The three Cloud Native Computing Foundation (CNCF) Kubernetes certifications (CKA, CKAD, and CKS) sit at the center of container-native engineering careers. They cost $395 each, they are all performance-based with real terminal access to live clusters, and they collectively signal the strongest Kubernetes credibility an engineer can put on a resume. The question for most candidates is sequence, not choice. Each cert has a narrow role fit, and the right first pick depends on whether the candidate's daily work is administrative, developer-facing, or security-focused.
This guide breaks down CKA (Certified Kubernetes Administrator), CKAD (Certified Kubernetes Application Developer), and CKS (Certified Kubernetes Security Specialist) on exam structure, preparation time, and career progression, and provides a sequencing matrix tied to target role.
Side by Side Comparison
| Attribute | CKA | CKAD | CKS |
|---|---|---|---|
| Full name | Certified Kubernetes Administrator | Certified Kubernetes Application Developer | Certified Kubernetes Security Specialist |
| Issuer | CNCF via Linux Foundation | CNCF via Linux Foundation | CNCF via Linux Foundation |
| Exam fee (2026) | $395 USD (includes 1 retake) | $395 USD (includes 1 retake) | $395 USD (includes 1 retake) |
| Duration | 2 hours | 2 hours | 2 hours |
| Format | Performance-based, real CLI | Performance-based, real CLI | Performance-based, real CLI |
| Passing score | 66% | 66% | 67% |
| Prerequisite | None | None | CKA (must be active) |
| Validity | 2 years | 2 years | 2 years |
| Retake window | 1 year from original purchase | 1 year from original purchase | 1 year from original purchase |
| K8s version tested | v1.29+ (rolling) | v1.29+ (rolling) | v1.29+ (rolling) |
The \(395 fee includes a single retake within 12 months, which effectively caps the cost at \)395 per credential unless the candidate fails twice. Community pass rates make a retake a real possibility, especially for CKA first-timers.
What Each Exam Tests
CKA Domains
| Domain | Weight |
|---|---|
| Cluster Architecture, Installation and Configuration | 25% |
| Workloads and Scheduling | 15% |
| Services and Networking | 20% |
| Storage | 10% |
| Troubleshooting | 30% |
CKA is the admin cert. Candidates configure clusters, manage nodes, troubleshoot scheduling, configure networking, and debug failed components. The 30 percent troubleshooting weight reflects the cert's operational tone.
CKAD Domains
| Domain | Weight |
|---|---|
| Application Design and Build | 20% |
| Application Deployment | 20% |
| Application Observability and Maintenance | 15% |
| Application Environment, Configuration and Security | 25% |
| Services and Networking | 20% |
CKAD is the developer cert. Candidates build container images (conceptually), write YAML manifests, configure deployments and pods, work with ConfigMaps and Secrets, and set up ingress, services, and network policies. Less cluster admin, more workload authoring.
CKS Domains
| Domain | Weight |
|---|---|
| Cluster Setup | 10% |
| Cluster Hardening | 15% |
| System Hardening | 15% |
| Minimize Microservice Vulnerabilities | 20% |
| Supply Chain Security | 20% |
| Monitoring, Logging, and Runtime Security | 20% |
CKS is the security cert. It assumes CKA fluency and goes deep on RBAC, admission controllers, network policies, pod security, image signing, runtime security with Falco, and supply chain verification. CKS requires an active CKA to register.
Performance Based Format Reality
All three exams use live terminal access to real Kubernetes clusters. Candidates run kubectl, edit YAML with vim or nano, use kubectl apply, kubectl exec, kubectl logs, and troubleshoot failing resources. There are no multiple choice questions. Partial credit is awarded on multi-step tasks.
Time pressure is the primary challenge. 2 hours to complete 15 to 20 tasks means candidates average 6 to 8 minutes per task. Tasks vary from 2-point quick fixes to 13-point multi-step debugging scenarios. Candidates who waste time on low-point tasks or who cannot type fast in vim struggle regardless of conceptual knowledge.
"Kubernetes certs are typing speed certs as much as they are Kubernetes certs. Practice kubectl and vim until they are automatic. Everything else follows." Sander van Vugt, Linux and Kubernetes trainer
Preparation Time
CKA Prep
- 10 to 14 weeks at 10 hours per week for candidates with Docker and Linux experience
- 14 to 20 weeks for candidates new to containers
- Core resource: Killer.sh simulator (included with $395 purchase), two sessions of 36 hours access each
Study stack: Mumshad Mannambeth's CKA course on KodeKloud, Sander van Vugt's video course, official Kubernetes docs (allowed during exam), kubectl practice on minikube or kind locally.
CKAD Prep
- 6 to 10 weeks at 10 hours per week for candidates with CKA or container experience
- 10 to 14 weeks for pure beginners
Study stack: Mumshad Mannambeth's CKAD course on KodeKloud, Ricardo Katz's practice tasks, kubectl imperative commands reference, the official Kubernetes API reference.
CKS Prep
- 8 to 12 weeks at 10 hours per week (CKA required and assumed)
- Walid Shaari's CKS course is widely recommended
- Falco documentation, OPA Gatekeeper reference, Trivy image scanning
CKS requires CKA and adds distinct security tooling. Candidates cannot skip to CKS. The registration system blocks it.
Difficulty Reality
Community pass rates from Reddit r/kubernetes and CKAD/CKA Slack communities:
| Attempt | CKA | CKAD | CKS |
|---|---|---|---|
| First attempt pass rate | ~50% | ~60% | ~55% |
| Second attempt (included) | ~80% | ~85% | ~80% |
| Common failure | Time management | YAML typo on multi-point task | Missing a hardening step |
All three are hard. CKA has the lowest first-attempt rate because it is the first exposure to the performance-based format for most candidates. CKAD is slightly more forgiving because the tasks are smaller and more focused. CKS is hard because it layers security depth on top of CKA-level fluency.
Salary Data for Kubernetes Engineers (2026)
Data from Levels.fyi, Dice, and Glassdoor:
| Role | No CNCF cert | CKA only | CKA + CKAD | CKA + CKAD + CKS |
|---|---|---|---|---|
| DevOps engineer (mid) | \(115,000-\)145,000 | \(125,000-\)158,000 | \(135,000-\)170,000 | \(145,000-\)185,000 |
| SRE (mid) | \(130,000-\)160,000 | \(140,000-\)175,000 | \(150,000-\)190,000 | \(165,000-\)210,000 |
| Platform engineer | \(140,000-\)175,000 | \(155,000-\)195,000 | \(165,000-\)210,000 | \(180,000-\)230,000 |
| Senior K8s engineer | \(170,000-\)210,000 | \(180,000-\)225,000 | \(195,000-\)245,000 | \(215,000-\)275,000 |
| K8s security specialist | N/A | N/A | N/A | \(185,000-\)245,000 |
The trio (CKA + CKAD + CKS) produces meaningful salary uplift. CKS alone commands the strongest premium because the security specialist role has the scarcest talent pool.
"CKS holders are the rarest of the three. The market assigns a premium to the scarcity. If you already have CKA and can afford 12 more weeks, CKS pays for itself within 6 months of the cert." Adrian Cantrill, cloud training instructor
Decision Matrix
Take CKA First If
- Your daily role is SRE, DevOps, platform engineering, or cluster administration
- You configure nodes, manage cluster upgrades, and debug scheduling issues
- You want the foundation that unlocks CKS later
- You plan to pursue the full CNCF trio
Take CKAD First If
- Your daily role is application development deploying to Kubernetes
- You write deployment manifests, configure services, and manage ConfigMaps
- You do not manage clusters (platform team handles that)
- You want the fastest Kubernetes credential path (CKAD has smaller admin surface)
Take CKS Third If
- You already hold an active CKA
- Your target role is Kubernetes security specialist or platform security engineer
- You work with admission controllers, RBAC, and runtime security tools
- You can afford 8 to 12 weeks of additional prep after CKA
Career Progression
Platform Engineer Path
- CKA (foundation)
- CKAD (dev-facing context)
- CKS (security layer)
- Cloud Native specialty (service mesh, GitOps, observability)
SRE Path
- CKA (foundation)
- CKS (security because SRE owns incident response)
- CKAD (optional, for dev empathy)
Security-First Path
- CKA (required for CKS)
- CKS (target credential)
- Additional cloud security certs (AWS Security Specialty, CCSP)
Stack Strategy
The full CNCF trio typically takes 28 to 40 weeks and $1,185 to complete. Candidates who plan to complete all three often take them in closer succession because the kubectl muscle memory compounds. Gap of 2 to 3 months between certs is common. Longer gaps require refresher drills.
Stacked Timeline Example
- Weeks 1 to 12: CKA prep and exam
- Weeks 13 to 14: Rest, minimal study
- Weeks 15 to 22: CKAD prep and exam
- Weeks 23 to 24: Rest
- Weeks 25 to 36: CKS prep and exam
Roughly 9 to 10 months from zero to trio. Candidates working full-time in Kubernetes-heavy roles can accelerate by 20 to 30 percent.
Recertification
All three CNCF certs expire after 2 years. Renewal requires retaking the current version of the exam at full price ($395). There is no discount and no CPE pathway. CNCF treats the cycle as an intentional knowledge refresh.
Candidates maintaining the full trio spend $1,185 every 2 years if all three are renewed. Most candidates let one or two lapse and maintain only the most job-relevant credential. CKS is typically the one most candidates maintain because the security premium justifies the cost.
Exam Environment and Policies
- Online proctored via PSI
- Candidates must show clean desk, no secondary monitors, no paper
- One browser tab, the exam terminal
- Kubernetes docs (kubernetes.io) are allowed during the exam
- Killer.sh simulator access is included and is the best exam prep resource
The Killer.sh simulator is harder than the real exam. Candidates who complete all Killer.sh tasks in 2 hours with 80+ percent score are well prepared.
Cross Domain Considerations
Kubernetes engineering roles increasingly require strong written communication. Runbook docs, post-incident reviews, and platform documentation are weekly deliverables. The technical writing templates at Evolang cover runbook and incident review structures that platform and SRE teams use.
For candidates moving into independent cloud-native consulting after the CNCF trio, entity structure matters. The business formation guides at Corpy cover LLC and S-corp tradeoffs for US-based cloud consultants billing $200+/hour.
Focused study sessions are essential for performance-based exam prep. The productivity environment coverage at Down Under Cafe supports the 90-minute kubectl drill blocks CKA prep demands. For spaced-recall on kubectl commands, the study protocols at When Notes Fly work well for imperative command memorization.
Cognitive style matters for performance-based exams. The cognitive style diagnostics at What's Your IQ offer a frame on procedural vs abstract reasoning. CKA rewards procedural muscle memory; candidates who prefer conceptual certs may find the format unusually demanding.
Related P4S Coverage
For candidates deciding between CKA and Docker certified associate as a container starting point, see the Docker DCA vs CKA comparison at Pass4Sure. For candidates mixing cloud certs with Kubernetes, see the Terraform Associate vs AWS SAA comparison.
Candidates maintaining credentialing on LinkedIn and resumes can use the QR code utilities at QR Bar Code for scannable verification links.
Common Mistakes
- Starting with CKS. Registration is blocked without active CKA.
- Skipping Killer.sh. Candidates who do not use the included simulator fail more often.
- Over-relying on video courses. Performance-based exams reward typing practice, not video consumption.
- Slow vim. Candidates who cannot edit YAML efficiently lose 20 to 30 minutes on YAML tasks alone.
- Ignoring the imperative shortcuts.
kubectl run,kubectl create, and--dry-run=client -o yamlsave minutes per task. - Underestimating time pressure. 2 hours is not enough for candidates who have not drilled pace.
Quick Decision Framework
- What do you do daily? Admin clusters? CKA. Deploy apps? CKAD. Both? CKA first.
- Do you have container background? If no, budget 14 to 20 weeks for CKA.
- Is your target security-focused? Plan CKA then CKS.
- Are you stacking the full trio? Budget 30 to 40 weeks and $1,185.
- Is your employer paying? Many employers cover Linux Foundation cert cost as part of training budget.
References
- Cloud Native Computing Foundation. CKA Exam Curriculum. CNCF, 2024. https://www.cncf.io/certification/cka/
- Cloud Native Computing Foundation. CKAD Exam Curriculum. CNCF, 2024. https://www.cncf.io/certification/ckad/
- Cloud Native Computing Foundation. CKS Exam Curriculum. CNCF, 2024. https://www.cncf.io/certification/cks/
- Linux Foundation Training. Kubernetes Certification FAQ. Linux Foundation, 2024. https://training.linuxfoundation.org/certification/
- Dice. 2026 Tech Salary Report. Dice Insights, 2026. https://www.dice.com/technologists/ebooks/tech-salary-report/
- Levels.fyi. DevOps and SRE Compensation Data. Levels.fyi, 2026. https://www.levels.fyi/
- Mannambeth, Mumshad. CKA and CKAD Certification Courses. KodeKloud, 2024.
- Killer.sh. CKA/CKAD/CKS Exam Simulator. Killer.sh, 2024. https://killer.sh/
Frequently Asked Questions
Can I take CKS without passing CKA first?
No. CNCF requires an active CKA credential before registering for CKS. The registration system blocks CKS purchases without a valid CKA. The prerequisite exists because CKS assumes cluster admin fluency that only CKA validates.
How hard is CKA compared to AWS SAA?
Significantly harder. CKA is performance-based with 2 hours to complete 15 to 20 hands-on tasks on a live cluster. AWS SAA is multiple choice and rewards pattern recognition. Community first-attempt pass rates are about 50 percent for CKA vs 65 percent for SAA.
Is Killer.sh worth it beyond the included sessions?
The included 36-hour simulator access with the exam purchase is typically sufficient. Candidates who need more practice can purchase additional Killer.sh sessions. Most community reports say the two included sessions are enough when used fully.
What is the typical prep time for CKA?
10 to 14 weeks at 10 hours per week for candidates with Docker and Linux fluency. 14 to 20 weeks for candidates new to containers. The prep time is driven by the performance-based format requiring kubectl muscle memory, not just conceptual knowledge.
Does CKA cover Helm or operators?
Helm is lightly covered. Operators are not in scope. CKA focuses on core Kubernetes: pods, deployments, services, networking, storage, and cluster administration. Helm charts and operators are operational conveniences outside the core curriculum.
How often do CKA, CKAD, CKS recertify?
Every 2 years. Renewal requires retaking the current version of the exam at full $395 price. There is no CPE pathway and no discount for retaking. Candidates who fall behind on Kubernetes version changes often need significant refresh prep.
Can I pass CKAD without hands-on Kubernetes experience?
Technically yes, but first-attempt pass rates for candidates without any hands-on cluster work are under 40 percent. The performance-based format requires real kubectl fluency that only practice builds. Budget 10 to 14 weeks minimum with daily kubectl drilling.