CKA, CKAD or CKS — which Kubernetes exam to take first

Three exams, one ordering constraint, and a decision that’s simpler than most guides make it. Costs, weightings and prerequisite rules do change, so verify on the Linux Foundation’s exam pages before booking.

Side by side

	CKA	CKAD	CKS
Kubernetes version	v1.35	v1.35	v1.35
Duration	2 hours	2 hours	2 hours
Validity	2 years	2 years	2 years
Cost, exam only	$445	$445	$445
Can be taken first	●Yes	●Yes	–No
Requires a passed CKA	–No	–No	●Yes
Largest domain	Troubleshooting, 30%	App env & config, 25%	Three tie at 20%
Aimed at people who run the cluster	●Yes	–No	●Yes

CKS is never first

You can’t sit the security exam without having passed the administrator exam, which takes CKS out of the “which first” question entirely.

So the real choice is CKA or CKAD.

Choosing between CKA and CKAD

The question isn’t which is harder. It’s what you do on a Tuesday.

Take CKA if you’re on the hook when a cluster misbehaves. If someone pages you because pods are pending, nodes are NotReady, or DNS resolution broke, CKA’s 30% troubleshooting weighting maps directly onto your job.

Take CKAD if you ship applications onto a cluster somebody else runs. If your questions are about probes, resource limits, config injection and rolling updates rather than etcd and kubelets, CKAD is the exam about your work.

Take CKA anyway if you’re torn. Two reasons: it unlocks CKS, and its troubleshooting bias makes you better at diagnosing your own applications even if you never touch a control plane. The reverse doesn’t hold — CKAD won’t make you better at operating a cluster.

What about OpenShift?

If your organisation runs OpenShift rather than upstream Kubernetes, the Red Hat track is a separate question rather than a competing one.

The two complement each other. CNCF certifications prove portable Kubernetes knowledge, while EX280 proves you can operate Red Hat’s platform specifically: the operators, the security defaults, the developer self-service model. We’ve covered the full OpenShift path separately.

If you have to pick one to start, pick the one matching the platform you run. Certifying on a platform you don’t use is how knowledge evaporates before the credential expires.

A realistic sequence

For someone who runs infrastructure and wants all three:

1. CKA. Baseline, and the prerequisite for CKS.
2. Six months of operating something real. CKS assumes an operational fluency that courseware doesn’t build, so this step isn’t a formality.
3. CKS. Sooner rather than later after CKA, while the terminal-and-clock muscle memory is still there.
4. CKAD only if you also build. If you don’t ship applications, this one won’t stick.

For someone who builds on Kubernetes:

1. CKAD.
2. CKA if you find yourself increasingly debugging the platform rather than the app, which in most teams happens eventually.

The renewal maths

All three are two years. Three certifications means three renewals on a rolling basis, which is a real ongoing cost in both money and time.

Red Hat’s track lets a higher exam renew the lower one. The CNCF certifications don’t renew each other, so holding all three means managing three separate clocks. Worth knowing before you collect them.

What they prove, and what they don’t

We teach this material and we still tell clients the same thing: these exams prove you could perform a set of tasks on one day, in a clean environment, with no incident open and nobody asking for an ETA.

That’s worth something. It’s a real baseline, and procurement departments are right to ask for it. It’s just not the same as being able to run the thing. That part comes from running the thing.