CNCF Certifications in 2026: CKA, CKAD, CKS, KCNA, KCSA, Platform Engineering, and Cloud-Native Specialisation

The Cloud Native Computing Foundation now supports a broad certification ecosystem around Kubernetes and the wider cloud-native landscape. The core Kubernetes credentials remain central—Certified Kubernetes Administrator (CKA), Certified Kubernetes Application Developer (CKAD), and Certified Kubernetes Security Specialist (CKS)—but the portfolio has expanded into foundation-level cloud-native knowledge, Kubernetes security, platform engineering, Istio, Cilium, GitOps, Backstage, OpenTelemetry, Kyverno, and other ecosystem technologies.

The result is a certification map that should be navigated by role. Cluster administrators need operational Kubernetes depth. Application developers need workload design and troubleshooting. Security specialists need both Kubernetes administration and security controls. Platform engineers need product and developer-experience thinking across the internal platform. Foundation credentials are useful for people who need conceptual breadth before performance-based exams. The current portfolio is not one mandatory ladder.

CKA remains the core administrator performance exam

The Certified Kubernetes Administrator validates hands-on cluster administration. Because the exam is performance based, candidates need command-line fluency and the ability to diagnose a live environment under time pressure. Core tasks include cluster architecture, installation and configuration, workloads, scheduling, services, networking, storage, and troubleshooting.

Preparation should use real clusters repeatedly. Build or access a lab, create workloads, break DNS, misconfigure services, change node state, work with persistent storage, and investigate events and logs. A candidate who knows every definition but cannot recover a failing workload is not ready for a performance exam.

A complete Kubernetes learning foundation helps, but practice should converge on fast, accurate use of the official tools and documentation.

CKAD focuses on deploying and operating applications inside Kubernetes

The Certified Kubernetes Application Developer is aimed at developers who design, configure, and troubleshoot workloads rather than manage the full cluster lifecycle. Candidates need fluency with Pods, Deployments, Jobs, configuration, secrets, probes, services, resource settings, security context, and application observability.

The exam rewards the ability to express application intent in Kubernetes objects. Developers should understand why readiness differs from liveness, how a rolling update behaves, what happens when a resource request is wrong, how configuration reaches a container, and how services discover workloads.

The practical value of CKAD preparation is strongest when candidates build and debug their own applications instead of only generating YAML from memorised templates.

CKS builds security on top of administrator competence

The Certified Kubernetes Security Specialist requires an active CKA because security decisions depend on understanding cluster operation. CKS covers cluster setup, hardening, system hardening, supply-chain security, runtime security, monitoring, logging, and vulnerability management.

Candidates should practise reducing attack surface rather than memorising security slogans. Use least privilege, limit container capabilities, manage secrets carefully, validate images, apply network policy, secure the API and nodes, review admission controls, and collect evidence from audit or runtime events.

Useful deeper study includes proactive Kubernetes cluster security and logging and incident response for CKS, because real security work combines prevention with investigation.

KCNA provides the conceptual cloud-native foundation

The Kubernetes and Cloud Native Associate is a knowledge-based entry credential. It is useful for engineers, managers, sales engineers, support staff, and students who need to understand Kubernetes architecture, container orchestration, cloud-native application delivery, observability, and the CNCF ecosystem before attempting deeper performance exams.

KCNA candidates should build a systems map. Containers run workloads, Kubernetes orchestrates them, services and ingress expose them, storage preserves state, observability explains behaviour, and the wider ecosystem adds networking, policy, deployment, and platform capabilities.

The credential is especially useful when the professional works with cloud-native teams but is not yet the person administering clusters.

KCSA creates a security-focused foundation before CKS depth

The Kubernetes and Cloud Native Security Associate introduces security across Kubernetes and the cloud-native lifecycle. It is appropriate for candidates who need to understand threat models, cluster security, workload security, supply-chain risk, identity, policy, and observability but are not yet ready for the hands-on CKS exam.

This path can be useful for security analysts, developers, and platform professionals who need a shared vocabulary. Security should be integrated early in the delivery lifecycle rather than added after deployment, which is why early security integration in Kubernetes is a useful design principle.

KCSA does not replace administration knowledge. Candidates planning to progress to CKS should still develop CKA-level operational fluency.

PCA reflects the growth of platform engineering as a distinct role

The Platform Engineering Certified Associate reflects a wider industry shift from operating individual clusters toward building internal platforms that make safe application delivery easier for many development teams. Platform engineers think about paved roads, self-service, golden paths, observability, policy, automation, and developer experience.

A platform is a product for internal users. That means technical design should be driven by developer needs, operating constraints, security, and supportability. A platform with every possible feature but poor usability will be bypassed; a simple platform with reliable workflows can reduce cognitive load and improve consistency.

Candidates should learn to connect Kubernetes capabilities to higher-level services developers actually consume.

Storage and networking remain critical troubleshooting domains

Kubernetes abstracts infrastructure, but it does not eliminate it. Persistent volumes, storage classes, CSI drivers, services, DNS, ingress, network policy, and CNI behaviour determine whether applications can access data and communicate. The mechanics of persistent volume claims are especially important because stateful workloads fail in ways that stateless examples do not reveal.

Networking should also be tested from first principles: can the Pod resolve DNS, reach the service, reach the endpoint, and return traffic? Is the port correct? Does a NetworkPolicy allow the flow? Is the workload actually ready?

Certification preparation becomes much stronger when candidates deliberately build these failures and diagnose them without immediately recreating resources.

Helm, GitOps, service mesh, observability, and policy extend the ecosystem

CNCF’s certification portfolio now reaches beyond Kubernetes core administration because production cloud-native environments use many complementary technologies. Helm charts package repeatable deployments. GitOps manages desired state through version-controlled workflows. Service meshes add traffic control, identity, and telemetry. OpenTelemetry standardises observability signals. Policy engines such as Kyverno enforce guardrails.

Current CNCF certifications span Kubernetes administration, development, security, platform engineering, observability, service mesh, GitOps, and related cloud-native disciplines. Candidates should use the CNCF and Linux Foundation certification catalogs to confirm which credentials and exam versions are active before building a study plan.

The right specialist credential is the one that matches technology the candidate actually operates.

The 2026 CARE model makes CKA and CKS maintenance more connected

CNCF and the Linux Foundation introduced a certification relationship in 2026 where successful CKS activity can extend or reinstate the related CKA certification under the CARE model. That reflects the prerequisite relationship: a security specialist is expected to retain administrator competence.

Candidates should still verify the current renewal rules for each credential at the time of recertification. Cloud-native certifications have defined validity periods because Kubernetes and its ecosystem evolve quickly.

A good maintenance routine is continuous hands-on use: follow release notes, repeat cluster labs, review security changes, and revisit concepts that are becoming automated by the platform.

Choose CNCF credentials by the operating layer you own

Use KCNA when broad cloud-native literacy is the goal. Use KCSA for foundational security knowledge. Choose CKA for cluster administration, CKAD for application operation, and CKS for Kubernetes security. Use PCA when the responsibility is building internal platforms. Specialist certifications make sense when Istio, Cilium, GitOps, Backstage, OpenTelemetry, Kyverno, or another ecosystem technology is a significant part of the job.

A strong candidate should be able to explain the boundary of responsibility: what the application team owns, what the platform team owns, what the cluster or cloud provider owns, and what the security team monitors. Many production failures occur precisely at those boundaries.

CNCF certification is most valuable when it maps to a real layer of the cloud-native system and is backed by repeated terminal-level practice.

Observability should answer operational questions, not only collect telemetry

Cloud-native systems generate metrics, logs, and traces at large scale, but collection alone does not create observability. Teams need signals that help answer why latency increased, which dependency is failing, whether an error affects one tenant or the whole service, and how a deployment changed behaviour.

Kubernetes candidates should understand how workload logs, events, resource metrics, application metrics, and distributed tracing complement one another. OpenTelemetry has become important because it provides a common approach to generating and transporting telemetry across many tools.

A useful lab is to deploy a small multi-service application, add telemetry, create a performance or dependency failure, and use evidence to locate the cause. That experience supports administration, development, security, and platform-engineering roles.

Cluster upgrades and lifecycle work reveal real administrator maturity

Production Kubernetes administration includes version upgrades, node maintenance, certificate rotation, backup, restore, API deprecation, and compatibility planning. A cluster that works today still needs a path through future releases.

CKA-level practitioners should understand draining and returning nodes, protecting workload availability, reviewing deprecated APIs, validating add-ons, and maintaining control-plane resilience. Platform teams should test upgrades in representative environments before production and document rollback or recovery expectations.

Lifecycle work is where cloud-native skill becomes operational discipline: changes must preserve service, data, security policy, and the developer workflows built on top of the cluster.