1. Executive Summary

The official, vendor-neutral Kubernetes certifications come from the CNCF / Linux Foundation ecosystem. The core set consists of:

The most important order for most learners is:

KCNA or directly Kubernetes Fundamentals
  -> CKA for operations and platform
  -> CKAD for application development
  -> KCSA for security fundamentals
  -> CKS for Kubernetes security at professional/advanced level

For Kubestronaut, all five CNCF Kubernetes certifications must be earned and kept current:

KCNA + KCSA + CKA + CKAD + CKS

For cloud, OpenShift, Rancher, DevOps, platform engineering, security, and observability certifications, Kubernetes knowledge is often not the only exam content, but it is a relevant lever. It is especially important for:

• Red Hat OpenShift certifications,
• SUSE Rancher / RKE2 certifications,
• Google Cloud certifications with GKE relevance,
• AWS certifications with Amazon EKS or container-platform relevance,
• Microsoft Azure credentials with AKS relevance,
• CNCF certifications around Argo, GitOps, Prometheus, OpenTelemetry, Cilium, Istio, Kyverno, and Platform Engineering.

2. What Was Expanded in This File

The original file already contained the correct baseline assumption: the official CNCF/Linux Foundation certifications are CKA, CKAD, CKS, KCNA, and KCSA. It also contained a short classification, topic list, learning strategy, and practical-evidence notes.

This expanded version adds:

1. a clear distinction between official Kubernetes certifications and related cloud-native certifications,
2. an overview of where these certifications exist,
3. a detailed description of the five CNCF Kubernetes certifications,
4. a classification of Kubestronaut and extended CNCF paths,
5. an overview of Red Hat OpenShift, SUSE Rancher/RKE2, Google Cloud, AWS, and Microsoft Azure,
6. learning paths by role,
7. a mapping to the existing workshop and exam levels 01 to 04,
8. a topic matrix for Kubernetes competencies,
9. a checklist before registration,
10. official sources for further verification.

3. Terminology: Official, Related, Useful

3.1 Official Kubernetes Certification

In this file, official Kubernetes certification means:

• a personal certification,
• directly focused on Kubernetes,
• offered or governed by CNCF and/or the Linux Foundation,
• vendor-neutral,
• internationally recognized,
• with an official exam or certification page.

This currently includes:

• KCNA,
• KCSA,
• CKA,
• CKAD,
• CKS.

3.2 Related Cloud-Native Certification

A related cloud-native certification does not primarily test Kubernetes itself, but is technically closely connected to Kubernetes platforms. Examples:

• Prometheus for monitoring,
• OpenTelemetry for telemetry,
• Cilium for Kubernetes networking, security, and observability,
• Istio for service mesh,
• Argo and GitOps for Kubernetes delivery,
• Kyverno for Kubernetes policy-as-code,
• Platform Engineering for internal developer platforms based on Kubernetes.

3.3 Vendor Certification with Kubernetes Relevance

A vendor certification is not vendor-neutral, but it often tests Kubernetes in a specific platform:

• Red Hat OpenShift,
• SUSE Rancher Prime,
• Rancher Kubernetes Engine 2,
• Google Kubernetes Engine,
• Amazon Elastic Kubernetes Service,
• Azure Kubernetes Service.

3.4 Kubernetes Knowledge Is Important or Useful

Kubernetes knowledge is important when the certification explicitly tests Kubernetes clusters, Kubernetes objects, Pods, Deployments, Services, RBAC, storage, networking, or security.

Kubernetes knowledge is useful when the certification tests broader cloud, DevOps, security, or architecture competencies and Kubernetes appears as one possible platform. In such exams, Kubernetes alone is not enough, but it helps with understanding containers, deployments, scaling, IAM/RBAC, observability, networking, and operations.

4. Official Kubernetes Certifications from CNCF and Linux Foundation

4.1 Overview

4.2 KCNA – Kubernetes and Cloud Native Associate

Goal: Demonstrate that you understand Kubernetes and the cloud-native ecosystem at a foundational level.

Suitable for:

• beginners,
• students,
• junior DevOps engineers,
• cloud engineers at the start of their path,
• people who want structured orientation before CKA/CKAD,
• technical product owners or project leads with a cloud-native focus.

Typical topics:

• Kubernetes basic architecture,
• Pods, Deployments, Services, and Namespaces,
• basic understanding of kubectl,
• containers and images,
• cloud-native principles,
• observability fundamentals,
• security fundamentals,
• CNCF ecosystem.

Why Kubernetes knowledge is important:

KCNA is directly focused on Kubernetes and Cloud Native. You do not need to administer production-grade clusters as in CKA, but you must classify terms and relationships confidently.

Matching preparation from this material:

• 01-fundamentals-*,
• fundamentals questions from questions-kubernetes-DE.md,
• simple hands-on labs with Namespace, Deployment, Service, ConfigMap, Secret, rollout, and troubleshooting.

Not ideal if:

• you already operate production Kubernetes clusters and want a practical exam,
• you want to directly prove a developer or administrator role.

In that case, CKA or CKAD is more useful.

4.3 KCSA – Kubernetes and Cloud Native Security Associate

Goal: Demonstrate foundational knowledge of Kubernetes and cloud-native security.

Suitable for:

• beginners in Kubernetes security,
• security engineers without Kubernetes practice,
• DevOps engineers interested in DevSecOps,
• people who later aim for CKS,
• auditors or compliance stakeholders with a cloud-native context.

Typical topics:

• Kubernetes security fundamentals,
• cluster and platform risks,
• RBAC fundamentals,
• Pod Security Standards,
• Secrets fundamentals,
• network segmentation,
• supply-chain fundamentals,
• compliance and hardening basics.

Why Kubernetes knowledge is important:

KCSA does not test security abstractly, but in the context of Kubernetes and Cloud Native. Anyone who cannot classify Pods, ServiceAccounts, RBAC, Secrets, Admission, and NetworkPolicies will understand the security questions only superficially.

Matching preparation from this material:

• Fundamentals for the object model and base resources,
• Advanced + Security for threat model, RBAC, Pod Security, NetworkPolicy, Secrets, and incident response,
• simple security reviews without production Secrets.

Not ideal if:

• you already hold CKA and want to prove Kubernetes security practically.

Then CKS is the stronger proof.

4.4 CKA – Certified Kubernetes Administrator

Goal: Demonstrate that you can administer, configure, operate, and debug Kubernetes clusters.

Suitable for:

• Kubernetes administrators,
• platform teams,
• SREs,
• cloud engineers,
• DevOps engineers with operations responsibility,
• people who aim for CKS.

Typical topics:

• cluster architecture,
• nodes,
• scheduling,
• workloads,
• Services,
• networking,
• storage,
• RBAC fundamentals,
• troubleshooting,
• upgrades and maintenance fundamentals,
• backup/recovery fundamentals.

Why Kubernetes knowledge is important:

CKA is a direct Kubernetes administration exam. Theory is not enough. You must work in a shell with kubectl, analyze resources, and fix errors.

Matching preparation from this material:

• 01-fundamentals-* for object model and safe operation,
• 02-intermediate-* for workloads, probes, resources, scheduling, NetworkPolicy, storage, and troubleshooting,
• 03-professional-* for platform operations, upgrades, observability, GitOps, DR, and cost.

Not ideal if:

• you almost exclusively develop applications and do not operate clusters.

Then CKAD is often a better fit.

4.5 CKAD – Certified Kubernetes Application Developer

Goal: Demonstrate that you can design, configure, deploy, expose, and debug applications on Kubernetes.

Suitable for:

• developers,
• DevOps engineers,
• application engineers,
• platform users,
• people who use Kubernetes primarily from a workload perspective.

Typical topics:

• Pods,
• Deployments,
• Jobs and CronJobs,
• ConfigMaps and Secrets,
• Probes,
• Services,
• Ingress fundamentals,
• resource requests and limits,
• Labels and Selectors,
• Volumes,
• SecurityContext fundamentals,
• application troubleshooting.

Why Kubernetes knowledge is important:

CKAD does not primarily test cluster operations. It tests safe and reproducible handling of Kubernetes objects from the application perspective.

Matching preparation from this material:

• 01-fundamentals-*,
• 02-intermediate-*,
• practical exercises with Deployments, Probes, Services, Jobs, CronJobs, ConfigMaps, Secrets, PVCs, Helm, and Kustomize.

Not ideal if:

• you primarily own clusters, nodes, networking, storage classes, and platform operations.

Then CKA is more important.

4.6 CKS – Certified Kubernetes Security Specialist

Goal: Demonstrate that you can operate, harden, audit, and respond to incidents for Kubernetes workloads and Kubernetes platforms securely.

Important prerequisite:

• CKS requires a current CKA. Without solid administration practice, CKS is not useful.

Suitable for:

• security engineers,
• DevSecOps engineers,
• platform security,
• senior SREs,
• Kubernetes administrators with security responsibility,
• people who need to audit or harden Kubernetes risks.

Typical topics:

• cluster setup security,
• API Server and control plane,
• RBAC,
• ServiceAccounts,
• Pod Security Standards,
• SecurityContext,
• NetworkPolicies,
• Secrets,
• supply-chain security,
• image scanning,
• Admission Control,
• runtime security,
• audit logs,
• incident response.

Why Kubernetes knowledge is important:

CKS is not a generic security exam. It requires that you already handle Kubernetes objects, cluster behavior, kubectl, workloads, networking, and operations processes safely.

Matching preparation from this material:

• 04-advanced-security-*,
• Advanced + Security solutions,
• practical labs on RBAC, Pod Security, NetworkPolicy, Admission, Secrets, supply chain, runtime detection, and incident response,
• additionally 03-professional-* for operations and platform context.

Not ideal if:

• you do not yet know Kubernetes administration,
• you only want to prove theoretical security fundamentals.

Then start with KCSA or CKA.

5. Kubestronaut and Extended CNCF Certification Paths

5.1 Kubestronaut

Kubestronaut is a CNCF program for people who have successfully earned and kept current all five CNCF Kubernetes certifications:

KCNA + KCSA + CKA + CKAD + CKS

Meaning:

• broad proof of Kubernetes competence,
• combination of fundamentals, administration, development, and security,
• especially suitable for platform engineers, senior DevOps engineers, SREs, and Kubernetes consultants.

Recommended order:

1. KCNA
2. CKAD or CKA
3. CKA or CKAD
4. KCSA
5. CKS

For people with substantial operations experience, this order is also possible:

1. CKA
2. CKAD
3. CKS
4. KCNA
5. KCSA

The first order is didactically cleaner. The second order is often faster for experienced practitioners.

5.2 Golden Kubestronaut / Expanded CNCF Breadth

In the CNCF ecosystem, there are additional cloud-native certifications besides the five core Kubernetes certifications, for example Prometheus, Istio, Cilium, Argo, GitOps, Backstage, OpenTelemetry, Kyverno, and Platform Engineering.

These extend the profile from pure Kubernetes usage to complete cloud-native platform competence:

• observability,
• service mesh,
• networking and security,
• GitOps and continuous delivery,
• policy-as-code,
• internal developer platforms,
• telemetry and platform operations.

6. CNCF Certifications Where Kubernetes Knowledge Is Especially Useful

These certifications are not all “Kubernetes certifications” in the narrow sense. However, many assume that you understand Kubernetes as a target platform.

6.1 Useful Combinations

7. Vendor Certifications with Direct Kubernetes or Kubernetes Platform Relevance

7.1 Red Hat OpenShift

Red Hat OpenShift is an enterprise platform based on Kubernetes. Kubernetes knowledge is very important here, but it is not sufficient by itself because OpenShift adds its own concepts:

• Projects instead of a pure Namespace view,
• Routes,
• BuildConfigs or modern build flows,
• Security Context Constraints,
• Operator Lifecycle Manager,
• OpenShift-specific CLI oc,
• integrated registry, authentication, networking, and platform functions.

Recommendation:

• For vendor-neutral Kubernetes, start with KCNA/CKA/CKAD.
• For OpenShift job roles, additionally take EX180/EX280/EX288 depending on role.
• For OpenShift security, still evaluate CKS/KCSA/KCA as vendor-neutral additions.

7.2 SUSE Rancher and Rancher Kubernetes Engine 2

SUSE/Rancher certifications are especially relevant when Kubernetes is operated through Rancher, Rancher Prime, RKE2, or multi-cluster management.

Recommendation:

• Use CKA as the base for general Kubernetes competence.
• Add SUSE certifications for Rancher/RKE2 operations.
• Add KCSA/CKS/KCA/CCA for security.

7.3 Distinction: Personal Certification vs. Product/Provider Program

Not everything with “Certified Kubernetes” is a personal exam. In the CNCF ecosystem, there are also programs such as:

These programs are relevant for companies, products, or training providers, but they are not the same as CKA, CKAD, CKS, KCNA, or KCSA for individuals.

8. Cloud Certifications Where Kubernetes Knowledge Is Helpful

Cloud certifications usually do not test only Kubernetes. Nevertheless, Kubernetes knowledge is often important in modern cloud roles because EKS, AKS, and GKE are common platform services.

8.1 Google Cloud

Google Cloud has a strongly Kubernetes-related managed service with Google Kubernetes Engine (GKE). Kubernetes knowledge is especially helpful for:

Classification:

• Anyone operating GKE should have at least CKAD-like or CKA-like Kubernetes practice.
• For architects, CKA is not mandatory, but Kubernetes fundamentals plus GKE architecture knowledge are highly useful.

8.2 AWS

AWS uses a managed Kubernetes service with Amazon Elastic Kubernetes Service (Amazon EKS). Kubernetes knowledge is especially helpful for:

Classification:

• CKA is very useful for EKS platform operations.
• CKS/KCSA is useful for EKS security.
• CKAD is useful for deploying applications on EKS.

8.3 Microsoft Azure

Azure uses a managed Kubernetes service with Azure Kubernetes Service (AKS). Microsoft distinguishes between classic Microsoft Certifications and practical Applied Skills.

Classification:

• CKA or CKAD plus Azure-specific AKS knowledge is very useful for AKS operations.
• CKS/KCSA plus Azure IAM, policy, and network know-how is useful for AKS security.
• Microsoft Applied Skills are practical proof points, but they are not identical to classic Microsoft certifications.

9. Role-based Decision: Which Certification Fits Which Goal?

9.1 Beginner / Junior Cloud Engineer

Goal: Understand Cloud Native and classify Kubernetes terms confidently.

Recommended path:

01 Fundamentals
  -> KCNA
  -> KCSA optional
  -> CKAD or CKA depending on target role

Why:

KCNA provides orientation without immediately requiring deep cluster troubleshooting or security hardening.

9.2 Kubernetes Administrator / Platform Operations

Goal: Operate clusters, analyze workloads, master storage/networking/troubleshooting.

Recommended path:

01 Fundamentals
  -> 02 Intermediate
  -> 03 Professional
  -> CKA
  -> PCA or CCA optional
  -> CKS if responsible for security

Why:

CKA is the central proof for Kubernetes administration. PCA, CCA, and CKS add observability, networking, and security.

9.3 Kubernetes Application Developer

Goal: Build, configure, deploy, and debug applications for Kubernetes.

Recommended path:

01 Fundamentals
  -> 02 Intermediate
  -> CKAD
  -> CGOA or CAPA
  -> PCA or OTCA optional

Why:

CKAD maps well to workload modeling, probes, ConfigMaps, Secrets, Services, Jobs, CronJobs, Volumes, and debugging.

9.4 DevOps Engineer / CI/CD / GitOps

Goal: Master build, test, scan, image promotion, GitOps, rollout, and rollback.

Recommended path:

KCNA
  -> CKAD or CKA
  -> CGOA
  -> CAPA
  -> cloud-provider certification depending on platform

Why:

GitOps and Argo are often Kubernetes-centered. Without the Kubernetes object model, rollouts, diffs, sync, drift, and rollbacks remain unclear.

9.5 Security Engineer / DevSecOps

Goal: Identify Kubernetes risks, harden clusters and workloads, formulate policies, handle incidents.

Recommended path:

KCNA
  -> KCSA
  -> CKA
  -> CKS
  -> KCA
  -> CCA optional

Why:

CKS requires CKA. KCSA is a useful entry point. KCA adds policy-as-code. CCA adds CNI, eBPF, networking, and security topics.

9.6 Platform Engineer / Internal Developer Platform

Goal: Provide Kubernetes as a platform product for multiple teams.

Recommended path:

CKA
  -> CKAD
  -> CGOA
  -> CAPA
  -> PCA/OTCA
  -> CNPA
  -> CNPE
  -> CKS optional or recommended

Why:

Platform Engineering connects architecture, GitOps, self-service, observability, security, policy enforcement, runtime operations, and developer experience.

9.7 OpenShift Administrator / OpenShift Developer

Goal: Operate the Red Hat OpenShift Kubernetes-based platform or deploy applications on it.

Recommended path:

KCNA or Kubernetes Fundamentals
  -> CKA or CKAD
  -> Red Hat EX180 / container fundamentals
  -> EX280 for administration
  -> EX288 for application development

Why:

OpenShift is based on Kubernetes, but adds its own platform functions. Kubernetes knowledge accelerates understanding but does not replace OpenShift-specific practice.

9.8 Rancher / RKE2 Administrator

Goal: Operate Kubernetes through Rancher, Rancher Prime, or RKE2.

Recommended path:

KCNA
  -> CKA
  -> SUSE Certified Administrator in RKE2
  -> SUSE Certified Administrator in SUSE Rancher Prime
  -> SUSE Deployment Specialist in RKE2 for lifecycle responsibility

Why:

Rancher and RKE2 are Kubernetes-adjacent platforms. CKA provides the vendor-neutral base, while SUSE certifications add product depth.

10. Mapping to Workshop and Exam Levels 01 to 04

10.1 01 Fundamentals

Fits:

• KCNA,
• KCSA entry,
• Red Hat container/Kubernetes fundamentals,
• cloud fundamentals with container relevance,
• preparation for CKAD/CKA.

Core competencies:

• Kubernetes purpose,
• control plane and worker nodes,
• Pods,
• Deployments,
• ReplicaSets,
• Services,
• Labels and Selectors,
• ConfigMaps and Secrets,
• Namespaces,
• rollouts,
• first diagnosis with logs, events, and status.

Certification relevance:

Fundamentals is not yet sufficient for CKA or CKAD, but it forms the required foundation.

10.2 02 Intermediate

Fits:

• CKAD,
• CKA preparation,
• Google Associate Cloud Engineer with GKE tasks,
• Azure AKS Applied Skills,
• OpenShift Application Development,
• DevOps certifications with container deployment.

Core competencies:

• Deployment vs. StatefulSet vs. DaemonSet vs. Job vs. CronJob,
• Probes,
• requests and limits,
• QoS,
• LimitRange and ResourceQuota,
• scheduling,
• NetworkPolicy,
• Ingress/Gateway,
• PVC/PV/StorageClass,
• Helm and Kustomize,
• systematic troubleshooting.

Certification relevance:

Intermediate is especially important for CKAD and forms the practical foundation for CKA.

10.3 03 Professional

Fits:

• CKA,
• cloud architect and DevOps certifications,
• CNPA/CNPE,
• SUSE Rancher / RKE2,
• Red Hat OpenShift Administration,
• platform and SRE roles.

Core competencies:

• production architecture,
• managed vs. self-managed vs. hybrid,
• node pools and sizing,
• add-ons as platform products,
• upgrades and API deprecations,
• observability,
• autoscaling,
• GitOps,
• multi-tenancy,
• operators and CRDs,
• backup and disaster recovery,
• cost management.

Certification relevance:

Professional adds what is often only indirectly visible in pure hands-on exams: architecture, operations, ownership, SLOs, and platform decisions.

10.4 04 Advanced + Security

Fits:

• KCSA,
• CKS,
• KCA,
• CCA,
• cloud security certifications with Kubernetes/container relevance,
• OpenShift/Rancher security tasks,
• DevSecOps roles.

Core competencies:

• threat modeling,
• RBAC and identity,
• ServiceAccount token automount,
• Pod Security Standards,
• SecurityContext,
• NetworkPolicy,
• supply-chain security,
• Admission Policies,
• Secrets security,
• runtime detection,
• compliance evidence,
• incident response.

Certification relevance:

Advanced + Security is direct preparation for CKS-adjacent skills and complements KCSA with practical work.

11. Certification Learning Paths

11.1 Path A: Broad Kubernetes Fundamentals

01 Fundamentals
  -> KCNA
  -> 02 Intermediate
  -> CKAD or CKA

Goal: From zero to robust Kubernetes fundamentals.

Completion capability:

• KCNA is realistic,
• CKAD/CKA after additional practical work.

11.2 Path B: Kubernetes Administrator

01 Fundamentals
  -> 02 Intermediate
  -> 03 Professional
  -> CKA
  -> PCA optional
  -> CCA optional

Goal: Operate Kubernetes clusters and platforms.

Required exercises:

• node and Pod diagnosis,
• scheduling,
• Services and DNS,
• NetworkPolicy,
• storage,
• RBAC,
• rollouts,
• upgrades and backup fundamentals,
• troubleshooting under time pressure.

11.3 Path C: Kubernetes Application Developer

01 Fundamentals
  -> 02 Intermediate
  -> CKAD
  -> CGOA or CAPA

Goal: Deploy applications cleanly on Kubernetes.

Required exercises:

• Deployments,
• Jobs and CronJobs,
• Probes,
• ConfigMaps and Secrets,
• Services,
• Ingress/Gateway,
• Volumes,
• Helm/Kustomize,
• debugging CrashLoopBackOff, ImagePullBackOff, and Service without Endpoints.

11.4 Path D: Kubernetes Security

01 Fundamentals
  -> 02 Intermediate
  -> KCSA
  -> CKA
  -> 04 Advanced + Security
  -> CKS
  -> KCA optional
  -> CCA optional

Goal: Professionally assess and implement Kubernetes security.

Required exercises:

• RBAC audit,
• Pod Security Restricted,
• disable ServiceAccount token automount,
• NetworkPolicy default deny,
• Admission Policy,
• Secrets rotation,
• supply-chain review,
• incident runbook,
• evidence collection.

11.5 Path E: Platform Engineering

CKA
  -> CKAD
  -> 03 Professional
  -> CGOA
  -> CAPA
  -> CNPA
  -> CNPE
  -> CKS or KCA as security addition

Goal: Design and operate internal developer platforms on a cloud-native basis.

Required exercises:

• platform blueprint,
• GitOps flow,
• multi-tenant Namespace standard,
• add-on matrix,
• observability SLO,
• tenant self-service,
• policy enforcement,
• cost model,
• operations handover.

11.6 Path F: Cloud Provider Kubernetes

KCNA or Kubernetes Fundamentals
  -> CKAD/CKA depending on role
  -> cloud provider certification
  -> provider-specific Kubernetes: EKS, AKS, or GKE

Examples:

• GKE: Google Cloud Associate Cloud Engineer, Professional Cloud DevOps Engineer, Professional Cloud Architect.
• EKS: AWS Certified DevOps Engineer – Professional, AWS Solutions Architect Professional with container/EKS context.
• AKS: Microsoft AKS Applied Skills, Azure DevOps Engineer Expert, Azure Solutions Architect Expert.

12. Topic Matrix: Kubernetes Knowledge by Certification

13. What to Practice for Which Exam

13.1 For KCNA

Practice:

• explaining Kubernetes components,
• reading apiVersion, kind, metadata, spec, status,
• understanding simple Pods, Deployments, and Services,
• basic terms of the CNCF ecosystem,
• container vs. VM vs. Pod,
• cloud-native fundamentals,
• simple security and observability fundamentals.

Do not overprioritize:

• deep cluster repair,
• complex RBAC escalation,
• production multi-tenancy,
• advanced runtime security.

13.2 For KCSA

Practice:

• threat model for Kubernetes,
• RBAC fundamentals,
• Pod Security Standards,
• NetworkPolicy fundamentals,
• Secrets and Base64 distinction,
• Admission fundamentals,
• supply-chain fundamentals,
• compliance and security terminology.

Do not overprioritize:

• complex shell-speed tasks,
• full CKS labs without an administration foundation.

13.3 For CKAD

Practice intensively:

• writing YAML quickly and correctly,
• Deployments, Jobs, CronJobs,
• ConfigMaps and Secrets,
• Probes,
• Volumes,
• Services,
• Labels and Selectors,
• resource requests and limits,
• application debugging,
• kubectl explain, kubectl logs, kubectl describe, kubectl get events.

Self-check:

kubectl apply --dry-run=server -f <manifest>.yml
kubectl rollout status deployment/<name> -n <namespace>
kubectl get pods --show-labels -n <namespace>
kubectl get svc,endpoints,endpointslices -n <namespace>
kubectl logs <pod> -n <namespace>

13.4 For CKA

Practice intensively:

• cluster and node diagnosis,
• scheduling,
• taints and tolerations,
• Services and DNS,
• NetworkPolicy fundamentals,
• storage and PVCs,
• RBAC,
• rollouts,
• troubleshooting,
• backup and upgrade fundamentals,
• safe kubectl use under time pressure.

Self-check:

kubectl get nodes -o wide
kubectl describe node <node>
kubectl get events -A --sort-by=.metadata.creationTimestamp
kubectl auth can-i <verb> <resource> --as <subject> -n <namespace>
kubectl get pvc,pv,storageclass -A
kubectl describe pod <pod> -n <namespace>

13.5 For CKS

Practice intensively:

• RBAC audit with kubectl auth can-i,
• Pod Security Restricted,
• securityContext,
• automountServiceAccountToken: false,
• NetworkPolicy default deny,
• Admission Policies,
• Secrets rotation,
• image and supply-chain review,
• runtime detection,
• audit logs,
• incident response and evidence.

Self-check:

kubectl auth can-i get secrets --as system:serviceaccount:<ns>:<sa> -n <ns>
kubectl get role,rolebinding,clusterrole,clusterrolebinding -A
kubectl label namespace <ns> pod-security.kubernetes.io/enforce=restricted --overwrite
kubectl get networkpolicy -n <ns>
kubectl describe pod <pod> -n <ns>
kubectl get events -n <ns> --sort-by=.metadata.creationTimestamp

13.6 For OpenShift Certifications

Practice in addition to Kubernetes:

• oc instead of only kubectl,
• OpenShift Projects,
• Routes,
• Builds,
• ImageStreams or current build mechanisms,
• Security Context Constraints,
• OpenShift Operators,
• OpenShift Console,
• OpenShift-specific RBAC,
• OpenShift networking and storage,
• OpenShift cluster administration.

13.7 For Rancher/RKE2 Certifications

Practice in addition to Kubernetes:

• Rancher Prime architecture,
• cluster import and provisioning,
• downstream clusters,
• Rancher authentication and authorization,
• RKE2 cluster operations,
• backup and restore,
• Fleet/GitOps,
• Rancher monitoring, security, and observability,
• multi-cluster management.

13.8 For Cloud Provider Certifications

Practice in addition to Kubernetes:

• IAM and workload identity,
• VPC/VNet/subnets,
• load balancers,
• managed node pools,
• autoscaling,
• container registry,
• Secrets Manager / Key Vault / Secret Manager,
• cloud-native logging and monitoring,
• provider-specific security and operating models.

14. Exam Preparation Without Brain Dumps

14.1 Allowed and Useful

• official exam guides,
• official documentation,
• your own labs,
• your own notes,
• publicly permitted sample tasks,
• mock exams, if they do not copy real exam questions,
• workshops and exercises,
• repetition of core tasks under time pressure.

14.2 Do Not Use

• brain dumps,
• real exam questions,
• copied protected tasks,
• shared exam screenshots,
• solutions from real exam sessions,
• unauthorized question banks.

14.3 Why This Matters

Certifications should prove that you can solve real tasks. CKA, CKAD, and CKS in particular are practice-oriented. Anyone who only memorizes answers will later fail in operations on simple issues such as:

• wrong Namespace,
• wrong selector,
• missing Endpoint,
• wrong ServiceAccount,
• PVC Pending,
• overly aggressive Liveness Probe,
• missing requests,
• overly broad RBAC,
• insecure Pod spec,
• unclear incident evidence.

15. Checklist Before Registration

Before every certification registration, check:

16. Maintenance Notes for This File

This file should be updated regularly, at least:

• once per quarter,
• before every new workshop run,
• before every exam preparation,
• after major Kubernetes releases,
• after changes at CNCF/Linux Foundation,
• after changes at Red Hat, SUSE, AWS, Google Cloud, or Microsoft.

Recommended maintenance fields:

Last review: <date>
Checked sources:
- CNCF Certification Page
- Linux Foundation Certification Catalog
- Kubernetes Training Page
- Red Hat Certification Pages
- SUSE Certification Pages
- AWS Certification Exam Guides
- Google Cloud Certification Guides
- Microsoft Learn Credentials
Open points:
- check prices
- check exam versions
- check languages
- check validity period
- check prerequisites

17. Official Sources

17.1 CNCF / Kubernetes / Linux Foundation

• CNCF Cloud Native Certifications: https://www.cncf.io/training/certification/
• Kubernetes Training and Certification: https://kubernetes.io/training/
• Linux Foundation Certification Catalog: https://training.linuxfoundation.org/certification-catalog/
• Certified Kubernetes Administrator: https://training.linuxfoundation.org/certification/certified-kubernetes-administrator-cka/
• Certified Kubernetes Application Developer: https://training.linuxfoundation.org/certification/certified-kubernetes-application-developer-ckad/
• Certified Kubernetes Security Specialist: https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/
• Kubernetes and Cloud Native Associate: https://training.linuxfoundation.org/certification/kubernetes-cloud-native-associate/
• Kubernetes and Cloud Native Security Associate: https://training.linuxfoundation.org/certification/kubernetes-and-cloud-native-security-associate-kcsa/
• Kubestronaut Bundle: https://training.linuxfoundation.org/certification/kubestronaut-bundle/
• Linux Foundation Certification Verification: https://training.linuxfoundation.org/certification/verify/

17.2 Red Hat

• Red Hat Certified Specialist in Containers and Kubernetes: https://www.redhat.com/en/services/certification/red-hat-certified-specialist-in-containers-and-kubernetes
• Red Hat Certified OpenShift Administrator exam / EX280: https://www.redhat.com/en/services/training/red-hat-certified-openshift-administrator-exam
• Red Hat Certified Advanced Developer in Cloud-native Applications / EX288: https://www.redhat.com/en/services/certification/rhcs-openshift-application-development
• Red Hat individual exams overview: https://www.redhat.com/en/services/certification/individual-exams

17.3 SUSE / Rancher

• SUSE Certified Administrator in SUSE Rancher Prime: https://www.suse.com/training/exam/sca_ran_prime/
• SUSE Certified Administrator in Rancher Kubernetes Engine 2: https://www.suse.com/training/exam/sca_rke2/
• SUSE Certified Deployment Specialist in Rancher Kubernetes Engine 2: https://www.suse.com/training/exam/scds_rke2/
• SUSE Certification Exams: https://www.suse.com/training/exam/

17.4 Google Cloud

• Google Cloud Certifications: https://cloud.google.com/learn/certification
• Associate Cloud Engineer: https://cloud.google.com/learn/certification/cloud-engineer
• Professional Cloud Architect Guide: https://cloud.google.com/learn/certification/guides/professional-cloud-architect
• Professional Cloud DevOps Engineer: https://cloud.google.com/learn/certification/cloud-devops-engineer
• Professional Cloud DevOps Engineer Guide: https://cloud.google.com/learn/certification/guides/cloud-devops-engineer
• Google Kubernetes Engine: https://cloud.google.com/kubernetes-engine

17.5 AWS

• AWS Certification Overview: https://aws.amazon.com/certification/
• AWS Certified DevOps Engineer – Professional: https://aws.amazon.com/certification/certified-devops-engineer-professional/
• AWS Certified DevOps Engineer – Professional Exam Guide: https://docs.aws.amazon.com/aws-certification/latest/devops-engineer-professional-02/
• In-scope services for AWS Certified DevOps Engineer – Professional: https://docs.aws.amazon.com/aws-certification/latest/devops-engineer-professional-02/dop-02-in-scope-services.html
• Amazon Elastic Kubernetes Service: https://aws.amazon.com/eks/

17.6 Microsoft Azure

• Microsoft Credentials Browse: https://learn.microsoft.com/en-us/credentials/browse/
• Microsoft Certified: DevOps Engineer Expert: https://learn.microsoft.com/en-us/credentials/certifications/devops-engineer/
• Exam AZ-400: https://learn.microsoft.com/en-us/credentials/certifications/exams/az-400/
• Microsoft Certified: Azure Solutions Architect Expert: https://learn.microsoft.com/en-us/credentials/certifications/azure-solutions-architect/
• Deploy containers by using Azure Kubernetes Service – Applied Skills Study Guide: https://learn.microsoft.com/en-us/credentials/applied-skills/resources/study-guides/apl-1001
• Azure Kubernetes Service documentation: https://learn.microsoft.com/en-us/azure/aks/

18. Recommendation for This Workshop

For this workshop, the following structure is useful:

01-fundamentals-*      -> KCNA foundation and CKAD/CKA preparation
02-intermediate-*      -> CKAD core, CKA foundation, cloud AKS/EKS/GKE practice
03-professional-*      -> CKA extension, platform operations, cloud/platform engineering paths
04-advanced-security-* -> KCSA/CKS/KCA/CCA security path
05-official-certificates-kubernetes-EN.md -> certification map and learning paths

Additionally recommended:

certification-paths/
  kcna-checklist.md
  ckad-checklist.md
  cka-checklist.md
  kcsa-checklist.md
  cks-checklist.md
  openshift-path.md
  rancher-rke2-path.md
  cloud-provider-kubernetes-path.md

Each checklist should contain:

• official exam page,
• current blueprint version,
• workshop files relevant to the exam,
• minimum practical labs,
• typical error patterns,
• schedule,
• evidence files,
• open knowledge gaps.