CKAD — CKAD vs CKA vs CKS
The Three Kubernetes Certifications
The CNCF offers three Kubernetes certifications. Each targets a different role and skill set. Understanding the differences helps you choose the right certification path.
| Aspect | CKAD | CKA | CKS |
|---|---|---|---|
| Full Name | Certified Kubernetes Application Developer | Certified Kubernetes Administrator | Certified Kubernetes Security Specialist |
| Focus | Application development | Cluster administration | Cluster security |
| Target Audience | Developers, DevOps | Admins, SREs | Security engineers |
| Duration | 2 hours | 2 hours | 2 hours |
| Passing Score | 66% | 66% | 67% |
| Cost | $395 USD | $395 USD | $395 USD |
| Prerequisite | None | None | CKA (active) |
| Difficulty | Medium | Medium-Hard | Hard |
CKAD vs CKA — Detailed Comparison
This is the most common question: “Should I take CKAD or CKA first?”
| Topic Area | CKA | CKAD |
|---|---|---|
| Cluster setup (kubeadm) | ✅ Yes — build clusters from scratch | ❌ No |
| etcd backup/restore | ✅ Yes — critical exam topic | ❌ No |
| Node troubleshooting | ✅ Yes — kubelet, kube-proxy, journalctl | ❌ Minimal |
| RBAC | ✅ Yes — Roles, ClusterRoles, bindings | ✅ Basic — ServiceAccounts |
| Deployments | ✅ Yes — rolling updates, rollbacks | ✅ Yes — deeper focus |
| Helm & Kustomize | ✅ Basic awareness | ✅ More emphasis |
| Pod design patterns | ✅ Basic | ✅ Deep focus (sidecar, init, ambassador) |
| Container images | ❌ Minimal | ✅ Yes — build, modify, optimize |
| Security contexts | ✅ Basic | ✅ Detailed |
| Probes & health checks | ✅ Basic | ✅ Detailed |
| ConfigMaps & Secrets | ✅ Yes | ✅ Yes |
| Services | ✅ Yes | ✅ Yes |
| NetworkPolicies | ✅ Yes | ✅ Yes |
| Ingress | ✅ Yes | ✅ Yes |
| Storage (PV/PVC) | ✅ Yes — detailed | ✅ Basic |
| CRDs & Operators | ❌ No | ✅ Yes |
| Jobs & CronJobs | ✅ Basic | ✅ Detailed |
Topic Overlap
CKA and CKAD share approximately 30% overlap in topics:
CKA Only Shared CKAD Only
┌──────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ kubeadm │ │ Deployments │ │ Container images │
│ etcd │ │ Services │ │ Pod patterns │
│ Node troubl. │ │ ConfigMaps │ │ Helm/Kustomize │
│ Cluster arch │ │ Secrets │ │ CRDs/Operators │
│ Upgrades │ │ NetworkPolicies │ │ Probes (detail) │
│ Storage (PV) │ │ Ingress │ │ Jobs/CronJobs │
│ Scheduling │ │ RBAC basics │ │ Multi-container │
└──────────────┘ └──────────────────┘ └──────────────────┘
CKS — The Security Specialist
CKS is the most advanced Kubernetes certification. Unlike CKAD and CKA, it requires you to hold an active CKA certification as a prerequisite.
CKS covers:
- Supply chain security (image scanning, signing, admission controllers)
- Cluster hardening (RBAC, Pod Security Standards, network restrictions)
- System hardening (AppArmor, seccomp, kernel hardening)
- Minimize microservice vulnerabilities (SecurityContexts, Secrets management, mTLS)
- Monitoring, logging, and runtime security (Falco, audit logs)
Take CKS when: You have passed CKA and want to specialize in Kubernetes security. It is the hardest of the three exams.
Which Certification Should You Take First?
Start with CKAD if you are:
- A developer who deploys applications on Kubernetes
- A DevOps engineer focused on CI/CD and application delivery
- New to Kubernetes certifications and want a slightly easier starting point
- More interested in application-level Kubernetes features
Start with CKA if you are:
- A system administrator or SRE managing Kubernetes clusters
- Responsible for cluster setup, upgrades, and maintenance
- Interested in troubleshooting node and cluster issues
- Planning to eventually take CKS (CKA is required)
Recommended Learning Paths
Path 1: Developer Track
CKAD → CKA → CKS
Start with application development, then learn admin skills, then security.
Path 2: Admin Track
CKA → CKAD → CKS
Start with cluster administration, add developer skills, then security.
Path 3: Fast Track (Experienced Engineers)
CKA → CKS
If you already have strong developer skills, focus on admin and security.
Our recommendation: If you are a developer or DevOps engineer, start with CKAD. If you are an admin or SRE, start with CKA. Taking both gives you the most complete Kubernetes skill set.
Certification Validity and Renewal
| Detail | CKAD | CKA | CKS |
|---|---|---|---|
| Validity | 2 years | 2 years | 2 years |
| Renewal | Retake exam or pass renewal assessment | Same | Same |
| Cost to Renew | Varies (check Linux Foundation) | Same | Same |
Key Takeaways
- CKAD = Developer exam (application-focused, no cluster setup)
- CKA = Admin exam (cluster-focused, includes kubeadm, etcd, troubleshooting)
- CKS = Security exam (requires active CKA, most advanced)
- CKA and CKAD share ~30% topic overlap
- Developers should generally start with CKAD, admins with CKA
- All three are hands-on, performance-based exams (no multiple choice)
FAQ
Q: Can I take CKAD and CKA at the same time?
You can prepare for both simultaneously since they share overlapping topics. However, most people focus on one at a time to avoid splitting their study effort. Take CKAD first if you are developer-focused, CKA first if you are admin-focused.
Q: Do I need CKA before CKAD?
No. CKAD has no prerequisites. Only CKS requires an active CKA certification.
Q: If I pass CKAD, will CKA be easier?
Yes — the 30% topic overlap means you will already know Deployments, Services, ConfigMaps, Secrets, Ingress, and NetworkPolicies. However, CKA adds significant new areas like kubeadm, etcd, node troubleshooting, and cluster upgrades.
