Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the CKA, the hands-on Kubernetes administration credential from the Cloud Native Computing Foundation, as of September 2026. This guide covers the performance-based exam, the five domains and their weights, the Kubernetes v1.35 exam environment, cost and validity, DoD 8140 status, the roles it fits, and how it compares with the CKAD and the CKS.
The Certified Kubernetes Administrator is the credential for the people who run Kubernetes clusters. It is issued by the Cloud Native Computing Foundation, the organization that stewards the Kubernetes project, and administered through the Linux Foundation.
It validates the work of a cluster administrator: building a cluster with kubeadm and keeping its control plane highly available, controlling access with RBAC, scheduling workloads and rolling them out safely, connecting Pods through services, Ingress and the Gateway API, attaching persistent storage, and diagnosing the cluster when a node, a component or the network fails. The exam is performance-based, which means you complete those tasks from a command line in a live cluster. There is no multiple choice.
The credential carries no prerequisites, but it assumes real command line and container experience, and it is the required first step toward the Certified Kubernetes Security Specialist. It is issued and maintained by CNCF through the Linux Foundation, and the exam environment currently runs Kubernetes v1.35.
kubeadm clusters, HA control planes, RBAC, CNI, CSI and CRI, Helm, Kustomize, CRDs and operators. 25%.
Deployments, rollouts and rollbacks, ConfigMaps and Secrets, autoscaling, Pod admission and scheduling. 15%.
Pod connectivity, NetworkPolicy, service types, Gateway API and Ingress, CoreDNS. 20%.
Storage classes, dynamic provisioning, volume types and modes, persistent volumes and claims. The smallest domain at 10%.
Clusters, nodes, components, resource usage, container output, services and networking. The largest domain at 30%.
Four things that set the CKA apart from the knowledge-based exams most infrastructure people have taken before.
The CKA has no multiple choice section. For two hours you work in a live Kubernetes cluster and every task is something an administrator does on the job: create the resource, fix the node, open the network path, attach the volume. A hiring manager reading the credential knows you did the work, not that you recognized the right answer.
CNCF stewards the Kubernetes project itself, so the CKA tests Kubernetes rather than one cloud's packaging of it. The skills carry to managed services on AWS, Azure and Google Cloud and to clusters in your own data center, which is why the credential travels between employers so well.
The Certified Kubernetes Security Specialist (CKS) requires an active CKA before you can sit it. Anyone heading toward cluster security work has to come through this exam first, and our comparison of CKA, CKAD and CKS lays out the order.
The CKA is not a DoD 8140 credential. It does not appear in the Qualification Matrix V2.1, so on its own it will not satisfy a cyber-coded position requirement. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the market instead. Kubernetes is the orchestration layer under the managed container services of every major cloud, CNCF is the body that governs the project, and the exam is built from the same Linux Foundation curriculum that platform teams in industry and government hire against. Federal cloud and platform teams ask for the CKA even though it sits outside the 8140 matrix.
Everything you need to know about the certification, the exam, and how long it stays current, as of September 2026.
The CKA proves you can run the cluster. From here, most people either secure it, learn to build for it, or pair it with a cloud platform credential so the whole stack is covered. The three paths below are the common next moves.
The step up that requires this exam. The CKS is CNCF's security credential: six domains, the same two-hour performance-based format and the same $445 fee, and you cannot register without an active CKA. It is the natural next exam for anyone whose cluster runs anything that matters.
The sideways move. The CKAD covers the developer's side of the same platform: designing, building, deploying and observing applications on Kubernetes across five domains. It has no prerequisite and shares the CKA's format and price, so an administrator who also ships code can add it with far less preparation than the first exam took.
The stack-completing move. Most production clusters run on a managed service, and the networking, identity and storage around them belong to the cloud provider. Pairing the CKA with the AWS Solutions Architect Associate or the Azure Administrator covers both halves of the job.
The CKA sits in the middle of the platform path. Linux and container skills come before it, the CKS builds on it, and from there the path goes deeper into Kubernetes or across into the cloud platform the cluster runs on.
The skills the exam assumes
Run the cluster
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue the CKA specifically. Here's a straight answer to both.
No prerequisite credential, no required training, no application to approve.
The CKA has no formal prerequisites. You buy the exam from the Linux Foundation for $445, which gives you a 12-month window to schedule and one retake, and you sit it online with a proctor. Nobody checks your resume first. The gate is practical rather than administrative: the exam hands you a live cluster and a clock, and it assumes you already know your way around a Linux shell and have run Kubernetes for real.
Two hours, real tasks, and no multiple choice to lean on.
Nothing on the exam is obscure, but all of it has to be done, correctly, in a live environment, against the clock. Candidates who understand the concepts but have never built a cluster with kubeadm, written a NetworkPolicy from scratch or debugged a node that will not join tend to run out of time before they run out of knowledge. Spend your preparation in a terminal, not a slide deck, and rehearse full-length timed sessions before you book the real exam.
The CKA fits hands-on infrastructure roles. It is the credential that moves a systems administrator onto the platform team and the one that platform, DevOps and reliability job listings name when they need someone who can run the cluster.
The role the exam is named for. Installs and upgrades clusters, manages RBAC, keeps the control plane healthy and is the person paged when a node goes NotReady. Every one of the five domains maps to a weekly task in this job.
Builds the internal platform that development teams deploy onto. Owns the cluster, the ingress layer, the storage classes and the Helm charts, and the CKA is the credential platform teams most often list for the cluster side of the work.
Runs the pipeline from commit to running Pod. Needs to understand Deployments, rollouts and rollbacks, ConfigMaps and Secrets well enough to automate them, which is the Workloads and Scheduling domain applied to a CI system.
Keeps production up and finds out why it went down. The Troubleshooting domain, the largest on the exam, is the daily reality of this role: failing components, resource pressure, broken services and networking faults under time pressure.
Provisions and operates managed Kubernetes on AWS, Azure or Google Cloud and the networking and storage around it. The CKA proves the Kubernetes half of that job in a way a single cloud vendor's exam does not.
The most common starting point for CKA candidates. A sysadmin who already runs Linux servers uses the credential to move onto the container platform team, and the kubeadm, networking and storage domains build directly on that background.
CNCF offers three Kubernetes practitioner exams that share a format and a price but test different jobs. Here's how the three line up.
| CKA | CKAD | CKS | |
|---|---|---|---|
| Issuer | CNCF via the Linux Foundation | CNCF via the Linux Foundation | CNCF via the Linux Foundation |
| Role | Cluster administrator | Application developer | Security specialist |
| Focus | Installing, configuring, networking, storing and troubleshooting clusters | Designing, building, deploying and observing applications on Kubernetes | Securing clusters, workloads and the supply chain |
| Prerequisites | None | None | Active CKA required |
| Domains | 5 | 5 | 6 |
| Exam | Performance-based, live cluster, 2 hours | Performance-based, live cluster, 2 hours | Performance-based, live cluster, 2 hours |
| Passing Score | Not published on the exam page | See training.linuxfoundation.org | See training.linuxfoundation.org |
| Exam Cost | $445 | $445 | $445 |
| Validity | 2 years | See training.linuxfoundation.org | See training.linuxfoundation.org |
| Good Fit For | Platform, DevOps, SRE and systems administrators | Developers shipping code onto Kubernetes | Administrators who own cluster security |
All three exams are purchased from the Linux Foundation and pricing may vary with taxes. The CKAD's five domains are Application Design and Build (20 percent), Application Deployment (20 percent), Application Observability and Maintenance (15 percent), Application Environment Configuration and Security (25 percent), and Services and Networking (20 percent). None of the CNCF certifications appear on the DoD 8140 Matrix; their recognition is market-driven rather than DoD-listed. Read the CKAD guide and the CKS guide for the full detail on each.
Our Certified Kubernetes Administrator (CKA) Boot Camp is five days of live online, hands-on, lab-based training built around the CNCF exam curriculum, with a mock CKA exam, post-class mentoring and a free course retake within one year, for $2,895. The CKA exam itself is not included; you purchase it from the Linux Foundation for $445. If you already run Kubernetes every day and want a shorter, faster review, the three-day CKA Fast Track ($2,495) covers the same domains at a quicker pace.
Which Kubernetes exam to take first, the Linux groundwork underneath it, how to study from an objectives list, and what renewal looks like across certification bodies.
The three CNCF exams side by side: what each one tests, who it is written for, the CKA prerequisite that decides the order for CKS, and how to pick a first exam based on the work you actually do.
Incidents in containerized environments move fast. Why the people who run clusters need response skills as much as build skills, and where the CKA troubleshooting domain fits in.
Kubernetes runs on Linux, and most CKA candidates come from a Linux background. A look at the current Linux+ exam for anyone who wants the operating system foundation first.
For anyone choosing a direction in IT. How the two paths overlap, where container platforms sit between them, and how to decide based on the work you want to be doing in three years.
The CNCF curriculum is short and blunt, and it is the whole exam. How to turn an objectives list into a lab plan, and why that matters more for a performance-based test than for any multiple choice exam.
How the major certification bodies handle renewal, from annual CPE quotas to fixed expiration dates like the CKA's two year validity, and what that means for planning your recertification calendar.
Many teams are weighing what comes after their VMware investment. What changed under Broadcom, where Kubernetes fits in that decision, and which credentials hold their value.
The CKA curriculum is organized into five domains, each carrying its own weight. Troubleshooting is the largest at 30 percent, Cluster Architecture, Installation and Configuration follows at 25 percent, and together they cover more than half the exam. Click any domain for what it covers.
You stand up clusters with kubeadm, run a highly available control plane, prepare the underlying infrastructure and manage role-based access control. It also covers the extension points that plug into Kubernetes, the CNI, CSI and CRI interfaces, along with Helm and Kustomize for installing software and CRDs and operators for extending the API.
Deployments and how to roll them forward and back, ConfigMaps and Secrets for configuration, autoscaling, and the primitives that make a deployment self-healing. The scheduling half covers Pod admission and placement: resource limits, node affinity and the other rules that decide where a Pod lands.
How Pods reach each other and the outside world: Pod connectivity, NetworkPolicy, and the ClusterIP, NodePort and LoadBalancer service types. It also covers the Gateway API and Ingress for routing traffic into the cluster, and CoreDNS for name resolution inside it.
The smallest domain covers storage classes and dynamic provisioning, plus the volume types with their access modes and reclaim policies. The practical core is PersistentVolumes and PersistentVolumeClaims, and how they connect a Pod to storage that outlives it.
The largest domain and the one worth the most points: diagnosing failing clusters and nodes, broken cluster components, and resource usage problems. You also read container output streams and trace faults in services and networking, all under time pressure in a live environment.
Domains and weights reflect the current CNCF CKA curriculum as published on training.linuxfoundation.org and verified on September 29, 2026, with the exam environment on Kubernetes v1.35. Confirm the current curriculum and software version on the Linux Foundation exam page before scheduling.
The questions candidates ask most often when researching the Certified Kubernetes Administrator.
The Certified Kubernetes Administrator (CKA) is the administrator-level Kubernetes certification issued by the Cloud Native Computing Foundation (CNCF) through the Linux Foundation. It shows that you can install, configure and operate a Kubernetes cluster: stand up a control plane with kubeadm, manage RBAC, schedule workloads, wire up networking and storage, and fix the cluster when it breaks. It's a performance-based exam, so you earn it by doing the work in a live cluster rather than by answering questions about it.
The CKA is an online, proctored, performance-based exam. You get two hours and a command line connected to a live Kubernetes cluster, and every item is a task you complete in that environment. There are no multiple choice questions. You work from the terminal with kubectl and the standard tooling, so speed and accuracy at the command line count as much as knowing the concepts.
As of September 2026 the exam environment runs Kubernetes v1.35, which is the software version listed on the Linux Foundation's CKA exam page. That version can change, so practice on the version named on that page in the weeks before your exam and check it again when you schedule. Features that shifted between releases, such as the Gateway API alongside Ingress, are exactly the kind of thing the current curriculum expects you to know.
No. There is no prerequisite certification and no required training. You buy the exam from the Linux Foundation, schedule it within the 12-month window, and sit it. That said, this is not an entry-level exam: the tasks assume you're comfortable in a Linux shell, understand containers, and have spent time with kubectl in a real cluster. The CKA is itself a prerequisite for the Certified Kubernetes Security Specialist (CKS), which requires an active CKA before you can sit it.
The five domains are Troubleshooting (30 percent), Cluster Architecture, Installation and Configuration (25 percent), Services and Networking (20 percent), Workloads and Scheduling (15 percent), and Storage (10 percent). Troubleshooting and cluster architecture together make up more than half the exam, so building clusters with kubeadm and diagnosing broken nodes, components and networking deserve most of your practice time.
CNCF does not publish a passing score on the CKA exam page, so there's no number to aim for. What you can control is how many tasks you complete correctly in the two hours. The practical advice is to do the tasks you're sure of first, flag the ones that will take longer, and come back to them with whatever time is left.
The CKA exam costs $445 USD, purchased directly from the Linux Foundation. The price includes one retake and a 12-month window to schedule after purchase. The exam is not included in Training Camp's CKA boot camp: you register and pay for it with the Linux Foundation separately, and the boot camp's $2,895 program fee covers five days of live online training, hands-on labs, a mock CKA exam, post-class mentoring and a free course retake within one year.
No. Linux Foundation and CNCF certifications don't appear on the DoD 8140 Approved Qualifications Matrix V2.1, so the CKA on its own won't satisfy a cyber-coded position requirement. Kubernetes still shows up in federal and defense job listings because agencies and contractors run containerized workloads, but that demand comes from the platform, not the matrix. See the full DoD 8140 work role paths.
The CKA is valid for two years from the date you earn it. The Linux Foundation's exam page states the two-year validity but does not spell out a renewal route, so check the current certification program rules on training.linuxfoundation.org as your expiration approaches. If you plan to add the CKS, keep in mind that it requires an active CKA, so plan your exam dates with the two-year clock in mind.
The CKA maps to hands-on infrastructure roles: Kubernetes Administrator, Platform Engineer, DevOps Engineer, Site Reliability Engineer, Cloud Infrastructure Engineer and Linux Systems Administrator. Employers hiring for those roles want proof that you can run a cluster in production, and a performance-based exam is closer to that proof than a multiple choice one. It's also the credential that people already in a systems role use to move onto the platform team.
It depends on what you do all day. If you build and operate clusters, start with the CKA. If you write and deploy applications that run on Kubernetes and someone else runs the cluster, the Certified Kubernetes Application Developer (CKAD) fits better, and it has no prerequisite either. The Certified Kubernetes Security Specialist (CKS) comes last no matter what, because it requires an active CKA. All three are two-hour, $445, performance-based exams from CNCF, so the format you practice for one carries over to the others.
Harder than its price and length suggest. The difficulty is time pressure on real tasks: two hours to work through cluster setup, RBAC, networking, storage and troubleshooting problems in a live environment, with no multiple choice to fall back on. Candidates who know the concepts but haven't built and broken clusters with their own hands run out of time. Plan on weeks of hands-on lab work, get fast with kubectl, and rehearse under a clock before you sit the real thing.
For anyone who runs, or wants to run, Kubernetes in production, yes. Kubernetes is the orchestration layer that the major clouds' managed container services are built on, and the CKA is the vendor-neutral credential that proves you can operate it no matter whose cloud it's on. It's a two-year credential with a hands-on exam, which is exactly why hiring managers trust it more than a knowledge test. If your work is application delivery rather than cluster operations, the CKAD is the better first exam, and the CKA can come later.
If you're weighing the certification, planning the Kubernetes path, or arranging platform training for a team, tell us where you are and we'll help you map out the right next step.