Kubestronaut: the five-certification roadmap
By Ibrahim Yesilay · Published · Updated
Kubestronaut is the CNCF title for holding all five Kubernetes certifications (KCNA, KCSA, CKA, CKAD and CKS) at the same time. This page gives the official rule, a recommended order with a reason for each step, the list price and format of every exam, and what you can practise on GoldenKube today.
Independent community project, not affiliated with or endorsed by the CNCF or the Linux Foundation. The program itself lives at cncf.io/training/kubestronaut.
The rule, from the CNCF FAQ
Do all 5 certifications need to be active at the same time?
"Yes, all 5 certifications need to be active at the same time."
The five, in the order we suggest
Our recommendation, not a CNCF sequence. The one official constraint is that CKS requires a passed CKA. Status badges show what GoldenKube can offer for each exam today.
Start with KCNA. It is multiple-choice, it shares the lowest list price of the five with KCSA, and it teaches the vocabulary every later exam assumes: control plane components, workloads, services, delivery and the CNCF landscape. GoldenKube has a full practice bank for it, so you can begin today.
Theory: Available288 questionsTake KCSA while the Kubernetes vocabulary is fresh. It is the second multiple-choice exam and covers cluster component security, the threat model and platform security at associate level; that map makes the hardening topics in CKA familiar and prepares the ground for CKS. The GoldenKube bank covers it in full.
Theory: Available310 questionsCKA is the centre of the five. It is the first hands-on exam, it is the one CKS officially requires you to have passed, and its domains (cluster architecture, workloads, services and networking, storage, troubleshooting) are the foundation CKAD builds on. Hands-on CKA labs on GoldenKube are in preview: scenarios are published, the CLI is not public yet.
Hands-on labs: PreviewCKAD looks at the same cluster from the application side: building, configuring, exposing and observing workloads. It overlaps heavily with CKA, so taking it straight after reuses the same kubectl speed and the same practice habits. GoldenKube labs for CKAD are planned.
Hands-on labs: PlannedCKS comes last because the Linux Foundation requires a passed CKA before you sit it. It adds cluster and system hardening, supply chain security and runtime security on top of the CKA skills, and the KCSA concepts from step two are the theory behind most of its tasks. GoldenKube labs for CKS are planned.
Hands-on labs: Planned
What Kubestronaut is
Kubestronaut is the CNCF recognition for people who hold all five Kubernetes certifications from the Linux Foundation: KCNA, KCSA, CKA, CKAD and CKS. The CNCF FAQ states the requirement as: "To become a Kubestronaut, you need to pass all Kubernetes-related certifications: CKA, CKAD, CKS, KCNA, and KCSA. All certifications must be current/active (i.e., in good standing, not expired)." It is a title and a community, not an exam of its own: there is nothing extra to sit once the five are passed, and the CNCF confirms new Kubestronauts on a weekly rhythm after the onboarding form is accepted. Golden Kubestronaut is the larger title on top of it, covering every CNCF certification plus LFCS, and has its own page on this site. GoldenKube is independent of the CNCF and the Linux Foundation; everything on this page about rules is quoted from the official FAQ, as read on 2026-10-28.
Two of the five are multiple-choice exams (KCNA and KCSA) and three are performance-based exams taken in a live terminal (CKA, CKAD and CKS). That split matters for planning: the multiple-choice pair can be prepared with practice questions, the hands-on three need time at a cluster.
The FAQ also lists benefits for current Kubestronauts, such as the exclusive jacket, a discount voucher for CNCF events and exam vouchers issued each January while the status is maintained. GoldenKube cannot confirm or grant any benefit; the program page is the authority.
The rule: all five must be active at the same time
The CNCF FAQ asks "Do all 5 certifications need to be active at the same time?" and answers: "Yes, all 5 certifications need to be active at the same time." It adds that there is no deadline for collecting them: "The only condition is to have all certifications active, regardless of when they were passed." In practice that means the five certifications, each valid for two years from the date it is earned, must all be unexpired on the day you qualify. If your first certification lapses before you pass the fifth, you renew it rather than start over. After you hold the title, the FAQ states: "The Kubestronaut title is valid until the end of the year in which their first of the 5 certifications expires." The CNCF sends a reminder every October, and a Kubestronaut who does not renew by year end loses the title and its benefits until they requalify.
For planning this has one consequence: the clock starts with the first exam you pass. A path that takes longer than two years needs a renewal of the earliest certification somewhere along the way, so a compact schedule costs less than a slow one.
New exams can join the requirements. The FAQ says that when a new Kubernetes exam reaches general availability it is added to the Kubestronaut prerequisites and that "no requirement takes effect earlier than 90 days after GA", with the enforcement date posted on the program page. On the check date the list is the five above.
Recommended order for the five
There is no official order. The only dependency the Linux Foundation states is on the CKS page: a passed CKA is required first. Our suggested sequence is 1. KCNA, 2. KCSA, 3. CKA, 4. CKAD, 5. CKS: the two multiple-choice exams first because they are cheaper, faster to prepare and teach the vocabulary the terminal exams assume, then the three hands-on exams close together so kubectl habits do not fade between them, with CKS last because of its prerequisite. The same reasoning drives the sixteen-exam order on the Golden Kubestronaut page; this is that order with the non-Kubernetes exams removed. If you already work with Kubernetes daily, swap the two blocks and let the associate exams fill the gaps.
1. KCNA. Start with KCNA. It is multiple-choice, it shares the lowest list price of the five with KCSA, and it teaches the vocabulary every later exam assumes: control plane components, workloads, services, delivery and the CNCF landscape. GoldenKube has a full practice bank for it, so you can begin today.
2. KCSA. Take KCSA while the Kubernetes vocabulary is fresh. It is the second multiple-choice exam and covers cluster component security, the threat model and platform security at associate level; that map makes the hardening topics in CKA familiar and prepares the ground for CKS. The GoldenKube bank covers it in full.
3. CKA. CKA is the centre of the five. It is the first hands-on exam, it is the one CKS officially requires you to have passed, and its domains (cluster architecture, workloads, services and networking, storage, troubleshooting) are the foundation CKAD builds on. Hands-on CKA labs on GoldenKube are in preview: scenarios are published, the CLI is not public yet.
4. CKAD. CKAD looks at the same cluster from the application side: building, configuring, exposing and observing workloads. It overlaps heavily with CKA, so taking it straight after reuses the same kubectl speed and the same practice habits. GoldenKube labs for CKAD are planned.
5. CKS. CKS comes last because the Linux Foundation requires a passed CKA before you sit it. It adds cluster and system hardening, supply chain security and runtime security on top of the CKA skills, and the KCSA concepts from step two are the theory behind most of its tasks. GoldenKube labs for CKS are planned.
The five at a glance: format, price, time and GoldenKube status
The table reads each figure from the official certification page as checked on 2026-10-23. Prices are list prices in US dollars; the Linux Foundation lists a Kubestronaut bundle at $1,645 against $1,835 for the five bought one by one, and runs promotions, so check the checkout price before you buy. The last column is what GoldenKube offers for the exam today: a theory bank you can practise now, hands-on labs in preview, or labs still planned. Preview means the CKA scenarios are published but the CLI that runs them has no public build yet; nothing on this site counts a planned lab as available.
Each exam has a page on this site with its official domains and weights, its exam facts with sources, and either a Start practice button or its lab status. The practice-tests pages are for sitting a run of questions now; the certification pages are for reading about the exam first.
| Step | Exam | Format | List price | Minutes | GoldenKube today |
|---|---|---|---|---|---|
| 1 | KCNA - Kubernetes and Cloud Native Associate | Multiple-choice | $250 | 90 | Theory practice: available (288 questions) |
| 2 | KCSA - Kubernetes and Cloud Native Security Associate | Multiple-choice | $250 | 90 | Theory practice: available (310 questions) |
| 3 | CKA - Certified Kubernetes Administrator | Hands-on | $445 | 120 | Hands-on labs: preview |
| 4 | CKAD - Certified Kubernetes Application Developer | Hands-on | $445 | 120 | Hands-on labs: planned |
| 5 | CKS - Certified Kubernetes Security Specialist | Hands-on | $445 | 120 | Hands-on labs: planned |
How GoldenKube fits the roadmap
For the two multiple-choice exams GoldenKube has question banks you can practise today: 288 KCNA questions and 310 KCSA questions, each with a verdict and a written explanation, an adaptive order that returns to weak domains, spaced repetition for mistakes, and a timed mock exam in the official format for accounts. For the three hands-on exams GoldenKube is building local labs: a command-line tool builds a real kubeadm cluster on your own Mac, runs exam-style tasks and grades them on your machine. CKA scenarios are published and the tool is in preview; CKAD and CKS labs are planned. Everything is free, with ten guest answers before a free account is needed; no practice result on this site is an official score.
- 9 theory banks are live across the wider program; for Kubestronaut the two that matter are KCNA and KCSA.
- Labs grade your cluster state deterministically: the same cluster always gets the same result, and hints and reference solutions stay inside the tool.
- Guest practice needs no account; progress and mock exams need a free one.
Frequently asked questions
Do all five Kubestronaut certifications need to be active at the same time?
Yes. The CNCF FAQ answers this question directly: "Yes, all 5 certifications need to be active at the same time." Each certification is valid for two years, so the earliest one must still be unexpired when you pass the last one, or it has to be renewed.
Is there an official order for the five exams?
No. The only official dependency is that CKS requires a passed CKA. GoldenKube suggests KCNA, KCSA, CKA, CKAD, CKS: multiple-choice first, the hands-on three close together, CKS last.
What happens when one of my certifications expires after I become a Kubestronaut?
The FAQ states: "The Kubestronaut title is valid until the end of the year in which their first of the 5 certifications expires." The CNCF sends a reminder each October; if the expired certification is not renewed by the end of that year, the title and its benefits are lost until you requalify.
Can I practise all five on GoldenKube?
Theory practice is available now for KCNA and KCSA. The hands-on exams need a terminal, so GoldenKube is building local labs: CKA is in preview (scenarios published, CLI not yet public), CKAD and CKS are planned. Planned and preview are shown as such and never as available.
How is Kubestronaut different from Golden Kubestronaut?
Kubestronaut needs the five Kubernetes certifications. Golden Kubestronaut needs every CNCF certification plus LFCS, 16 on the check date, and is kept for life once earned. The Golden Kubestronaut page on this site covers the full list, its order and cost.
Sources
Last updated