Certified Kubernetes Application Developer (CKAD)
A hands-on, performance-based certification proving you can design, build, configure and expose applications running on Kubernetes — from a command line, against a clock.
- src
- Linux Foundation Training & Certification — Certified Kubernetes Application Developer (CKAD) certification page (training.linuxfoundation.org)
- chk
CKAD or CKA?
Both exams are two hours on a command line, cost the same and share a passing score. They test different jobs.
CKAD is the application on the cluster. You write manifests, wire up ConfigMaps and Secrets, set probes, expose a Deployment through a Service and an Ingress. You never bootstrap a cluster, restore etcd or fix a broken kubelet — those are the CKA's largest domains. Configuration and security is the biggest block here at 25%, and every domain name starts with the word "Application".
Pick CKAD if you ship services onto a cluster someone else runs. Pick the CKA if you run the cluster. If you do both, CKAD first: it is the gentler of the two and most of its material is a prerequisite for the CKA anyway.
What the exam is actually like
Speed is the exam. 15-20 tasks in 120 minutes is roughly six minutes each, and most people who fail knew every concept involved. They typed too slowly, wrote YAML by hand instead of generating it, and left tasks untouched. This is why shell setup is step one rather than a footnote.
Nothing here is obscure. The curriculum is core Kubernetes objects you already use if you deploy to Kubernetes at work. There is no trivia, no hidden corner of the API. The difficulty is entirely in execution under a clock.
The docs are open and they are a trap. You may use kubernetes.io/docs, the Kubernetes blog and helm.sh/docs, and you may search within them — but not open an external result. Two or three lookups are fine. Ten will cost you the exam.
Tasks are independent and weighted individually. Each states its weight and runs in a named namespace and context. Read the context line every single time; a perfect answer in the wrong namespace scores zero.
Before you book
The fee includes one free retake and twelve months to schedule, so a slightly early first attempt is a cheap way to find out which domains need work. The certification is valid for two years.
Budget hands-on hours, not reading hours. You cannot pass a performance-based exam by having read about probes.
New to Linux and the command line?
This path assumes fundamentals you may not have yet. Our Foundations Pack is out and free — Linux, the shell and Git, with exercises that mark your work and explain why you got it wrong. We're writing an agents pack next; leave your email if you want to hear when it ships.
One email when the pack launches. No spam, unsubscribe any time.
Exam domains
Application Design and Build
20%Application Deployment
20%Application Observability and Maintenance
15%Application Environment, Configuration and Security
25%Services and Networking
20%Preparation path
- 1
Set up a throwaway cluster and a fast shell
One kind cluster is enough — you never touch a control plane in this exam. Spend the time instead on the kubectl alias, completion and the --dry-run=client -o yaml habit. Candidates lose CKAD on typing speed, so make the shortcuts automatic from day one and use them for every step below.
~4 hours - 2
Learn Pods, workload resources and multi-container patterns
The first 20%. Know which workload resource fits a described job — a batch task is a Job, a nightly task is a CronJob — and be able to write an init container and a sidecar from memory. These are generated fast with kubectl run and then edited, not typed from scratch.
~20 hoursPodsKubernetes · FreeInit ContainersKubernetes · FreeSidecar ContainersKubernetes · FreeCronJobKubernetes · FreeKubernetes: Up and RunningBrendan Burns, Joe Beda, Kelsey Hightower, Lachlan Evenson · Paid · aff — Affiliate link — we may earn a commission at no extra cost to you. A free alternative is always listed alongside. - 3
Drill the configuration and security domain — it is the largest
At 25% this is the biggest single block of marks, and it is almost all mechanical: mount a ConfigMap as a volume, inject a Secret as an env var, set a securityContext runAsUser, apply a resource quota. Practise each mounting style until you stop looking it up, because each lookup costs a minute you need elsewhere.
~22 hours - 4
Cover deployment, Helm and Kustomize
Rolling updates and rollbacks are reliable marks. Blue/green and canary are asked as primitives — two Deployments and a Service selector you edit — not as a product feature. Helm appears as install, upgrade and rollback of an existing chart, so learn the CLI rather than chart authoring.
~16 hours - 5
Cover networking, probes and debugging
Services, Ingress and NetworkPolicies are 20%, and observability another 15%. Deliberately break your own app — wrong selector, wrong targetPort, a probe that fails — and fix it from kubectl describe and logs alone. That symptom-to-cause mapping is what makes the debugging tasks quick.
~20 hours - 6
Take timed simulations until you finish with time left
Two hours, 15-20 tasks, only kubernetes.io, the Kubernetes blog and helm.sh open. Start with the free Killercoda scenarios, then sit a full simulator. Score the run on how many tasks you finished, not just how many you got right — unfinished is the usual failure mode.
~14 hours
Frequently asked questions
Career Roadmaps
- Platform Engineer RoadmapThe path DevOps engineers move into — building an internal developer platform as a product, covering Kubernetes as substrate, IaC at scale, GitOps, golden paths, portals, policy, multi-tenancy and adoption.
- DevOps Engineer RoadmapA structured path from Linux fundamentals through cloud infrastructure, automation, containers, and monitoring to a production-ready DevOps engineering career.