The three headline Kubernetes certifications from the CNCF, CKA, CKAD and CKS, look similar on paper: each is a hands-on, command-line exam lasting two hours, priced at $445, and based on Kubernetes v1.35. The difference is the job each one proves you can do. CKA is for administrators, CKAD is for developers, and CKS is for security specialists, and CKS requires CKA first. Here is how to choose.

What each one tests

All three are, in the Linux Foundation's words, "online, proctored, performance-based" exams solved "from a command line running Kubernetes", each with "2 hours to complete the tasks" and "valid for 2 years". None of them is multiple choice; you do the work.

  • CKA (Certified Kubernetes Administrator). For people who run clusters. Its domains are Troubleshooting (30%), Cluster Architecture, Installation and Configuration (25%), Services and Networking (20%), Workloads and Scheduling (15%), and Storage (10%). Troubleshooting being the single heaviest area tells you what an administrator's day really looks like.
  • CKAD (Certified Kubernetes Application Developer). For people who build and deploy applications on Kubernetes. Its domains centre on Application Design and Build (20%), Deployment (20%), Environment, Configuration and Security (25%), Observability and Maintenance (15%), and Services and Networking (20%). It assumes you write and ship workloads rather than operate the cluster underneath them.
  • CKS (Certified Kubernetes Security Specialist). For hardening and securing clusters, covering Cluster Setup, Cluster Hardening, System Hardening, Minimising Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security.

The one hard rule: CKS needs CKA

CKA and CKAD have no prerequisites, so you can take either first. CKS is different. The Linux Foundation states plainly that "Certified Kubernetes Security Specialist (CKS) candidates must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS exam." CKS is an advanced, security-focused layer on top of administration, not a standalone entry point.

Which should you choose

Match the certification to your role, not to prestige.

  • Choose CKA if you run or want to run clusters: operations, platform, SRE or infrastructure work. It is also the gateway to CKS.
  • Choose CKAD if you develop applications that run on Kubernetes and rarely touch cluster internals. It proves you can package, deploy and troubleshoot your own workloads.
  • Choose CKS if you already hold CKA and your focus is securing clusters. It is the most specialised of the three and the highest-intent for security roles.

A sensible ladder for someone serious about Kubernetes operations is CKA, then CKS. Developers who never administer clusters can stop at CKAD.

A useful bonus: the CARE renewal

There is a real reason to think about order. Under the Linux Foundation's CARE programme (Certification Advancement and Recertification Experience), passing a higher certification can auto-renew a related lower one. Passing CKS renews your CKA, and both CKA and CKAD can in turn renew the entry-level KCNA. In other words, climbing the ladder keeps the rungs below you valid, which rewards planning your sequence rather than taking exams at random.

Practise under real exam conditions

These are performance-based exams with no multiple choice and a hard two-hour clock, so speed at the command line is as decisive as knowledge. The candidates who pass are the ones who have solved the task types under time pressure until the commands are automatic. CandidatesPrep's simulator lets you rehearse timed, scored practice so the clock stops being the enemy, and trainers preparing cloud-native cohorts can track readiness across a whole group.

Exam-day tactics

  • Set up your shell aliases and context early; seconds saved per task add up across two hours.
  • Do the tasks you know fastest first, and flag the rest, since every task is worth marks regardless of order.
  • Use the official documentation you are allowed to consult, but know it well enough that you are confirming, not learning, during the exam.
  • Verify each change actually applied before moving on.

The bottom line

CKA, CKAD and CKS share a format but prove different jobs: administering, developing, and securing Kubernetes. Pick the one that matches your role, remember that CKS requires CKA first, and if you plan to climb, sequence your exams so the CARE programme keeps your earlier certifications renewed. Then practise the hands-on tasks against the clock, because that is what the exam really measures.

Preparing for a Kubernetes exam, or training a cloud-native team? Rehearse under timed, hands-on conditions, or book a demo to see cohort readiness on CandidatesPrep.