The Cloud Native Computing Foundation (CNCF), through its training partner the Linux Foundation, has expanded its certification portfolio dramatically over the past two years. What used to be just CKA, CKAD, and CKS now includes more than a dozen certifications covering GitOps, observability, networking, policy, FinOps, and platform engineering.
This article maps every current CNCF and adjacent Linux Foundation cert into three tiers (Associate, Professional, Specialist), explains who each is for, and gives recommended learning paths for the most common cloud-native career tracks.
The CNCF Certification Universe
| Tier | Cert | Code | Cost (USD) | Format |
|---|---|---|---|---|
| Associate | Kubernetes & Cloud Native Associate | KCNA | $250 | MCQ |
| Associate | Kubernetes & Cloud Native Security Associate | KCSA | $250 | MCQ |
| Associate | Certified GitOps Associate | CGOA | $250 | MCQ |
| Associate | Certified Argo Project Associate | CAPA | $250 | MCQ |
| Associate | OpenTelemetry Certified Associate | OTCA | $250 | MCQ |
| Associate | Prometheus Certified Associate | PCA | $250 | MCQ |
| Associate | Cilium Certified Associate | CCA | $250 | MCQ |
| Associate | Kyverno Certified Associate | KCA | $250 | MCQ |
| Associate | Cloud Native Platform Engineer Associate | CNPA | $250 | MCQ |
| Associate | Certified Backstage Associate | CBA | $250 | MCQ |
| Associate | FinOps Certified Practitioner | FOCP | $325 | MCQ |
| Professional | Certified Kubernetes Administrator | CKA | $445 | Hands-on |
| Professional | Certified Kubernetes Application Developer | CKAD | $445 | Hands-on |
| Specialist | Certified Kubernetes Security Specialist | CKS | $445 | Hands-on (requires CKA) |
Tier 1 — Associates: The Vocabulary Layer
All CNCF Associate certs are 60–75 minute multiple-choice exams that test concepts, not hands-on skill. They're priced affordably ($250 each), include one retake, and validate that you can speak intelligently about a topic before going deeper.
KCNA — Kubernetes & Cloud Native Associate
The entry-point. Covers Kubernetes fundamentals, cloud-native architecture, observability concepts, and the CNCF landscape. Best for: anyone new to Kubernetes.
KCSA — Kubernetes & Cloud Native Security Associate
Security-flavoured KCNA. Covers RBAC, NetworkPolicy, admission control, secrets management, and supply chain security at a conceptual level. Best for: developers and operators preparing for CKS later.
CGOA — Certified GitOps Associate
Validates understanding of GitOps principles (declarative, versioned, automatic, continuously reconciled) and the tooling landscape (Argo CD, Flux). Best for: platform engineers adopting GitOps.
CAPA — Certified Argo Project Associate
Deeper Argo-specific cert covering Argo CD, Argo Workflows, Argo Events, and Argo Rollouts. Best for: teams using Argo as their primary delivery platform.
OTCA — OpenTelemetry Certified Associate
The vendor-neutral observability cert. Covers OTel signals (traces, metrics, logs), collectors, exporters, instrumentation, and the OpenTelemetry SDKs. Best for: SREs and platform engineers building observability pipelines.
PCA — Prometheus Certified Associate
Validates PromQL fluency, exporters, alerting via Alertmanager, and Prometheus operator basics. Best for: SREs and platform engineers running self-hosted observability.
CCA — Cilium Certified Associate
Cilium-specific networking and observability. Covers eBPF basics, NetworkPolicy with Cilium extensions, Hubble for flow observability, and the Cilium Service Mesh. Best for: platform engineers using Cilium as their CNI.
KCA — Kyverno Certified Associate
Policy-as-code on Kubernetes using Kyverno: validating, mutating, and generating policies. Best for: platform/security engineers replacing OPA Gatekeeper or supplementing PodSecurity admission.
CNPA — Cloud Native Platform Engineer Associate
The newest umbrella cert, validating end-to-end platform thinking: service catalog, golden paths, IaC, GitOps, observability, secrets. Best for: anyone in or moving into a platform engineering role.
CBA — Certified Backstage Associate
Validates fluency with Backstage — the developer portal originated at Spotify. Software catalog, TechDocs, scaffolder, plugins. Best for: platform teams building internal developer portals.
FOCP — FinOps Certified Practitioner
Not strictly a CNCF cert (issued by the FinOps Foundation, also under the Linux Foundation umbrella). Covers cloud cost management principles, the FinOps lifecycle, and KPIs. Best for: anyone with budget responsibility on cloud platforms.
Tier 2 — Professionals: The Hands-On Layer
CKA and CKAD are the original hands-on Kubernetes certs and the ones hiring managers care most about. Both are 2-hour real-cluster exams.
CKA — Administrator
Operator-focused. Cluster install (kubeadm), node management, networking, storage, troubleshooting, RBAC. The cert for platform engineers and SREs.
CKAD — Application Developer
Developer-focused. Pod design, ConfigMaps and Secrets, probes, deployments, services, Helm basics. The cert for backend and cloud-native developers.
Tier 3 — Specialists: The Senior Layer
CKS — Certified Kubernetes Security Specialist
The senior security hands-on exam. Requires an active CKA. Covers cluster hardening, system hardening, supply chain security, runtime security (Falco), and microservice vulnerabilities. The hardest of the three CNCF hands-on exams.
Recommended Paths by Role
Platform Engineer / SRE
- KCNA (optional, 1 month)
- CKA (3 months)
- CKS (3 months)
- CGOA + OTCA + PCA stack (1 month each)
- CNPA (capstone)
Cloud-Native Application Developer
- KCNA (optional)
- CKAD (3 months)
- CGOA (1 month)
- OTCA (1 month)
Security Engineer
- KCSA (1 month)
- CKA (prerequisite for CKS, 3 months)
- CKS (3 months)
- KCA — Kyverno (1 month)
FinOps / Cloud Economist
- FOCP (2 months)
- KCNA (1 month, optional context)
- A cloud vendor architect-level cert in parallel
Total Cost of Common Bundles
| Bundle | Certs | Total cost (USD) |
|---|---|---|
| Kubernetes Trifecta | CKA + CKAD + CKS | $1,335 |
| Cloud-Native Associate Sampler | KCNA + KCSA + CGOA + OTCA + PCA | $1,250 |
| Platform Engineering Full Stack | CKA + CGOA + OTCA + CNPA + CBA | $1,445 |
| Security-First Path | KCSA + CKA + CKS + KCA | $1,390 |
The Linux Foundation routinely runs 30%–50% off promotions around Black Friday, KubeCon, and the start of each quarter. If you can wait, real prices come down meaningfully.
How Long Are They Valid?
- All Associate certs: 3 years
- CKA / CKAD / CKS: 2 years (will move to 3 years for new issues from late 2025)
Recertification is via re-examination or accumulated PDUs through Linux Foundation's certification renewal program.
What's Missing From the CNCF Roster (as of May 2026)
- No dedicated service mesh cert beyond CCA
- No dedicated Helm certification (Helm Associate is rumoured for late 2026)
- No dedicated Istio certification (managed entirely outside CNCF)
- No professional-tier specialty in observability (OTCA is associate-only)
Final Recommendation
Don't try to collect all 14. Pick a primary track (platform, dev, or security), get the one hands-on cert that defines it (CKA, CKAD, or CKS), and round it out with two or three associates that directly support your day job. A typical strong cloud-native resume in 2026 carries one hands-on cert + two or three associates — more than that signals diminishing returns to most hiring managers.