Tracking the five CNCF Kubernetes certifications — KCNA, KCSA, CKA, CKAD, CKS — that add up to the Kubestronaut title. One down, four to go, with study guides as I write them.
$ ./kubestronaut --status
CNCF gives the Kubestronaut title to anyone holding all five of its Kubernetes certifications at once. I have one. This page is the run sheet — what each exam actually tests, where I am, and the study guide for each one as I write it.
┌──────────────────────────────────────────────────────────────┐ │ KUBESTRONAUT 1 / 5 │ ├──────────────────────────────────────────────────────────────┤ │ [████████████ ] 20% │ ├──────────────────────────────────────────────────────────────┤ │ [x] KCNA Kubernetes and Cloud Native Associate │ │ multiple choice · 90 min ✓ passed │ │ │ │ [»] KCSA Kubernetes and Cloud Native Security Assoc. │ │ multiple choice · 90 min next │ │ │ │ [ ] CKA Certified Kubernetes Administrator │ │ hands-on · terminal queued │ │ │ │ [ ] CKAD Certified Kubernetes Application Developer │ │ hands-on · terminal queued │ │ │ │ [ ] CKS Certified Kubernetes Security Specialist │ │ hands-on · 2h · requires CKA locked │ └──────────────────────────────────────────────────────────────┘
Kubernetes and Cloud Native Associate
Breadth, not depth. The resource model, how orchestration actually works, and enough of the CNCF landscape to know which project solves which problem. It does not ask you to fix a broken cluster — it asks whether you understand what a cluster is made of. The heaviest domain by a wide margin is Kubernetes fundamentals at 44%, and the weighting is honest about it.
→ KCNA study guide — domain by domain, weighted the way the exam is.
Kubernetes and Cloud Native Security Associate
Same format as KCNA — multiple choice, 90 minutes — but it assumes you already know what the components do and asks how each one fails. Cluster component security and security fundamentals carry 22% each, and there's a threat-model domain that rewards having actually thought about attacker paths rather than memorising flags.
This is the one that overlaps most with work I've already done — classified-grade cloud at Swisscom and the containment thread I keep pulling on under ai-safety. Security as engineering practice rather than a checklist.
→ KCSA study guide — written as a prep plan, before the exam rather than after.
Certified Kubernetes Administrator
The first hands-on one, and the pivot point of the whole run: a terminal, a timer, and a cluster you have to actually operate. Lifecycle, etcd, networking, RBAC, and the troubleshooting that decides whether you're useful at 3 a.m. It's also the gate — CKS can't be attempted without it.
Certified Kubernetes Application Developer
The same cluster from the other seat. Pod design, configuration, probes, services, and deployment strategy — what you need when you're the one shipping onto the platform rather than running it. Mostly a speed exam: the knowledge overlaps CKA heavily, the time pressure doesn't.
Certified Kubernetes Security Specialist
Two hours, hands-on, and locked behind a passing CKA. Supply chain, admission control, runtime security, seccomp and AppArmor, and the parts of a cluster you only think about after something has gone wrong in one. The hardest of the five and the last one I'll sit.
Kubestronaut recognises holding all five CNCF Kubernetes certifications simultaneously — none expired. Each is valid for two years, so the run has a clock on it: pass the fifth before the first lapses. That constraint is most of why this page exists.
The rewards are a jacket, a private Slack channel and mailing list, and five 50%-off certification coupons a year. There's a Golden Kubestronaut tier above it — every CNCF certification plus LFCS — which I'm not thinking about yet.
Organised by the official domain weights, heaviest first — so study time maps to exam weight rather than to whatever is most fun to read.
A curriculum-driven reference for the Kubernetes and Cloud Native Security Associate exam, organised by the official domain weights — cluster component security and security fundamentals at 22% each, threat model and platform security at 16%, cloud native security overview at 14%, compliance frameworks at 10%.
A curriculum-driven reference for the Kubernetes and Cloud Native Associate exam, organised by the official domain weights — 44% Kubernetes fundamentals, 28% container orchestration, 16% application delivery, 12% cloud native architecture.