Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the CKAD, the CNCF certification for people who build and deploy applications on Kubernetes, as of September 2026. This guide covers the performance-based exam, the five domains and their weights, the Kubernetes version the exam runs on, cost and validity, DoD 8140 status, the roles it fits, and how it compares with the CKA and CKS.
The Certified Kubernetes Application Developer is the Cloud Native Computing Foundation's credential for people who build, configure and deploy applications on Kubernetes. It is administered by the Linux Foundation, and it is the developer-side exam in a family of three: CKAD for developers, CKA for administrators, CKS for security.
The exam is not a quiz about Kubernetes. It is a two-hour session at a command line in a live cluster, where every question is a task: build the image, write the Deployment, mount the ConfigMap, set the resource limits, expose the Service, write the NetworkPolicy, fix the Pod that will not start. There are no multiple choice questions, and there is nowhere to hide a gap in hands-on skill.
The credential carries no prerequisites. You do not need the CKA first and you do not need to take a course, though the Linux Foundation lists the expected experience level as intermediate. It is issued by CNCF through the Linux Foundation, and the exam environment currently runs Kubernetes v1.35.
Container images, choosing the workload resource, multi-container Pods and volumes. 20%.
Rolling updates, blue/green and canary strategies, Helm and Kustomize. 20%.
API deprecations, probes, CLI monitoring, logs and debugging. The smallest domain at 15%.
CRDs and operators, access control, resource limits, ConfigMaps, Secrets, ServiceAccounts and SecurityContexts. The largest domain at 25%.
NetworkPolicy, exposing applications with Services, and Ingress rules. 20%.
Four things that set the CKAD apart from the certifications that only ask you to recognize the right answer.
Kubernetes is the orchestration layer that the major clouds, on-premises platforms and most modern container tooling are built around, and the CKAD comes from CNCF, the foundation that hosts the Kubernetes project itself. The exam puts you in a real cluster and grades what you build there. That is why hiring managers read a CKAD as evidence of ability rather than recall, and why it holds up on a resume next to credentials that cost far more.
Every item on the CKAD is a task you complete with kubectl and YAML in a live cluster during a two-hour proctored session. You cannot guess your way through a task that asks for a working NetworkPolicy. The format rewards people who deploy to Kubernetes every week and exposes people who have only read about it.
The Application Deployment domain covers the tools teams actually ship with, Helm and Kustomize, alongside rolling, blue/green and canary rollouts. That is one of the clearest differences from the administrator exam, and our comparison of CKA vs CKAD vs CKS walks through where each exam draws its line.
The CKAD is not a DoD 8140 credential. It does not appear in the Qualification Matrix V2.1, so on its own it will not satisfy a cyber-coded position requirement. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the market instead. Kubernetes runs a growing share of enterprise and government workloads, the credential comes from the foundation that governs the project, and it is vendor-neutral: the same skills apply on AWS, Azure, Google Cloud and a rack in your own data center. Federal cloud and platform teams ask for Kubernetes skills even though the certification sits outside the 8140 matrix. Training Camp's Linux Foundation certification training covers the CKAD and its neighbors.
Everything you need to know about the certification, the exam, and how to keep it current, as of September 2026.
The CKAD covers the application side of Kubernetes. From here, most people pick up the administrator exam to own the cluster too, go on to the security exam, or add a cloud platform credential so the Kubernetes skills have a home. The three paths below are the common next moves.
The other half of the platform. The CKA is the administrator exam: same performance-based format, same $445 price, five domains weighted toward cluster architecture and troubleshooting. It has no prerequisite, and the Services and Networking domain you studied for the CKAD appears on it too.
The security step. The CKS is the third CNCF exam, same format and price, with six domains on securing clusters and the workloads on them. It requires an active CKA, so the usual order for someone starting from the CKAD is CKAD, then CKA, then CKS.
Kubernetes runs somewhere, and most of the time that is a managed service on AWS, Azure or Google Cloud. A platform credential such as the AWS Solutions Architect Associate covers the networking, identity and storage around the cluster that the CKAD leaves to the cloud provider.
The CKAD is the developer entry to the CNCF path. The CKA sits beside it for people who run clusters, the CKS builds on the CKA, and from there the path goes across into a cloud platform.
Build and ship on Kubernetes
Own the cluster too
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue the CKAD specifically. Here's a straight answer to both.
No prerequisites, no required training, no CKA needed first.
The CKAD has no prerequisites. You buy the exam from the Linux Foundation, you get 12 months to schedule it and one retake if you need it, and you sit it online with a proctor. Nobody checks your job title or your years of experience. The Linux Foundation does list the expected experience level as intermediate, and that is an honest description of what the tasks assume, not a gate you have to pass through.
Two hours, a live cluster, and no partial credit for knowing the theory.
Nothing on the exam is obscure. The difficulty is doing all of it, correctly, in two hours, while a mistyped YAML key or a forgotten namespace flag eats the minutes you needed for the next task. Candidates who read about Kubernetes and skip the keyboard stall on the first task that asks them to build something. Spend your preparation on a cluster you are free to break, work through every bullet in the curriculum until it is muscle memory, and use the exam-simulator sessions that come with the exam purchase to find out where you are slow.
The CKAD fits roles that build and ship software onto Kubernetes. On its own it speaks to development, DevOps and platform positions; paired with the CKA it covers the operations side as well.
The role the exam is named for. Writes services that are built as container images and shipped to Kubernetes, and owns the Deployment, ConfigMap, Secret and Service manifests that go with the code. Every one of the five domains maps to a normal week in this job.
Owns the pipeline that takes a commit to a running Pod. Builds images, templates releases with Helm or Kustomize, runs rolling and canary rollouts, and debugs the deploy when it stalls, which is the Application Deployment domain in practice.
Builds the internal platform that development teams deploy onto. Sets resource limits, admission rules, NetworkPolicy defaults and SecurityContext baselines for everyone else, so the largest CKAD domain is the center of the work.
Keeps production applications up. Tunes probes and health checks, reads logs and events under pressure, and migrates manifests off deprecated APIs before an upgrade breaks them, all of which sit in the Observability and Maintenance domain.
A backend engineer at a company that runs on Kubernetes. Increasingly expected to package and deploy their own services rather than hand them to an operations team, and the CKAD is the credential that proves they can.
Runs the release process across many services and clusters. Chooses between blue/green, canary and rolling strategies, manages Helm charts and Kustomize overlays, and exposes new versions through Services and Ingress without downtime.
CNCF issues three Kubernetes certifications through the Linux Foundation, and they share a format and a price. The difference is the job each one describes. Here's how the three line up.
| CKAD | CKA | CKS | |
|---|---|---|---|
| Issuer | CNCF via the Linux Foundation | CNCF via the Linux Foundation | CNCF via the Linux Foundation |
| Written For | Developers who build on Kubernetes | Administrators who run clusters | Security specialists hardening clusters |
| Focus | Application design, deployment, configuration, observability and networking | Cluster architecture, workloads, services, storage and troubleshooting | Securing Kubernetes clusters and the workloads on them |
| Prerequisites | None | None | Active CKA |
| Exam Format | Performance-based, live cluster, 2 hours | Performance-based, same format as CKAD | Performance-based, same format as CKAD |
| Domains | 5 | 5 | 6 |
| Largest Domain | Application Environment, Configuration and Security (25%) | Troubleshooting (30%) | See the CKS guide |
| Exam Cost | $445 | $445 | $445 |
| Validity | 2 years | See the CKA guide | See the CKS guide |
| Good Fit For | Developers, DevOps and platform engineers | Cluster operators and infrastructure engineers | Security engineers who already hold the CKA |
Prices are the Linux Foundation's exam-only prices as of September 29, 2026. CNCF does not publish a passing score for the CKAD on the exam page. The CKAD is not on the DoD 8140 Matrix; check the current matrix before relying on any Kubernetes credential for a cyber-coded role. Full facts for the other two exams are in the CKA guide and the CKS guide.
Our Certified Kubernetes Application Developer (CKAD) Boot Camp is five days of live online, hands-on training built around the CNCF exam curriculum: labs on a real cluster, a mock CKAD exam, a free course retake within one year, and post-class mentoring, for $2,895. The CKAD exam itself is not included; you purchase it separately from the Linux Foundation. If you already deploy to Kubernetes every day, the three-day CKAD Fast Track ($2,495) covers the same curriculum at a faster pace.
How the three CNCF exams compare, how to turn a curriculum into a study plan, and where Kubernetes skills fit next to Linux and cloud credentials.
The three CNCF exams side by side: who each one is written for, where the domains overlap, which one requires another, and how to pick a starting point based on the work you already do.
For anyone choosing a first direction in IT. How the two paths overlap, where container and platform skills fit into each, and how to decide based on the work you want.
The CKAD curriculum is a short list of tasks, and it's the whole exam. How to turn an objectives document into a practice plan instead of a reading list.
Kubernetes runs on Linux, and the CKAD assumes you're comfortable in a shell. A look at the Linux+ exam for anyone who needs the command line foundation before the cluster.
The multi-cloud question. Kubernetes is the layer that runs the same on every cloud, and this piece covers when a second platform credential is worth adding beside it.
How the major certification bodies handle renewal, and where a two-year credential like the CKAD sits next to the ones that want hours logged every year.
When a containerized application goes down, the person who can read Pod events and logs is the one who ends the incident. Why response skills belong next to deployment skills.
The CKAD curriculum is organized into five domains, each carrying its own weight. Application Environment, Configuration and Security is the largest at 25 percent, three domains sit at 20 percent each, and Observability and Maintenance is the smallest at 15 percent. Click any domain for what it covers.
How to define, build and modify container images, and how to pick the right workload resource for the job: a Deployment for a stateless service, a DaemonSet for one Pod on every node, a CronJob for scheduled work. It also covers multi-container Pod design patterns such as sidecar containers, and the difference between persistent volumes that outlive a Pod and ephemeral volumes that do not.
The rollout side of the job: rolling updates on a Deployment, and the blue/green and canary strategies you reach for when a straight rollout is too risky. Helm and Kustomize are both in scope, so expect to install or template an application with one and patch a set of manifests with the other.
The smallest domain, and the one that keeps an application running after it ships: API deprecations and how to move a manifest to a current API version, liveness, readiness and startup probes, and monitoring from the command line. You will also read container logs and debug a Pod that will not start or will not stay up.
The largest domain, covering CustomResourceDefinitions and operators, authentication, authorization and admission control, and resource requests and limits. It also covers the three objects that carry configuration into a Pod, ConfigMaps, Secrets and ServiceAccounts, along with SecurityContexts, so expect to set a user ID, drop a capability or make a container filesystem read-only.
How traffic reaches an application and who is allowed to talk to it. You will write NetworkPolicy rules that restrict Pod-to-Pod traffic, expose applications with ClusterIP, NodePort and LoadBalancer Services, and build Ingress rules that route by host and path.
Domains and weights reflect the CKAD exam curriculum published by CNCF and the Linux Foundation for the Kubernetes v1.35 exam environment, verified on September 29, 2026. The environment tracks the latest Kubernetes minor release, so confirm the current version and curriculum on training.linuxfoundation.org before scheduling.
The questions candidates ask most often when researching the Certified Kubernetes Application Developer.
The Certified Kubernetes Application Developer (CKAD) is a performance-based certification issued by the Cloud Native Computing Foundation (CNCF) through the Linux Foundation. It shows you can design, build, configure and expose cloud native applications on Kubernetes: define workloads, roll them out, wire up configuration and secrets, set resource limits and security contexts, and get traffic to them. It's the developer-side Kubernetes credential, next to the CKA for administrators and the CKS for security.
As of September 2026 the exam environment runs Kubernetes v1.35. The Linux Foundation moves the environment to the latest Kubernetes minor release within roughly four to eight weeks of each release, so the version will keep changing. Study against the current version and check the exam page before you schedule, because deprecated APIs are themselves an exam topic.
There are no prerequisites. You don't need the CKA first and you don't need to take a course. What you do need is real time at a terminal with kubectl and YAML, because the exam is a set of tasks in a live cluster and there's no multiple choice to fall back on. The Linux Foundation lists the experience level as intermediate.
The five domains are Application Design and Build (20 percent), Application Deployment (20 percent), Application Observability and Maintenance (15 percent), Application Environment, Configuration and Security (25 percent), and Services and Networking (20 percent). Environment, Configuration and Security is the largest and carries a quarter of the exam, and the weights are even enough that you can't afford to skip a domain.
CKAD is an online, proctored, performance-based exam. You get 2 hours to solve a set of tasks from a command line in a live Kubernetes cluster, and every task is a real change to that cluster: create a resource, fix a broken one, expose a service, write a NetworkPolicy. There are no multiple choice questions. Speed with kubectl matters as much as knowing the answer.
CNCF does not publish a passing score on the CKAD exam page, so there's no percentage to aim at going in. The practical approach is to treat every task as required: work through the exam curriculum until you can complete each type of task from memory, inside the time limit, and then build in a margin for the ones that go wrong on the day.
The exam costs $445 USD when purchased directly from the Linux Foundation, exam only. That price includes one retake and a 12-month window to schedule the exam after you buy it. The exam is not included in Training Camp's CKAD boot camp; you purchase it separately from the Linux Foundation, and the boot camp includes a free course retake within one year and post-class mentoring instead.
No. The CKAD doesn't appear on the DoD 8140 Approved Qualifications Matrix V2.1, so on its own it won't satisfy a cyber-coded position requirement. Federal agencies and contractors still ask for Kubernetes skills on cloud and platform roles because so much government workload now runs in containers, but that demand comes from the market, not the matrix. Check the current matrix at the DoD Cyber Exchange before you count on any credential for an 8140 role, and see the full DoD 8140 work role paths.
The certification is valid for 2 years. Kubernetes ships new minor versions several times a year, so a two-year cycle keeps the credential close to what's actually running in production. Check the Linux Foundation's current renewal terms before your expiration date so you know whether you'll be sitting the exam again and on which Kubernetes version.
The CKAD fits roles that build and ship software onto Kubernetes rather than run the cluster itself: Cloud Native Application Developer, DevOps Engineer, Platform Engineer, Site Reliability Engineer, Backend Software Engineer and Release Engineer. For roles that own the cluster, employers look for the CKA, and the two credentials together cover both sides of the job.
Take the one that matches your work. If you write applications and deploy them to a cluster someone else runs, start with the CKAD. If you install, upgrade, troubleshoot and secure clusters, start with the CKA. Neither is a prerequisite for the other, both cost $445, both are performance-based exams in a live cluster, and the Services and Networking domain appears on both. The CKS is the third step for security work, and it does require an active CKA.
It's a practical exam under a clock, and that's the difficulty. Nothing in it is conceptually exotic, but you have 2 hours to finish a set of hands-on tasks across five domains, and every minute spent hunting through documentation or fixing a YAML indentation error is a minute you don't have. Candidates who pass tend to have the muscle memory to create resources imperatively with kubectl, generate a manifest and edit it fast, and read a Pod's events and logs without hesitation. Plan for weeks of daily cluster time, not a weekend of reading.
For a developer, DevOps engineer or platform engineer whose code runs on Kubernetes, yes. It's one of the few certifications where passing proves you can do the work, because the exam is the work: a live cluster and a list of tasks. It costs $445, it's valid for two years, and it lines up with the CKA and CKS if you want to go further. For someone who has never touched a container, start with Linux and container fundamentals first and come back when you have a cluster to practice on.
If you're weighing the certification, planning the Kubernetes path, or arranging container training for a team, tell us where you are and we'll help you map out the right next step.