Kubernetes Certifications: CKA, CKAD, and CKS Guide

Step 1: Compare the three exams

CKA is for administrators, CKAD is for application developers, and CKS is the security specialty. All three are two hours long with 15 to 20 performance-based tasks, list at 445 USD, and are valid for two years. CKA and CKAD need a 66 percent score, and CKS needs 67 percent. CKS requires you to have passed CKA first. The exam fee includes 12 months to schedule it, a retake when eligible, and two sessions on the killer.sh simulator.

            CKA      CKAD     CKS
Focus       Admin    Dev      Security
Duration    2 hours  2 hours  2 hours
Pass mark   66%      66%      67%
Needs CKA   No       No       Yes
Validity    2 years  2 years  2 years

Step 2: Know the CKA domains

CKA weighs troubleshooting most heavily, so practice finding why pods, nodes, and services fail. The exam also covers cluster installation and configuration, networking, scheduling, and storage. The CKA product page lists topics such as Gateway API, Helm and Kustomize, CRDs and operators, and workload autoscaling.

Troubleshooting                                       30%
Cluster Architecture, Installation & Configuration    25%
Services & Networking                                 20%
Workloads & Scheduling                                15%
Storage                                               10%

Step 3: Know the CKAD and CKS domains

CKAD focuses on building and running applications on Kubernetes. CKS focuses on securing clusters, supply chains, and runtime.

CKAD
App Environment, Configuration and Security   25%
Application Design and Build                  20%
Application Deployment                        20%
Services and Networking                       20%
Application Observability and Maintenance     15%

CKS
Minimize Microservice Vulnerabilities         20%
Supply Chain Security                         20%
Monitoring, Logging and Runtime Security      20%
Cluster Setup                                 15%
Cluster Hardening                             15%
System Hardening                              10%

Step 4: Understand the exam environment

The exam is remotely proctored through the PSI secure browser, with a single monitor, webcam, microphone, a clear private room, and a government ID that matches your registration. Tasks run on designated hosts reached over SSH, with kubectl, yq, curl, and wget available. During CKA and CKAD you may open the official Kubernetes documentation, the Kubernetes blog, and Helm documentation, plus Gateway API docs for CKA. Notes and other resources are not allowed. The exam tracks a recent Kubernetes version, so use the current curriculum PDF from the CNCF curriculum repository.

Step 5: Practice speed with kubectl

Time is the main constraint, so create resources imperatively and generate YAML instead of writing it from scratch. Learn to navigate the documentation quickly, because that is your only reference. Set up the exam-friendly alias and autocomplete at the start of the exam.

alias k=kubectl
k run web --image=nginx --dry-run=client -o yaml > web.yaml
k create deployment api --image=nginx --replicas=3
k expose deployment api --port=80 --type=ClusterIP
k explain pod.spec.containers --recursive | less
k get events --sort-by=.metadata.creationTimestamp

Step 6: Follow a preparation plan

Spend four to eight weeks building a cluster with kubeadm or kind and working through every curriculum item by hand. Break things on purpose: stop kubelet, misconfigure a service selector, set a bad image, and fix it. Use the included killer.sh sessions in the last week, which are deliberately harder than the real exam, and review mistakes. Renew by retaking before expiry, noting that recertifying CKS can extend CKA under the Linux Foundation's program.