The CNCF currently offers more than a dozen Kubernetes and cloud-native certifications, but three dominate every "which one should I take?" conversation: KCNA (Kubernetes and Cloud Native Associate), CKA (Certified Kubernetes Administrator), and CKAD (Certified Kubernetes Application Developer). This article compares them on cost, difficulty, format, and career impact, and gives a clear order of attack for four common career paths.
The Big Three at a Glance
| Attribute | KCNA | CKA | CKAD |
|---|---|---|---|
| Level | Foundational | Professional | Professional |
| List price (USD) | $250 | $445 | $445 |
| Format | 60 MCQs, online proctored | 15–20 hands-on tasks on real cluster | 15–20 hands-on tasks on real cluster |
| Duration | 90 minutes | 120 minutes | 120 minutes |
| Passing score | 75% | 66% | 66% |
| Free retake | 1 retake included | 1 retake included | 1 retake included |
| Validity | 3 years | 2 years | 2 years |
| Hands-on? | No | Yes | Yes |
KCNA — Kubernetes and Cloud Native Associate
KCNA is the entry-level credential in the CNCF stack. It's the only one of the three that is purely multiple-choice and does not require any hands-on cluster work.
What it covers
- Kubernetes fundamentals (pods, deployments, services, namespaces)
- Container basics (images, runtimes, OCI standards)
- Cloud-native architecture, microservices, and serverless
- CNCF landscape and project ecosystem awareness
- Observability, GitOps, and service mesh concepts at a survey level
Who it's for
Anyone new to Kubernetes who wants a structured introduction before committing to CKA or CKAD. It's also a strong fit for product managers, sales engineers, technical writers, and architects who need vocabulary but not hands-on operational skill.
CKA — Certified Kubernetes Administrator
CKA is the operator-focused cert and the most prestigious of the three for platform and SRE roles.
What it covers
- Cluster architecture, installation, and configuration (kubeadm)
- Workloads, scheduling, and node management
- Networking (CNI, service types, ingress, NetworkPolicy)
- Storage (PVs, PVCs, storage classes)
- Troubleshooting clusters, control plane, and worker nodes
- Security: RBAC, ServiceAccounts, admission control basics
Exam mechanics
You get a Linux terminal with several clusters and must complete 15–20 weighted tasks in 2 hours. Speed and kubectl fluency matter more than memorising YAML; the docs at kubernetes.io are available during the exam.
Who it's for
Platform engineers, SREs, DevOps engineers, and infrastructure engineers who operate clusters. It is the most-requested Kubernetes cert in job descriptions for platform and infra roles.
CKAD — Certified Kubernetes Application Developer
CKAD is the developer-focused cert. It assumes you'll deploy applications onto a Kubernetes cluster someone else operates.
What it covers
- Pod design (labels, annotations, multi-container patterns, init containers)
- Configuration (ConfigMaps, Secrets, environment variables, security contexts)
- Observability (probes, logging, debugging)
- Services and networking (from the consumer side)
- Helm basics and Kustomize
- State persistence for workloads (PVCs, StatefulSets)
Exam mechanics
Same lab format as CKA but with developer-flavoured tasks: define a pod with specific labels, fix a failing probe, mount a secret, write a service for an existing deployment.
Who it's for
Backend developers, full-stack developers, and cloud application engineers who consume Kubernetes as a deployment target.
Side-by-Side Difficulty
| Cert | Conceptual difficulty | Hands-on difficulty | Typical prep time |
|---|---|---|---|
| KCNA | Low–Medium | None | 4–6 weeks (part-time) |
| CKAD | Medium | Medium–High (time pressure) | 8–12 weeks |
| CKA | High | High (breadth + speed) | 10–16 weeks |
Path Recommendations by Role
Aspiring platform/SRE engineer
- Optional: KCNA (1 month) for vocabulary if Kubernetes is brand-new
- CKA (3 months) — the primary cert
- CKS (3 months) — adds security depth, requires CKA
Backend developer / cloud application engineer
- Optional: KCNA if you've never written a pod spec
- CKAD — the primary cert for app developers
- Optional: KCSA for security-aware development
DevOps engineer (broad role)
- CKA first — operator skills travel further than developer skills in DevOps roles
- CKAD second if you write app deployment automation
Career-changer with no IT background
- KCNA — proves baseline knowledge cheaply
- 3–6 months of hands-on lab work
- CKA or CKAD based on whether you prefer infrastructure or application work
Do You Need KCNA Before CKA or CKAD?
No — none of these are prerequisites for each other. If you already have hands-on Kubernetes experience or have built clusters at work, skip KCNA and go straight to CKA or CKAD. KCNA is most valuable when you're new to the ecosystem and want a confidence-building first step.
Salary Impact (US, 2026)
| Role | Median salary | Common certs held |
|---|---|---|
| Kubernetes Engineer | $148,000 | CKA, CKS |
| Platform Engineer | $152,000 | CKA + Terraform Associate |
| SRE | $165,000 | CKA + cloud associate |
| Backend Engineer (Kubernetes-aware) | $135,000 | CKAD |
| DevOps Engineer | $132,000 | CKA + Terraform Associate |
Data aggregated from Levels.fyi, the CNCF 2024 Annual Salary survey, and US Bureau of Labor Statistics May 2024 release adjusted for 2026.
How to Practise for the Hands-On Exams
- Killer.sh — bundled with your CKA/CKAD exam purchase; two free simulator sessions, harder than the real exam
- kubectl alias setup:
alias k=kubectl,export do='--dry-run=client -o yaml'— saves 20–30 minutes across the exam - Local KIND or k3d cluster for daily practice
- kubernetes.io docs navigation — practise finding answers via the search bar, since this is your in-exam reference
- Vim or nano fluency — pick one and master tabs, search, and undo
Verdict
If you're choosing one cert to start: take CKA if you'll operate clusters, CKAD if you'll deploy onto them, and KCNA only as a low-risk first step or vocabulary builder. The hands-on certs (CKA/CKAD) are the credentials hiring managers actually filter on — KCNA alone is rarely enough for a Kubernetes role, but it's a useful confidence builder before the bigger commitment.