Certified Kubernetes Application Developer (CKAD)
CNCF
Complete guide to passing the Certified Kubernetes Application Developer (CKAD) exam on your first attempt.
$445
Not published
2 years
Global
CNCF
$96,800-$133,080
Are you ready for Certified Kubernetes Application Developer (CKAD)?
Loading quiz...
Complete Overview
The Certified Kubernetes Application Developer (CKAD) is a two-hour, hands-on certification exam from the Cloud Native Computing Foundation, delivered by The Linux Foundation, that tests whether you can design, build, configure and expose cloud native applications on Kubernetes from a command line. It costs $445, which includes 12 months of exam eligibility, one retake and two attempts at the Killer.sh exam simulator. Candidates work through 15 to 20 performance-based tasks in a live Kubernetes cluster and must earn a score of 66% or above to pass. There are no multiple choice questions. Every task is graded on the state of the cluster you leave behind, so partial credit depends on what the grader finds running, not on how you got there. The exam is aimed at developers who ship containerised applications rather than at cluster operators. CNCF describes the target candidate as someone comfortable working with OCI-compliant container images, applying cloud native application concepts and architectures, and writing and validating Kubernetes resource definitions. That focus separates CKAD from the Certified Kubernetes Administrator (CKA), which covers control plane installation, etcd backups, node maintenance and cluster upgrades. Where CKA asks you to repair a broken kubelet, CKAD asks you to add a readiness probe, mount a Secret as a volume, or roll a Deployment back to a previous revision. The published curriculum has five domains: Application Environment, Configuration and Security at 25%, then Application Design and Build, Application Deployment, and Services and Networking at 20% each, and Application Observability and Maintenance at 15%. The exam environment currently runs Kubernetes v1.35, and The Linux Foundation aligns it with each new Kubernetes minor version within roughly four to eight weeks of release, so the version you practise on matters. Exam tasks are available in English, Simplified Chinese and Japanese. Delivery is online proctored through PSI's Bridge platform using the PSI Secure Browser, with a live proctor watching audio, video and screen share for the full session. Dual monitors are not supported. During the exam you may open Kubernetes documentation at kubernetes.io/docs, the Kubernetes blog at kubernetes.io/blog, the Helm documentation at helm.sh/docs, and the task-specific links in the Quick Reference box. Searching within kubernetes.io/docs is allowed, but opening an external search result is not. Score reports arrive by email within 24 hours of finishing. CNCF does not publish a pass rate for CKAD. Certification earned now is valid for two years; CKA and CKAD certifications earned before 1 April 2024 carry a three-year validity. Renewal means passing the exam again, or qualifying through the CARE program, under which a related Kubernetes certification can extend an existing one. The main constraint reported by candidates is time rather than difficulty of any single task: 15 to 20 tasks in 120 minutes leaves an average of six to eight minutes each, which rewards imperative kubectl commands and punishes writing YAML by hand from a blank file.
Why Get Certified Kubernetes Application Developer (CKAD) Certified?
The exam is 100% performance-based: 15 to 20 tasks in a live cluster, zero multiple choice questions
The $445 registration includes one free retake plus two Killer.sh simulator attempts of 17 questions each
A passing score is 66%, so roughly a third of the available points can be lost and you still pass
The curriculum is open source and published by CNCF, with weights of 25/20/20/20/15 across five domains
Registration gives 12 months of eligibility, so you can buy during a sale and schedule later
Certification is valid for 2 years and renews by retaking and passing the exam; under CNCF's CARE program, earning or recertifying CKAD also renews an existing KCNA automatically
Exam tasks are offered in English, Simplified Chinese and Japanese, and the exam is delivered online in any time zone
Exam Format & Structure
Duration
2 hours
Questions
15-20
Passing Score
66%
Question Types
- Performance-based tasks solved in a Linux command line against live Kubernetes clusters
- Tasks graded on the resulting cluster state rather than on the commands typed
- Multi-part tasks where each sub-requirement carries its own points
Delivery Method
Online proctored through PSI Bridge using the PSI Secure Browser, with audio, video and screen sharing monitored by a live proctor
- The exam environment currently runs Kubernetes v1.35 and is realigned within roughly 4 to 8 weeks of each Kubernetes minor release
- Allowed documentation is limited to kubernetes.io/docs, kubernetes.io/blog, helm.sh/docs and the Quick Reference box
- Searching inside kubernetes.io/docs is allowed but opening external search results is not
- Dual monitors are not supported; one active built-in or external monitor only
- Tasks are completed on a designated host reached over SSH, with kubectl aliased to k, bash autocompletion, yq, curl and wget preinstalled
- Copy is Ctrl+Shift+C and paste is Ctrl+Shift+V in the exam terminal; use Ctrl+Alt+W rather than Ctrl+W to avoid closing a browser tab
How scoring works
Score scale
Percentage of total available points, 0 to 100
Score needed to pass
66%
Roughly what that means raw
At a 20-task exam of equal weight, 66% is roughly 13 of 20 tasks fully correct, or a wider spread of partial credit reaching the same total
When results arrive
A score report is emailed within 24 hours of the time the exam is completed
How the scale is built
Each of the 15 to 20 tasks carries a stated point value, and multi-part tasks award points per sub-requirement, so partial completion still scores. Graders evaluate the state of the cluster you leave behind rather than the commands you typed, which means a correct approach that leaves a Pod in CrashLoopBackOff earns nothing while an unconventional route to the right end state earns full marks.
- There is no on-screen provisional result, because grading happens after the session ends
- Points are lost for objects created in the wrong namespace even when the manifest itself is correct
- Tasks are independent, so failing one does not affect scoring on the others
Pacing and time budget
15-20 questions in 120 minutes gives you 6 to 8 minutes per task at a 15 to 20 task exam per question.
| At this point | You should have answered |
|---|---|
| 30 min | 4 to 5 tasks completed and verified |
| 60 min | 8 to 10 tasks completed, half the exam behind you |
| 90 min | 12 to 15 tasks completed, all remaining tasks read at least once |
| 110 min | Every task attempted, last 10 minutes reserved for flagged tasks |
- Spend the first minute on aliases and autocompletion rather than on task one; it pays back several times over
- Cap any single task at 8 minutes, flag it, and return only if time remains
- Tasks are not ordered by difficulty, so read all of them early and sequence them yourself
- Verification with kubectl get and describe costs about 20 seconds per task and prevents zero-scoring silent failures
- At 66% to pass, three unfinished tasks out of 20 is still a comfortable pass if the rest are clean
Where the marks are
| Topic | Weight | Why it scores |
|---|---|---|
| ConfigMaps, Secrets and SecurityContexts | 25% domain | Application Environment, Configuration and Security is the largest domain, and these three appear in almost every exam form. Injecting a ConfigMap three ways, mounting a Secret as a volume, and setting runAsUser with dropped capabilities are fast tasks once drilled, which makes this the highest points-per-minute area on the exam. |
| Multi-container Pod patterns and volumes | 20% domain | Application Design and Build regularly asks for an init container that gates startup or a sidecar sharing an emptyDir with the main container. Both are template-shaped tasks: once you can write the two-container Pod spec from memory, the same skeleton covers most variations in this domain. |
| Rolling updates, rollbacks, Helm and Kustomize | 20% domain | Application Deployment is dominated by kubectl rollout status, history and undo, plus Helm install and upgrade with value overrides and Kustomize overlays. These are command-driven rather than YAML-driven, so they are among the quickest points available if the commands are memorised. |
| Services, endpoints and Ingress rules | 20% domain | Services and Networking tasks usually involve exposing a Deployment and then proving it is reachable. The single highest-value habit is checking kubectl get endpoints after creating a Service, because a selector mismatch is the most common way to lose full marks on an otherwise correct answer. |
| NetworkPolicy ingress and egress rules | 20% domain | NetworkPolicy sits inside the Services and Networking domain and is the topic candidates most often skip in practice. A default-deny policy plus one podSelector-based allow rule covers the typical exam task, and the YAML has no imperative shortcut, so it must be practised from the documentation example. |
| Probes and container logs | 15% domain | Application Observability and Maintenance is the smallest domain but the tasks are short. Adding a liveness or readiness probe to an existing Deployment and reading logs with kubectl logs --previous are both under two minutes each once you know the field paths, which makes them useful time buffers. |
| Requests, limits and ResourceQuotas | 25% domain | Resource requirements sit in the largest domain and appear as both a standalone task and a hidden constraint inside other tasks, where a Pod stays Pending because a namespace quota blocks it. Recognising a quota rejection in kubectl describe saves a task you would otherwise lose entirely. |
The numbers
$445, including one retake and two simulator attempts
Exam fee
Source: The Linux Foundation CKAD certification page
66%
Passing score
Source: Linux Foundation Frequently Asked Questions: CKA and CKAD & CKS
2 hours
Duration
Source: Linux Foundation Frequently Asked Questions: CKA and CKAD & CKS
15 to 20 performance-based tasks
Task count
Source: Linux Foundation Important Instructions: CKA and CKAD
Kubernetes v1.35
Exam environment version
Source: Linux Foundation Important Instructions: CKA and CKAD
2 years, or 3 years if earned before 1 April 2024
Certification validity
Source: Linux Foundation Frequently Asked Questions: CKA and CKAD & CKS
If you fail
Wait before retaking
No enforced waiting period. Scoring takes 24 hours and new appointments require at least 24 hours of lead time, so the earliest realistic retake is about two days after a failed attempt.
Attempt limit
One included retake per registration. Further attempts require buying another registration; The Linux Foundation does not publish a cap on purchased registrations.
Retake fee
The first retake is included in the $445 registration. Beyond that, a new registration is $445.
The included retake must be scheduled and completed within 12 months of the original purchase date, the same window as the initial exam eligibility. If the window lapses, both the eligibility and the retake expire together.
Exam Domains & Topics
The largest domain covers how an application gets its configuration and its permissions. It spans CustomResourceDefinitions and Operators, authentication, authorization and admission control, resource requests, limits and quotas, ConfigMaps, Secrets, ServiceAccounts, and application-level security settings such as SecurityContexts and Linux capabilities.
Key Topics to Master:
- Discover and use resources that extend Kubernetes (CRDs, Operators)
- Understand authentication, authorization and admission control
- Understand requests, limits and ResourceQuotas
- Define resource requirements on containers
- Understand ConfigMaps and the envFrom, env and volume mount patterns
- Create and consume Secrets
- Understand ServiceAccounts and how Pods use them
- Application security: SecurityContext, runAsUser, capabilities, readOnlyRootFilesystem
This domain covers building the artifact and choosing the right shape for the workload. It includes defining, building and modifying container images, choosing between Deployment, DaemonSet, Job, CronJob and other workload resources, multi-container Pod patterns such as sidecar and init containers, and attaching persistent and ephemeral volumes.
Key Topics to Master:
- Define, build and modify container images
- Choose the right workload resource: Deployment, DaemonSet, Job, CronJob, StatefulSet
- Multi-container Pod design patterns: sidecar, init container, adapter, ambassador
- PersistentVolume, PersistentVolumeClaim and StorageClass
- Ephemeral volumes: emptyDir, configMap, secret, downwardAPI
- Job completions, parallelism and backoffLimit
This domain covers getting new versions into a cluster safely. It includes using Kubernetes primitives to implement blue/green and canary strategies, understanding Deployments and performing rolling updates and rollbacks, using the Helm package manager to deploy existing charts, and using Kustomize to layer configuration over a base.
Key Topics to Master:
- Blue/green and canary deployment patterns built from Deployments and Services
- Rolling updates, maxSurge, maxUnavailable and revisionHistoryLimit
- kubectl rollout status, history, undo and pause
- Helm: repo add, search, install, upgrade, uninstall and values overrides
- Kustomize bases, overlays, patches and kubectl apply -k
This domain covers exposing an application and controlling who can reach it. It includes a basic understanding of NetworkPolicies with ingress and egress rules and label selectors, providing and troubleshooting access to applications through Services of each type, and using Ingress rules with host and path routing to expose applications outside the cluster.
Key Topics to Master:
- NetworkPolicy podSelector, namespaceSelector, ingress and egress rules
- Service types: ClusterIP, NodePort, LoadBalancer and ExternalName
- Endpoints, EndpointSlices and label selector mismatches
- Ingress host and path rules, pathType and backend services
- Troubleshooting connectivity with kubectl exec, wget, curl and nslookup
- Cluster DNS naming: service.namespace.svc.cluster.local
The smallest domain covers keeping a running application healthy and diagnosing it when it is not. It includes API deprecations, liveness, readiness and startup probes, monitoring applications with built-in CLI tools, reading and following container logs including logs from previous container instances, and general debugging technique inside Kubernetes.
Key Topics to Master:
- Understand API deprecations and how to migrate manifests to current apiVersions
- Liveness, readiness and startup probes with httpGet, exec and tcpSocket
- initialDelaySeconds, periodSeconds, failureThreshold and timeoutSeconds
- kubectl top, kubectl describe and kubectl get events for monitoring
- kubectl logs with -f, --previous, -c and --since
- Debugging: kubectl exec, kubectl debug ephemeral containers, CrashLoopBackOff and ImagePullBackOff
Recommended Study Plan
- 1Install a local cluster with kind or minikube running Kubernetes v1.35
- 2Add alias k=kubectl, source the kubectl completion script and export do='--dry-run=client -o yaml'
- 3Create Pods imperatively with kubectl run and inspect them with describe and get -o yaml
- 4Practise kubectl explain to find field paths without opening documentation
- 5Learn namespace switching with kubectl config set-context --current --namespace
- 1Create Deployments, DaemonSets, Jobs and CronJobs from imperative commands
- 2Build an init container that waits on a Service before the main container starts
- 3Build a sidecar that tails a shared emptyDir volume written by the main container
- 4Set Job completions, parallelism and backoffLimit and watch the Pods finish
- 5Time yourself creating each workload type in under 90 seconds
- 1Create ConfigMaps from literals, files and directories with kubectl create configmap
- 2Inject configuration three ways: single env var, envFrom, and a mounted volume
- 3Create generic and docker-registry Secrets and decode them with base64 -d
- 4Attach a ServiceAccount to a Pod and inspect the projected token volume
- 5Set a SecurityContext with runAsUser, fsGroup and dropped capabilities
- 1Set requests and limits on containers and observe scheduling failures when they exceed node capacity
- 2Create a ResourceQuota and a LimitRange in a namespace and watch Pod creation get rejected
- 3Read the difference between Guaranteed, Burstable and BestEffort QoS classes
- 4Explore a CustomResourceDefinition and list its instances with kubectl get
- 5Review RBAC verbs and test permissions with kubectl auth can-i
- 1Create a PersistentVolume and a matching PersistentVolumeClaim and bind them
- 2Mount a PVC into a Deployment and confirm data survives a Pod delete
- 3Compare emptyDir, configMap, secret and downwardAPI volume types side by side
- 4Practise accessModes and storageClassName mismatches so you recognise a Pending PVC
- 5Write a Pod manifest with two containers sharing one emptyDir
- 1Run a rolling update, check kubectl rollout status, then roll back with rollout undo
- 2Tune maxSurge and maxUnavailable and observe the replica counts during the update
- 3Build a canary by running two Deployments behind a single Service selector
- 4Install, upgrade and uninstall a Helm chart and override values with --set
- 5Create a Kustomize base and overlay and apply it with kubectl apply -k
- 1Expose Deployments with kubectl expose as ClusterIP, NodePort and LoadBalancer
- 2Break a Service on purpose by changing the selector, then diagnose it with kubectl get endpoints
- 3Write an Ingress with two host rules and two path rules and check pathType behaviour
- 4Resolve service DNS names from inside a Pod with nslookup and wget
- 5Practise reaching a Service by its fully qualified cluster DNS name across namespaces
- 1Install a CNI that enforces NetworkPolicy, such as Calico, on your practice cluster
- 2Write a default-deny policy, then allow one Pod by label and verify with wget
- 3Add ingress and egress rules including a namespaceSelector and a port restriction
- 4Add liveness, readiness and startup probes to a Deployment and force each to fail
- 5Read logs with kubectl logs --previous after deliberately crashing a container
- 1Fix a broken cluster scenario set covering ImagePullBackOff, CrashLoopBackOff and Pending Pods
- 2Use kubectl debug to attach an ephemeral container to a distroless Pod
- 3Practise kubectl get events --sort-by=.metadata.creationTimestamp as a first diagnostic step
- 4Run timed sets of 8 mixed tasks in 45 minutes and record which task types cost you time
- 5Rebuild your alias and vim setup from scratch in under 2 minutes
- 1Take the first Killer.sh simulator attempt under full exam conditions with no pauses
- 2Score the attempt, then list every task you failed and the domain it belongs to
- 3Redo every failed task from a blank terminal without looking at the answer
- 4Re-read the CNCF curriculum PDF and tick off any bullet you cannot demonstrate
- 5Rehearse the documentation search path for your three slowest task types
- 1Take the second Killer.sh simulator attempt and aim to finish with 15 minutes spare
- 2Do a full PSI system check on the exact machine and network you will use
- 3Clear your desk, test your webcam and confirm one monitor only
- 4Practise the copy and paste key combinations Ctrl+Shift+C and Ctrl+Shift+V
- 5Write a one-page cheat sheet from memory, then throw it away
- 1Redo the 10 tasks you have failed most often across all practice sessions
- 2Confirm your government-issued photo ID is unexpired and matches your registered name
- 3Schedule the exam at least 24 hours in advance at a time you are alert
- 4Do one 60-minute half-length run to keep pace without exhausting yourself
- 5Stop new material 48 hours before the exam and review only your own notes
Ready to pass Certified Kubernetes Application Developer (CKAD)?
Get 500+ practice questions, video walkthroughs, and a pass guarantee.
Best Study Resources
CNCF CKAD curriculum (open source)
Official syllabusThe exact competency list the exam is written from, published as a PDF per Kubernetes version in the cncf/curriculum repository. Every domain weight and every bullet in this guide comes from it.
Free
Killer.sh CKAD simulator
Exam simulatorTwo attempts are bundled with the exam, each giving 36 hours of access and 17 questions, with a different question set per attempt and graded results with full solutions. It is harder than the real exam by design.
Included with the $445 registration
Kubernetes documentation
ReferenceThe only reference site you can use during the exam alongside the Kubernetes blog and Helm docs. Learn where the Pod, Deployment, Ingress and NetworkPolicy example manifests live so you can reach them in seconds.
Free
Kubernetes for Developers (LFD259)
Official courseThe Linux Foundation course written against the CKAD curriculum, sold as a bundle with the certification for $645 versus $445 for the exam alone. It includes lab environments matched to the exam domains.
$645 bundled with the exam
Linux Foundation THRIVE-ONE annual subscription bundle
Subscription bundleThe second purchase option on the CKAD page, adding a year of unlimited access to Linux Foundation e-learning courses, SkillCreds and premium microlearning for $180 above the exam-only price.
$625 bundled with the exam
kubectl quick reference cheat sheet
ReferenceThe official cheat sheet page covering the alias, autocompletion, output formats, --dry-run=client -o yaml and JSONPath. Set up the alias and completion lines from this page as the first thing you do in the exam.
Free
kind (Kubernetes in Docker)
Practice environmentRuns a multi-node Kubernetes cluster inside Docker containers on a laptop in about 60 seconds, which makes it practical to destroy and rebuild a cluster between practice sets. Pin the node image to the exam version.
Free
Linux Foundation CKA and CKAD important instructions
Policy documentThe Linux Foundation page listing the current exam Kubernetes version, the 15 to 20 task count, terminal copy and paste keys, preinstalled tools and system setup rules. Read it in full the week before you sit.
Free
Killercoda CKAD scenarios
Practice labsBrowser-based interactive Kubernetes scenarios that run a real cluster with no local setup, useful for short drills on a single topic such as NetworkPolicy or probes when you cannot run a cluster locally.
Free tier available
Common Mistakes to Avoid
Writing every manifest by hand in vim from a blank file
Generate the base YAML with kubectl create or kubectl run plus --dry-run=client -o yaml, redirect it to a file, then edit only the fields the task asks for. This routinely saves two to three minutes per task, which is one to two extra tasks over the full exam.
Forgetting to set the namespace and creating objects in default
Read the namespace line in every task first. Either pass -n to every command or run kubectl config set-context --current --namespace=<ns> at the start of the task. Objects created in the wrong namespace score zero even when the manifest is correct.
Running out of time because one hard task consumed 20 minutes
Set a personal ceiling of eight minutes per task. Flag the task in the exam interface, note it on the provided notepad, move on, and come back with whatever time is left. At 66% to pass you can afford to lose whole tasks, but you cannot afford to lose several easy ones you never reached.
Practising on an old Kubernetes version and hitting removed API versions
Check the current exam version on the Linux Foundation instructions page, which lists v1.35, and pin your kind or minikube cluster to it. Manifests using deprecated apiVersions from older tutorials will be rejected by the API server.
Treating CKAD like CKA and studying control plane administration
Skip etcd backups, kubeadm upgrades, certificate rotation and node cordon and drain. None of those appear in the CKAD curriculum. Spend the time instead on the 25% environment, configuration and security domain, which is the single largest scoring block.
Losing the Service to Pod connection because of a label selector typo
After creating any Service, run kubectl get endpoints <name>. An empty endpoints list means the selector does not match any Pod labels. This one check catches the most common silent failure in the services and networking domain.
Opening an external search result during the exam
Search only within kubernetes.io/docs using its own search box, and do not follow results that leave the allowed domains. Allowed sites are kubernetes.io/docs, kubernetes.io/blog, helm.sh/docs and the Quick Reference links. Leaving them is a policy breach that can void the attempt.
Skipping the simulator until the night before
Take the first of your two Killer.sh attempts about two weeks out, so the failures still leave time to fix them, and the second attempt about three days out as a dress rehearsal. Each attempt gives 36 hours of access, so you can review the solutions after the timed session ends.
Not verifying the work after finishing a task
Spend 20 seconds running kubectl get and kubectl describe on whatever you created. Grading reads cluster state, so a Pod stuck in Pending or CrashLoopBackOff scores nothing even though the YAML looked right when you applied it.
Assuming the free retake can be used at any time
The included retake must be taken within 12 months of the original purchase date. If you buy during a discount period and delay, the eligibility window and the retake expire together, and a further attempt means paying full price again.
Exam Day Tips
- 1
Run the PSI system check on the exact laptop and network you will use, at least a day ahead, and disable any firewall or VPN that blocks the secure browser
- 2
Disconnect any second monitor before check-in, because dual monitors are not supported and the proctor will not start the session until it is removed
- 3
Clear the desk completely: no notes, no phone, no external documents. Only what the proctor approves stays in the room
- 4
In the first 60 seconds of the exam, set alias k=kubectl, source the completion script and export do='--dry-run=client -o yaml' so every later task is faster
- 5
Read the whole task list once and rank tasks by expected time, then start with the ones you can finish in under three minutes
- 6
Use Ctrl+Shift+C and Ctrl+Shift+V for copy and paste in the terminal, and Ctrl+Alt+W instead of Ctrl+W so you do not close the exam browser tab
- 7
Open the Kubernetes documentation tab before you need it and keep it on the reference section you use most, so you are not searching under pressure
- 8
Verify each completed task with kubectl get and kubectl describe before moving on, because grading looks at cluster state and not at your commands
- 9
Keep 10 minutes at the end for flagged tasks, and spend it on partially completed tasks rather than starting a new one
- 10
Plug the laptop into mains power and use a wired connection if you have one, since a dropped session mid-task is scored on whatever state the cluster is in
Career Paths & Salary Ranges
Cloud native application developer
Writes and ships services that run as containers on Kubernetes, owning the Deployment manifests, probes, ConfigMaps and Secrets for those services. CKAD maps almost exactly onto this daily work, which is why it is the certification most often listed on developer job postings that mention Kubernetes.
$133,080 US median for software developers, BLS May 2024
Cloud infrastructure architect
Designs the cluster topology, networking and service exposure model that application teams build on. CKAD is usually a stepping stone rather than the destination here, paired with CKA and a cloud provider architect certification to cover the control plane and managed service side.
$130,390 US median for computer network architects, BLS May 2024
Kubernetes security engineer
Owns NetworkPolicies, RBAC, admission control and workload hardening across clusters. CKAD covers the application-facing half of this through SecurityContexts, Secrets and ServiceAccounts, and the Certified Kubernetes Security Specialist (CKS) extends it, with CKA required before CKS.
$124,910 US median for information security analysts, BLS May 2024
Site reliability or release engineer
Runs the rollout, rollback and observability path for production services. The CKAD deployment domain, at 20% of the exam, covers rolling updates, canary patterns, Helm and Kustomize, which is the core toolset for this role.
$103,790 US median for computer systems analysts, BLS May 2024
Platform or DevOps engineer
Builds and maintains the internal platform that developers deploy onto, including CI pipelines, Helm chart libraries and cluster add-ons. CKAD proves you can use the platform as a consumer, which matters when you are designing it for other teams.
$96,800 US median for network and computer systems administrators, BLS May 2024
Prerequisites & Requirements
- No formal prerequisites. Unlike CKS, which requires an active CKA, CKAD can be taken as a first Kubernetes certification
- Working knowledge of container runtimes and microservice architecture, which CNCF states the exam assumes
- Comfort with a Linux command line, including vim or nano, file redirection, and reading YAML without a graphical editor
- Ability to build and modify OCI-compliant container images
- A machine meeting the PSI Bridge system requirements with a webcam, microphone and a single active monitor
- An unexpired government-issued photo identity document whose name matches the name on your Linux Foundation exam checklist
Frequently Asked Questions
How much does the CKAD exam cost?
The exam alone costs $445. The Linux Foundation also sells two bundles: the exam with a THRIVE-ONE annual subscription for $625, and the exam with the Kubernetes for Developers (LFD259) course for $645. The registration fee is the same worldwide in US dollars, and CKAD tasks can be presented in Chinese with a Chinese-speaking proctor at no extra cost.
What score do I need to pass CKAD?
You need 66% or above. The Linux Foundation states this directly in its CKA, CKAD and CKS FAQ. Because scoring is by task and sub-task rather than all-or-nothing, partial completion on a multi-part task still earns points.
How many questions are on the CKAD exam?
The exam consists of 15 to 20 performance-based tasks completed in 2 hours. The exact count varies by exam form. There are no multiple choice questions.
Does CKAD include a free retake?
Yes. Every CKAD registration includes one retake. The retake must be taken within 12 months of the original exam purchase date. There is no enforced waiting period between attempts, but scoring takes 24 hours and new reservations need at least 24 hours of lead time, so the earliest practical retake is about two days after a failed attempt.
What happens if I fail CKAD?
You receive a score report by email within 24 hours showing that you did not pass, and you use the included retake at no extra cost. If you have already used the retake, you buy another registration at full price. Each new registration carries its own 12-month eligibility window and its own included retake.
How long is CKAD valid, and how do I recertify?
CKAD certifications earned now are valid for 2 years. CKA and CKAD certifications earned before 1 April 2024 remain valid for 3 years. To renew, you retake and pass the exam, which extends the certification for a further 2 years from the pass date. Nothing currently renews CKAD automatically. CNCF's CARE program runs the other way for this credential: earning or recertifying CKAD on or after 1 January 2026 automatically renews an existing KCNA certification.
What is the CKAD pass rate?
CNCF and The Linux Foundation do not publish a pass rate for CKAD. Any percentage quoted elsewhere comes from third-party surveys or training vendors rather than from the certifying body.
Which documentation am I allowed to use during the exam?
You may open the Kubernetes documentation at kubernetes.io/docs, the Kubernetes blog at kubernetes.io/blog, the Helm documentation at helm.sh/docs, and task-specific links provided in the Quick Reference box. Using the search box on kubernetes.io/docs is allowed, but you must not open results that lead outside those sites.
Is CKAD proctored online, and what does that involve?
Yes. CKAD is delivered online through PSI's Bridge proctoring platform using the PSI Secure Browser. A live proctor monitors streaming audio, video and screen sharing for the whole session. Dual monitors are not supported, so a second display must be disconnected before check-in.
What identification do I need on exam day?
A valid, unexpired, government-issued original physical document showing your name, photo and signature. The name on the ID must exactly match the verified name on your exam checklist, which you confirm through a Verify Name step before you can schedule. Photocopies and digital images are not accepted.
What is the difference between CKAD and CKA?
CKAD tests building, configuring and exposing applications on Kubernetes, while CKA tests running the cluster itself. CKA covers cluster architecture, installation, etcd backup and restore, node maintenance and control plane troubleshooting, none of which appear in the CKAD curriculum. Both run 2 hours, both are performance-based, and both cost $445. CKAD requires 66% to pass. Many candidates take CKAD first because it maps to work developers already do.
Do I need CKAD before taking CKS?
No. The Certified Kubernetes Security Specialist requires an active CKA, not CKAD. CKAD has no prerequisite and does not satisfy the CKS prerequisite. If your goal is CKS, take CKA rather than CKAD.
What Kubernetes version does the exam run?
The exam environment currently runs Kubernetes v1.35. The Linux Foundation aligns the CKAD environment with the most recent Kubernetes minor version within roughly four to eight weeks of that release date. Check the official instructions page for the current version before you schedule.
How long do I have to schedule the exam after buying it?
Twelve months. The registration gives 12 months of eligibility to schedule and take the exam, and the included retake must also fall within 12 months of the original purchase date. Once that window closes, the eligibility and the retake both expire.
When do I get my results?
A score report is emailed within 24 hours of the time the exam is completed. There is no provisional result on screen at the end of the session, because the tasks are graded against cluster state after the exam ends.
How does the exam simulator work?
Registration includes two attempts at the Killer.sh simulator. Each attempt gives 36 hours of access from the moment you activate it, and each session contains 17 questions, with a different question set on the second attempt. Results are graded and full solutions are provided after the timed portion.
Are accommodations available for candidates with disabilities?
Yes. The Linux Foundation provides individualised testing accommodations for candidates with documented needs, considered on a case-by-case basis. Requests must be submitted and approved before you schedule the exam, so start the process well ahead of the date you want to sit.
Can I reschedule my exam appointment?
Yes, provided you act more than 24 hours before the scheduled start time. Within 24 hours of the start time you must either sit the exam or forfeit that appointment. All rescheduling has to stay inside the 12-month eligibility window.
What tools are already installed in the exam environment?
Tasks are completed on a designated host reached over SSH. The environment provides kubectl with a k alias and bash autocompletion already configured, plus yq, curl and wget. You still need to know vim or nano well enough to edit manifests quickly.
Which domain should I study hardest?
Application Environment, Configuration and Security at 25% is the largest single block, covering ConfigMaps, Secrets, ServiceAccounts, SecurityContexts, requests, limits, quotas and CRDs. Three domains follow at 20% each and Application Observability and Maintenance is smallest at 15%. Since 66% is the pass mark, securing the 25% domain plus two of the 20% domains already gets you close.
Pass Certified Kubernetes Application Developer (CKAD) — Guaranteed
94% pass rate on first attempt
One-time • Lifetime access
One-time payment