Golden Kubestronaut: the order to take the 16 exams

How we picked this order

This order is our recommendation, not an official sequence. The Linux Foundation pages we read do not prescribe an order for the sixteen exams, with one exception: the CKS page states that you must have taken and passed the CKA exam first. Everything else here follows three simple rules. Take the dependencies first, group exams that reuse the same preparation, and alternate hands-on blocks with multiple-choice blocks so you do not burn out on terminal practice. If your job already exercises a topic, move that step earlier and keep the rest.

The three rules are cheap to apply. A dependency is anything where the later exam assumes the earlier one: CKS needs CKA officially, and the rest are soft dependencies where one exam teaches vocabulary the next uses. A group is a set of exams with heavy topic overlap, like PCA and OTCA, where studying them together saves relearning. Alternating means you do not schedule four hands-on exams in a row without a multiple-choice break, even though the hands-on exams are the ones that fade fastest if left.

What the order does not account for is certification validity. The exam pages list 2 years of validity, and the sixteen exams add up to a program that, at a sensible pace, runs for well over a year. Whether all certifications must be valid together is not stated on the pages we verified, so check the official program page before deciding how fast to go.

Phase 1: foundations with KCNA and KCSA

Start with the two associate-level Kubernetes exams. They are multiple-choice, they cost the least of the Kubestronaut five, and together they give you a map of Kubernetes and its security model before you touch a hands-on exam. Passing them first also tells you how you handle the Linux Foundation exam process (booking, proctoring, identity checks) at low cost. The reason to go first is not difficulty alone: later exams assume the vocabulary these two teach, so every later hour of study is spent more efficiently.

KCNA. KCNA comes first because it is the cheapest broad map of Kubernetes and the cloud native ecosystem. It is multiple-choice, it names the projects the later exams go deep on, and passing it early gives you a quick win and a feel for how Linux Foundation multiple-choice exams are worded.

KCSA. KCSA follows KCNA while the Kubernetes vocabulary is fresh. It covers the cluster components, the threat model and platform security at associate level, which prepares the ground for CKS later and makes the hardening topics in CKA feel familiar.

Phase 2: the Linux and Kubernetes hands-on core

The second phase is the heavy one: LFCS, CKA, CKAD and CKS are all two-hour hands-on exams in a live command-line environment. They are grouped because they train the same muscle, which is working fast and accurately in a terminal, and because the dependencies run in a line: Linux skills feed CKA, CKA feeds CKAD and is an official prerequisite for CKS. Keep these four close together in time so that the shell and kubectl habits do not fade between exams, and book each exam only when practice runs finish with time to spare.

LFCS. LFCS is the Linux base under every hands-on exam. Fast, calm work at a shell prompt (files, users, storage, networking, services) is the single skill that CKA, CKAD, CKS and CNPE all assume. Doing it before CKA means the Kubernetes exam tests Kubernetes, not your terminal habits.

CKA. CKA is the centre of the program. Cluster architecture, workloads, services and troubleshooting are the foundation for CKAD, for CKS and for the platform work in CNPE, and CKS officially requires a passed CKA. Taking it fourth, after the Linux exam, puts the heaviest dependency early.

CKAD. CKAD looks at the cluster from the application side: building, configuring and exposing workloads. It overlaps heavily with CKA, so taking it straight after CKA reuses the same practice habits and the same speed with kubectl, which makes it one of the cheaper hands-on exams to prepare for in time.

CKS. CKS needs a passed CKA, so it cannot come earlier than fifth or sixth in any order. It adds hardening, supply chain and runtime security on top of cluster skills, and KCSA taken earlier gives you the conceptual map it builds on.

Phase 3: observability with PCA and OTCA

After the hands-on core, switch back to multiple-choice with the observability pair. Prometheus Certified Associate and OpenTelemetry Certified Associate cover metrics, instrumentation, collection and alerting from two angles. Doing them together keeps the concepts in one place in your head, and doing them now gives you a recovery stretch after four demanding hands-on exams. The order inside the phase is PCA then OTCA because PromQL and the metrics model are the part most people already half-know, and OpenTelemetry then widens the picture to traces and logs.

PCA. PCA opens the observability block. Prometheus and PromQL are the common language for metrics on Kubernetes, and several later exams (service mesh, GitOps and platform engineering) assume you can read a dashboard or an alert rule. It is multiple-choice, so it fits in a study gap between hands-on exams.

OTCA. OTCA comes straight after PCA because the two overlap in concepts: instrumentation, signals, collection and export. Studying them back to back lets you compare metrics, traces and logs in one pass instead of relearning observability twice.

Phase 4: delivery and policy with CGOA, CAPA and KCA

Phase four covers how workloads reach the cluster and what rules they must obey: GitOps principles, the Argo project and Kyverno policies. The three share a theme of declarative configuration that is stored, reviewed and enforced automatically. CGOA goes first because it teaches the principles the other two implement. Two of the three, CGOA and CAPA, are among the smaller question banks on this site, so budget time for the official documentation rather than expecting a large bank to carry the preparation.

CGOA. CGOA introduces GitOps principles, the declarative desired-state model that Argo and platform engineering build on. It is a concept-first exam, so it is a good bridge from the observability block into delivery tooling, and it makes CAPA easier to read.

CAPA. CAPA covers the Argo project family. With CGOA behind you, the GitOps ideas are already in place and the exam becomes mostly about how Argo implements them. Its GoldenKube bank is small, so it rewards official documentation reading.

KCA. KCA covers Kyverno, the policy engine for Kubernetes. Policy is easier to learn after CKA and KCSA because you already know which resources and settings a policy would be guarding, and after GitOps because policies are usually shipped as declarative configuration.

Phase 5: networking with CCA and ICA

Phase five is the network layer: Cilium for the data plane and policy, Istio for service mesh traffic management and workload security. The order follows the stack, from the CNI up to the mesh. CCA is multiple-choice and ICA is hands-on, so this phase also returns you to a terminal for the first time since the core. Both assume the Kubernetes networking you studied for CKA, so they are better after it than before it, and the security vocabulary from KCSA helps with both.

CCA. CCA covers Cilium: eBPF networking, network policy, Hubble observability, Cluster Mesh and BGP. It sits after the core exams because it builds on the Kubernetes networking you met in CKA and the network policy ideas from KCSA and KCA.

ICA. ICA is hands-on and covers installing and operating Istio, traffic management and securing workloads. It follows CCA so the networking layers (CNI first, mesh on top) are learned in the order they sit in a cluster. It is also the one hands-on exam priced at the multiple-choice level on its page.

Phase 6: platform engineering with CBA, CNPA and CNPE

The last phase brings the program together: Backstage for the developer portal, CNPA for platform engineering concepts, and CNPE as the hands-on capstone. These three were the most recently expanded part of the program, with CNPA required since 15 October 2025 and CNPE since 1 March 2026, so check the official pages for current curricula before you start. The phase is last because it assumes the rest: GitOps, policy, observability and networking all appear as the pieces a platform is made of.

CBA. CBA covers Backstage, the developer portal framework. It moves the program from running clusters to serving the developers who use them, which is the theme of the last block, and it is multiple-choice, so it works as a lighter step before the platform exams.

CNPA. CNPA is the platform engineering associate exam and the longest multiple-choice exam in the program, with 85 questions in 120 minutes on its page. By this point you have met most of the tools it refers to, so it works as a summary of the whole platform picture.

CNPE. CNPE is last because it is the broadest hands-on exam, required since 1 March 2026, and it rewards everything before it: Kubernetes, GitOps, policy, observability and platform thinking. Leaving it as the capstone means you spend the final preparation on one exam instead of juggling it with others.

The ordered path at a glance

Sixteen steps, in the order below: ten multiple-choice exams and six hands-on exams, with the list price of each exam taken from its official page. The first column is the step, the last is the reason in one line. Hands-on steps fall in phases two, five and six, and the multiple-choice steps fill the gaps between them. The prices add up to the same total whichever order you choose; order changes when you pay, not how much.

If you buy the Golden bundle you pay once regardless of order; if you buy exam by exam, the order above also spreads the cost over time. The cost page works the arithmetic through.

Changing the order for your situation

Move steps freely as long as the CKA-before-CKS rule holds. If you work with Kubernetes daily, do CKA and CKAD first while your hands are warm and fit the associate exams around them. If you are new to Linux, spend extra time in phase two and consider doing LFCS before anything else. If you only want Kubestronaut now, stop after CKS and take the five core exams, since the sixteen-exam order is a superset of them. Holding some certifications already simply removes those steps.

• Already hold CKA or CKAD: the Linux Foundation lists a CKA or CKAD to Kubestronaut upgrade bundle, see the cost page.
• Short on time: put the nine multiple-choice associate exams with the largest GoldenKube banks first, because they can be practised today.
• Work in platform engineering: bring CNPA, CBA and CNPE forward, then fill the rest.
• Worried about renewal: group the exams you expect to renew together so the 2-year validity windows line up.

Frequently asked questions

Sources

• Kubestronaut program, Linux Foundation (read 2026-10-23)
• Golden Kubestronaut bundle, Linux Foundation (read 2026-10-23)