CKA vs CKAD vs CKS: Which Cert to Take First

Originally published on DevToolHub.

Three Kubernetes certifications exist, and each one tests a different job. The CKA is for people who run clusters. The CKAD is for people who deploy apps onto them. Securing those clusters is what the CKS covers. When you are choosing, CKA vs CKAD vs CKS comes down to your actual role, not which exam sounds hardest.

This guide covers what each exam tests, the format, the cost, the big 2025 CKA changes, and how long prep really takes.

[IMAGE: articles/images/2026-08-28-cka-vs-ckad-vs-cks-featured.png | alt: "CKA vs CKAD vs CKS Kubernetes certification comparison"]

CKA vs CKAD vs CKS: what's the difference?

Cluster operations are the CKA's focus: installation, upgrades, networking, storage, and fixing broken nodes. The CKAD is about application delivery, so it covers pod design, config, health probes, and multi-container patterns. Security hardening drives the CKS, which means RBAC, network policies, supply-chain checks, and runtime detection. All three are hands-on, run from a terminal, and use the same Kubernetes version. The CKS also requires a passed CKA first.

Here is the split by curriculum weight, taken from the current CNCF certification pages.

Exam	Who it's for	Heaviest domains	Prerequisite
CKA	Cluster admins, SREs, platform engineers	Troubleshooting 30%, Cluster architecture 25%, Services & networking 20%	None
CKAD	Backend and app developers shipping to Kubernetes	App environment, config & security 25%, Design & build 20%, Deployment 20%	None
CKS	Security engineers, platform teams with a security remit	Microservice vulnerabilities 20%, Supply chain 20%, Monitoring & runtime 20%	Passed CKA

The CKA and CKAD overlap on services and networking. Past that, they pull apart. A developer rarely drains a node, and an admin rarely writes a readiness probe from scratch.

CKA vs CKAD vs CKS: which one should you take first?

Take the CKA first if you run infrastructure, and take the CKAD first if you write application code. Most people should start with the CKA. It is the broadest of the three, it has no prerequisite, and it is the one hiring managers recognize. The CKS is not a starting point, because you must pass the CKA before you can attempt it.

Platform or DevOps engineer: take the CKA. It maps to what you already do, and it unlocks the CKS later.

Backend developer: take the CKAD. Your time goes into manifests and rollouts, not etcd backups.

Security is your job title: CKA, then CKS right after. Budget for both from the start.

Verdict: the CKA is the default answer for anyone unsure. It carries the most weight on a resume and opens the most doors, the CKS included. Our guide to DevOps certifications shows how these sit next to the AWS and Azure tracks.

CKA vs CKAD vs CKS exam format, scoring, and rules

Every exam is a two-hour, online-proctored, performance-based test taken from a command line. There is no multiple choice. You solve real tasks on a live cluster: create resources, fix broken configs, and verify your work. The Linux Foundation delivers all three through PSI's "Bridge" proctoring platform with the PSI Secure Browser, so you need a quiet room, a clear desk, and a webcam ID check.

Passing scores are fixed:

• CKA: 66%
• CKAD: 66%
• CKS: 67%

The Linux Foundation does not publish an official task count for any of the three exams. The Killer.sh simulator bundled with each exam runs 17 questions, and test-takers generally report a similar number on the real exam. Time management matters more than raw knowledge here, because each task is weighted and partial credit is common.

Every exam is open-book, but only for a fixed list of sites. During the CKA and CKAD you may open kubernetes.io/docs, kubernetes.io/blog, and helm.sh/docs, and the CKA also allows gateway-api.sigs.k8s.io. The CKS adds falco.org/docs, etcd.io/docs, docs.cilium.io, istio.io/latest/docs/, the NGINX Ingress controller docs, and the Kubernetes SIGs bom docs. You can use the search on kubernetes.io/docs, but you cannot open an external search result. The full list lives on the allowed-resources page. Practice navigating the docs fast, because tab-hunting mid-exam burns minutes you do not have.

⚠️ Note: certifications earned on or after April 1, 2024 are valid for 2 years (older ones keep their 3-year term). Renew by retaking and passing the current exam before yours expires.

What the CKA, CKAD, and CKS certifications cost

Each exam costs $445 on its own. The Linux Foundation also sells two bundles: exam plus a THRIVE-ONE annual subscription for $625, or exam plus the matching instructor course (LFS258 for CKA, LFD259 for CKAD, LFS260 for CKS) for $645. Every purchase includes one free retake and a 12-month window to schedule and sit the exam.

Purchase	Price (USD)	Includes
Exam only	$445	Two attempts (one retake), two Killer.sh simulator sessions
Exam + THRIVE-ONE	$625	The above, plus a year of Linux Foundation training access
Exam + course	$645	The above, plus the official prep course

Wait for a sale. The Linux Foundation runs discount codes on certification bundles regularly, especially around Black Friday, CyberMonday, and KubeCon. Check for an active coupon before you buy — paying full price when one exists is the most common money mistake with these exams. Your enrollment does not expire for a year, so buy on sale and schedule later.

What changed in the CKA exam in 2025

The CKA changed on February 18, 2025. The five domains and their weights stayed the same. The competencies inside them were reworked. The official program-changes page confirms what got added: Gateway API (GatewayClass, Gateway, HTTPRoute), Helm and Kustomize for installing cluster components, and CRDs and operators. Troubleshooting is the single heaviest domain at 30%.

For prep, that means three things. First, you have to know Helm basics and Kustomize overlays, not just raw manifests. Second, Gateway API is now testable alongside Ingress, so learn both. Third, the troubleshooting weight rewards speed at reading logs, describing resources, and checking kubectl get events before you change anything. CNCF versions the curriculum per Kubernetes release (currently v1.35), so download the current curriculum PDF from the CNCF curriculum repo before you book.

If you studied from a pre-2025 course, your material has no Gateway API, Helm, Kustomize, or CRD coverage at all.

[IMAGE: articles/images/2026-08-28-cka-vs-ckad-vs-cks-diagram.png | alt: "Study path from fundamentals through the Killer.sh simulator to booking the Kubernetes exam"]

How long CKA, CKAD, and CKS preparation takes

There is no official prep-time guidance. Real numbers swing widely with how much Kubernetes you already run day to day. Community reports cluster around 40 to 60 hours for the CKA from a working knowledge of Kubernetes, and 20 to 30 hours for the CKAD once you hold the CKA. One engineer who passed the CKAD in January 2026 logged about 20 hours, having taken the CKA the same month. A candidate preparing for the CKA around a full-time job reported 38 to 44 hours over roughly six weeks. Treat these as rough anchors, not targets.

The CKS usually needs less raw prep time — community estimates land around 25 to 35 hours — but only because it assumes everything the CKA already taught you. Do not book it until CKA reflexes are automatic.

Two things decide pass or fail beyond knowledge:

• kubectl speed. Use imperative commands such as kubectl run --dry-run=client -o yaml, and set up aliases and shell autocompletion in the first two minutes of the exam.
• Remote-desktop fluency. The exam console has its own copy-paste behavior. Practice it in Killer.sh until it is muscle memory, because fighting the clipboard mid-task has failed people who knew the material cold.

A study path for your first Kubernetes exam

This path works for the CKA or the CKAD. Swap the course for CKS once your CKA is done.

1. Learn the fundamentals first. If pods, deployments, and services still feel fuzzy, start with our Kubernetes guide and the kubectl commands reference before any exam prep.
2. Take one structured course. KodeKloud and the official Linux Foundation courses both track the current curriculum. Pick one, then finish it.
3. Do every lab twice. Hands-on repetition beats re-watching videos. Rebuild each scenario from an empty cluster.
4. Practice RBAC and network policies by hand. Both show up across all three exams and trip people who only read about them.
5. Sit both Killer.sh sessions. The simulator is harder than the real exam by design. Score above the pass line on the second attempt before you book.
6. Book the real exam within a week of your second simulator. Skills fade fast once you stop drilling.

For the CKS specifically, add hands-on time with Falco for runtime security, Trivy image scanning, and pod security standards.

Frequently Asked Questions

Q: Is CKA or CKAD harder?
A: Most people find the CKA harder. It covers more ground, its troubleshooting section is unpredictable, and it now includes Helm, Kustomize, and Gateway API. The CKAD is narrower and more forgiving on time. Someone who already holds the CKA can usually pass the CKAD with about 20 hours of focused prep.

Q: Do I need the CKA before the CKS?
A: Yes. The official rule is that you must have taken and passed the CKA before attempting the CKS. There is no such prerequisite for the CKA or the CKAD, which you can take in any order.

Q: How long are the certifications valid?
A: Certifications earned on or after April 1, 2024 are valid for two years. Older certifications keep their original three-year term. You renew by passing the current version of the exam before your certification expires.

Q: Can I use the Kubernetes documentation during the exam?
A: Yes, but only specific sites. The CKA and CKAD allow kubernetes.io/docs, kubernetes.io/blog, and helm.sh/docs. The CKS allows several more, including the Falco, Cilium, and etcd docs. You can search within those domains, but you cannot open an external search result.

Q: Which certification helps most with getting hired?
A: The CKA. It is the most widely recognized of the three and it maps to the largest number of job descriptions. The CKAD matters for developer roles specifically, and the CKS is a specialist add-on that means little without the CKA behind it.

Quick Summary:

• The CKA is for cluster operators, the CKAD for app developers, and the CKS for security engineers; start with the CKA unless you only write application code.
• All three are two-hour, performance-based, command-line exams on the same Kubernetes version, delivered through PSI Bridge.
• Passing scores are 66% for the CKA and CKAD and 67% for the CKS; each exam is $445 with one free retake, and bundles run $625 to $645.
• The CKA competencies were revised on February 18, 2025 to add Gateway API, Helm, Kustomize, and CRDs; troubleshooting is the heaviest domain at 30%.
• Budget 40 to 60 hours for the CKA and 20 to 30 for the CKAD after it, and buy during a Linux Foundation sale rather than at full price.

Still deciding between CKA vs CKAD vs CKS? Default to the CKA, set up kubectl autocompletion and imperative-command aliases today, and use them for every task this week so they are automatic on exam day.