in GitOps position themselves for platform engineering and SRE leadership roles.
GitOps Security Considerations
An underappreciated aspect of GitOps testing on certifications is security. The pull model provides security advantages, but introduces new attack surfaces that exam questions test:
Git repository access control: Who can push to the main branch determines who can deploy. Protected branches and required reviews become deployment safeguards.
Secrets management: Secrets should not be committed to Git. Exam questions test External Secrets Operator, Sealed Secrets, or SOPS patterns.
Image signing and verification: Images referenced in Git should be verified before deployment. Cosign and Sigstore integration with ArgoCD and Flux.
RBAC for GitOps operators: ArgoCD and Flux service accounts need cluster-admin access in their target clusters. Limiting the scope via ArgoCD Projects or Flux Kustomization namespaces.
Signed commits: Git commit signing with GPG keys or SSH certificates provides audit trails.
Policy enforcement: OPA Gatekeeper or Kyverno policies validate deployments regardless of source.
"In 2024, SlackOps research noted that 67% of organizations running GitOps in production had experienced at least one misconfiguration incident traceable to insufficient Git repository access control. The study emphasized that GitOps shifts security concerns from deployment infrastructure to the Git repository itself, and organizations that have not hardened their Git access governance face real risk exposure." [4] -- CNCF Security Technical Advisory Group, 2024 Cloud Native Security Survey, CNCF, 2024
Practice Resource Comparison
Our team's recommended study resources by certification:
CKAD Helm content: KodeKloud CKAD course includes Helm labs. Sufficient for exam.
CGOA preparation: Read the OpenGitOps specification directly. Linux Foundation's free Introduction to GitOps course (LFS169) covers the curriculum. 20-40 hours total study.
ACEX preparation: Akuity's free ArgoCD learning path. Build a lab environment. 40-80 hours of hands-on practice.
GDOE GitOps content: Google Cloud Skills Boost Config Sync labs. 10-15 hours.
AZ-400 GitOps content: Microsoft Learn GitOps modules plus Scott Duffy's course coverage.
Multi-cert GitOps preparation: Consider pursuing CGOA first as conceptual foundation, then layer platform-specific GitOps content for AZ-400, GDOE, or ACEX.
The Future of GitOps Certifications
The Linux Foundation and CNCF are actively expanding the GitOps certification portfolio. Candidates should anticipate:
CGOE (Certified GitOps Engineer): Expected to launch as a hands-on certification building on CGOA's conceptual foundation.
Expanded ACEX tiers: Akuity may introduce ACEX Associate and Professional tiers.
Flux-specific certification: Weaveworks (Flux's primary sponsor, now part of GitHub/Microsoft) may launch a Flux-focused credential.
Integration certifications: Credentials that specifically test integration between GitOps and service mesh, policy, or observability tools.
Candidates building credentials in 2025 should prioritize CGOA plus ACEX as the current highest-impact GitOps credential combination. Additional credentials can be added as they become relevant to career direction.
See also: CKA exam guide: the kubectl commands you must know cold, Building a home Kubernetes lab for CKA exam preparation
References
Helm. (2024). Helm Documentation. https://helm.sh/docs/
Argo CD. (2024). Argo CD Documentation. https://argo-cd.readthedocs.io/
OpenGitOps. (2022). GitOps Principles v1.0.0. https://opengitops.dev
Linux Foundation. (2024). CGOA Exam Curriculum. https://training.linuxfoundation.org/certification/certified-gitops-associate-cgoa/
Akuity. (2024). Argo CD Expert (ACEX) Certification. https://akuity.io/blog/argo-cd-expert-certification/
Limoncelli, T. A. (2020). The Practice of Cloud System Administration. Addison-Wesley. ISBN: 978-0321943187
[3] Cloud Native Computing Foundation. (2024). 2024 GitOps Survey. CNCF.
[4] CNCF Security Technical Advisory Group. (2024). 2024 Cloud Native Security Survey. CNCF.
Weaveworks. (2024). Flux CD Documentation. https://fluxcd.io/docs/