CKA — CKA vs CKAD vs CKS
Three Certifications, Three Perspectives
The CNCF offers three Kubernetes certifications, each targeting a different professional role:
| Aspect | CKA | CKAD | CKS |
|---|---|---|---|
| Full Name | Certified Kubernetes Administrator | Certified Kubernetes Application Developer | Certified Kubernetes Security Specialist |
| Focus | Cluster administration & operations | Application development & deployment | Cluster & application security |
| Duration | 2 hours | 2 hours | 2 hours |
| Passing Score | 66% | 66% | 67% |
| Questions | 15–20 tasks | 15–20 tasks | 15–20 tasks |
| Prerequisite | None | None | CKA required |
| Cost | $395 USD | $395 USD | $395 USD |
| Difficulty | Medium-Hard | Medium | Hard |
| Validity | 2 years | 2 years | 2 years |
CKA vs CKAD — Topic-by-Topic Comparison
| Topic | CKA | CKAD |
|---|---|---|
| Cluster setup (kubeadm) | ✅ Deep focus | ❌ Not tested |
| etcd backup/restore | ✅ Core topic | ❌ Not tested |
| Cluster upgrades | ✅ Core topic | ❌ Not tested |
| Node troubleshooting | ✅ 30% weight | ⚠️ Minimal |
| RBAC | ✅ Deep focus | ⚠️ Basic |
| Deployments | ✅ Standard | ✅ Deep focus |
| ConfigMaps & Secrets | ✅ Standard | ✅ Deep focus |
| Multi-container Pods | ⚠️ Basic | ✅ Deep focus |
| Helm & Kustomize | ⚠️ Basic | ✅ More emphasis |
| Jobs & CronJobs | ⚠️ Basic | ✅ Deep focus |
| Services | ✅ Standard | ✅ Standard |
| Ingress | ✅ Standard | ✅ Standard |
| NetworkPolicies | ✅ Standard | ✅ Standard |
| PV & PVC | ✅ Deep focus | ✅ Standard |
| Security Contexts | ✅ Standard | ✅ Standard |
| Pod design patterns | ⚠️ Basic | ✅ Deep focus |
| Resource limits | ✅ Standard | ✅ Standard |
| Probes (liveness, readiness) | ⚠️ Basic | ✅ Deep focus |
| journalctl / crictl | ✅ Core tools | ❌ Not tested |
| kubelet management | ✅ Core topic | ❌ Not tested |
Key insight: CKA and CKAD share about 30% overlap in core topics like Deployments, Services, ConfigMaps, and NetworkPolicies. The differences are in cluster-level operations (CKA) vs application-level design (CKAD).
CKS — The Security Specialist
The CKS (Certified Kubernetes Security Specialist) is the most advanced CNCF Kubernetes certification. It requires a valid CKA certification as a prerequisite.
What CKS Covers (Not in CKA)
| CKS Topic | Description |
|---|---|
| Supply chain security | Image scanning, signing, immutable containers |
| System hardening | AppArmor, seccomp, kernel capabilities |
| Runtime security | Falco, audit logging, behavioral detection |
| Network security (advanced) | Service mesh, mTLS, advanced NetworkPolicies |
| Compliance & auditing | CIS benchmarks, kube-bench, audit policies |
| Secret management (advanced) | Vault integration, encryption at rest |
| Admission controllers | OPA/Gatekeeper, validating/mutating webhooks |
Recommended Learning Paths
Path 1: Operations / SRE Track
CKA → CKS → (optional) CKAD
Start with CKA for cluster administration, then advance to CKS for security. Add CKAD if you also deploy applications.
Path 2: Developer Track
CKAD → CKA → CKS
Start with CKAD for application development, then add CKA for broader cluster understanding. CKS if security is part of your role.
Path 3: Full Stack / Platform Engineering
CKA + CKAD → CKS
Take both CKA and CKAD (in any order — they share 30% content), then pursue CKS for security depth.
Which One First?
| Your Role | Start With | Reason |
|---|---|---|
| DevOps / SRE | CKA | Cluster operations is your primary responsibility |
| Developer | CKAD | Application deployment is your primary focus |
| Platform Engineer | CKA | You build the platform others deploy on |
| Security Engineer | CKA (then CKS) | CKA is required before CKS |
| Full Stack | CKA or CKAD | Pick based on current job duties |
Our recommendation: If you are reading this CKA tutorial, you are likely in an operations or infrastructure role. CKA is the right starting point for you. After CKA, pursue CKS for security specialization or CKAD if you also deploy applications.
Next: Learn about the exam interface with Exam Environment →
