GnoseedGnoseed
Certifications guide

Which Cloud Native Certification Should You Take?

CNCF now runs more associate-level certifications than most people realise, and they are not a ladder — each one covers a different project. This guide sets the eight most established side by side so you can pick the one your job actually rewards, instead of collecting the cheapest badge.

certifications compared
8
certifications compared
read
11 min read
read
last updated
August 2026
last updated
Overview

Eight associate exams, one decision

Most people meet cloud native certification through the Kubernetes credentials — CKA, CKAD and CKS — and assume everything else is a step on the same ladder. It is not. Alongside them, CNCF and The Linux Foundation run a whole associate tier, and each exam certifies a different project or concern. This guide compares the eight most established: the cloud native landscape as a whole, its security model, its metrics stack, its tracing standard, its service mesh, its delivery model, the Argo project, and Cilium's eBPF networking. Passing one says nothing about the others. The catalogue lists newer ones besides: KCA (Kyverno) has its own guide here, while CNPA (cloud native platform engineering) and CBA (Backstage) now have guides of their own.

They are also remarkably uniform in shape, which makes the choice a question of subject rather than of difficulty. Every one of the eight has no prerequisites, costs $250 for the exam alone, is valid for two years, carries a 12-month eligibility window and includes one retake. Seven of the eight are 90-minute multiple-choice exams rated at beginner level. Only ICA breaks the pattern — two hours, performance-based as well as multiple choice, and rated intermediate — which makes it the one that genuinely needs cluster time rather than recall.

That uniformity is the useful part: since none of them gates another and all of them cost the same, there is no ordering to obey and no reason to take one you do not care about. The right question is which project you already touch, or want to touch next. Below, each exam is broken down with what it tests and who it suits, followed by a decision guide. Every figure here was read off the Linux Foundation certification pages in August 2026 — confirm the current price and policy at the source before you buy, because bundles and terms change. Gnoseed neither sells, proctors nor guarantees any of these exams; it is a free study companion.

Side by side

How the eight compare

Aspect KCNAKubernetes and Cloud Native AssociateKCSAKubernetes and Cloud Native Security AssociatePCAPrometheus Certified AssociateOTCAOpenTelemetry Certified AssociateICAIstio Certified AssociateCGOACertified GitOps AssociateCAPACertified Argo Project AssociateCCACilium Certified Associate
Focus The broad on-ramp to the whole landscapeThe security model and threat model, not the hardening commandsMetrics, PromQL and the Prometheus data modelTraces, the Collector and vendor-neutral instrumentationThe one that puts you in a live meshThe principles and vocabulary, deliberately tool-agnosticThe whole Argo project, not just Argo CDeBPF networking, policy and observability with Cilium
Level Associate · beginnerAssociate · beginnerAssociate · beginnerAssociate · beginnerAssociate · intermediateAssociate · beginnerAssociate · beginnerAssociate · beginner
Format Multiple choice · 90 minMultiple choice · 90 minMultiple choice · 90 minMultiple choice · 90 minPerformance-based and multiple choice · 2hMultiple choice · 90 minMultiple choice · 90 minMultiple choice · 90 min
Prerequisite NoneNoneNoneNoneNoneNoneNoneNone
Best for Newcomers, students, people moving into cloud-native rolesAnyone whose job touches cluster security without being CKS-deepSREs, platform engineers, anyone who owns the metrics stackEngineers instrumenting services and running the CollectorPlatform engineers running a service mesh in productionAnyone delivering with Argo CD, Flux or a home-grown reconcilerEngineers running Argo CD, Workflows, Events or RolloutsPlatform and cloud engineers running Cilium as their CNI
Breakdown

The eight associate certifications, one by one

What each exam tests, who it is for, and the Gnoseed decks that map to it. Where a certification already has its own domain-by-domain guide on this site, it is linked from the summary.

KCNA

Kubernetes and Cloud Native Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

KCNA is the widest and shallowest of the eight: container orchestration, Kubernetes architecture, application delivery, observability and cloud native architecture, all at a conceptual level and none of it hands-on. It is the only associate exam that tries to cover the landscape rather than one project, which makes it the natural first badge — and the least informative one about any particular skill.

Choose this if…

  • You are new to Kubernetes and the cloud native ecosystem
  • You want a recognised credential before attempting a hands-on exam
  • Your role is adjacent — product, pre-sales, junior dev — and you need vocabulary you can trust

Study with Gnoseed

Kubernetes Fundamentals · 91 cardsDocker Fundamentals · 63 cardsHelm — The Kubernetes Package Manager · 81 cardsPrometheus & Observability · 79 cards
KCSA

Kubernetes and Cloud Native Security Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

KCSA covers cluster component security, security fundamentals, the Kubernetes threat model, platform security, the cloud native security overview and compliance frameworks. It has the flattest blueprint of any CNCF associate exam, so "study the biggest domain first" is bad advice here. Its own KCSA guide maps it domain by domain — including the 4Cs framing the exam still asks for and the upstream docs no longer teach.

Choose this if…

  • Security is part of your remit but CKS is more than you need
  • You want the vocabulary — threat model, 4Cs, compliance scope — rather than the terminal drills
  • You already operate clusters and want the security lens on them

Study with Gnoseed

Kubernetes Security & Cluster Hardening · 81 cardsOPA / Gatekeeper — Policy as Code · 48 cardsFalco — Runtime Security · 48 cardsSoftware Supply Chain Security · 113 cards
PCA

Prometheus Certified Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

PCA is about observability fundamentals, the Prometheus architecture, PromQL, instrumentation and exposition, and alerting. Because it is multiple choice rather than terminal-based, it rewards knowing the data model and the query semantics cold — the shape of knowledge flashcards are unusually good at. It has its own PCA guide.

Choose this if…

  • You maintain or query Prometheus regularly
  • Alerting rules and PromQL are part of your week
  • You want a credential that certifies a tool you actually run

Study with Gnoseed

Prometheus & Observability · 79 cardsObservability: Grafana, Logs & Traces · 62 cards
OTCA

OpenTelemetry Certified Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

OTCA covers the OpenTelemetry API and SDK, the Collector and its pipelines, semantic conventions, and the signals themselves. It pairs naturally with PCA — Prometheus certifies the metrics you scrape, OpenTelemetry certifies how the telemetry is produced and shipped in the first place. It has its own OTCA guide.

Choose this if…

  • You instrument applications rather than only scrape them
  • You run or configure the OpenTelemetry Collector
  • You want a credential that is deliberately vendor-neutral

Study with Gnoseed

Observability: Grafana, Logs & Traces · 62 cardsPrometheus & Observability · 79 cards
ICA

Istio Certified Associate

Associate · intermediatePerformance-based and multiple choice · 2hPrereq: None

ICA is the outlier of the eight: two hours instead of ninety minutes, performance-based as well as multiple choice, and rated intermediate rather than beginner. Its blueprint changed in August 2025 — five domains became four, Installation rose to 20%, and Troubleshooting replaced Advanced Scenarios — so material predating that is misleading. Its own ICA guide covers the current split and says plainly which parts flashcards cannot buy you.

Choose this if…

  • Istio is running in an environment you are responsible for
  • You can get cluster time to practise, not just study time
  • You want the associate credential with the most hands-on weight

Study with Gnoseed

Service Mesh: Istio & Linkerd · 118 cardsKubernetes Fundamentals · 91 cards
CGOA

Certified GitOps Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

CGOA was launched with the CD Foundation and is unusual in how little of it is about tools: GitOps principles are 30% and terminology another 20%, so half the exam is the OpenGitOps vocabulary rather than any product. Candidates who arrive expecting an Argo CD exam are the ones who fail it. Its own CGOA guide is blunt about which parts of the GitOps track are on the blueprint and which are not.

Choose this if…

  • You practise GitOps and want the concepts named precisely
  • Your team argues about what counts as GitOps
  • You want a delivery credential that is not tied to one product

Study with Gnoseed

GitOps with Argo CD & Flux · 140 cardsTerraform Fundamentals · 76 cardsCI/CD with GitHub Actions · 54 cards
CAPA

Certified Argo Project Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

The trap in CAPA is its shape: Argo Workflows is 36% of the blueprint, a larger domain than Argo CD at 34%, with Rollouts at 18% and Events at 12%. Most candidates prepare as though it were an Argo CD exam and lose half the paper. Its own CAPA guide maps all four domains, which Gnoseed now covers across two tracks.

Choose this if…

  • You run more of the Argo project than just Argo CD
  • Batch or event-driven pipelines are part of your platform
  • You already hold or plan CGOA and want the tooling depth

Study with Gnoseed

GitOps with Argo CD & Flux · 140 cardsArgo Workflows & Argo Events · 90 cardsKubernetes Fundamentals · 91 cards
CCA

Cilium Certified Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

CCA is the only Cilium-specific credential, and its blueprint is not the one the project's reputation implies: eBPF is 10%, while Architecture (20%), Network Policy (18%) and Service Mesh (16%) are 54% between them. It is also the most networking-literate of the eight — the Linux Foundation recommends you already know the seven-layer model and how TCP, UDP, DNS and HTTP behave. Its own CCA guide walks all eight domains by weight.

Choose this if…

  • Cilium is the CNI in your clusters, not a thing you have read about
  • You write network policy and want the L7 and DNS-aware types straight
  • You want a networking credential tied to a product rather than a concept

Study with Gnoseed

Cilium — eBPF Networking · 60 cardsKubernetes Fundamentals · 91 cardsNetworking Fundamentals · 69 cards
Decision guide

Still not sure? Pick by what is on your screen today

Since none of these exams gates another and all eight cost the same, the only sensible ordering is the one your work already suggests.

  • If you are

    New to cloud native altogether

    Take KCNA first. It is the only one that maps the landscape, which makes every later exam easier to place.

    Start with Kubernetes Fundamentals
  • If you are

    You own the monitoring stack

    PCA if you mostly query and alert on Prometheus; OTCA if you are the one adding instrumentation. Together they cover the pipeline end to end.

    Start with Prometheus & Observability
  • If you are

    Security is in your job title

    KCSA. It certifies the threat model and compliance vocabulary that CKA never asks for, without demanding CKS-level terminal work.

    Start with Kubernetes Security & Cluster Hardening
  • If you are

    You deploy with Argo CD or Flux

    CGOA for the principles, then CAPA if your platform runs Workflows, Events or Rollouts as well — and budget most of your CAPA time for Workflows.

    Start with GitOps with Argo CD & Flux
  • If you are

    A service mesh is in production and it is yours

    ICA — but plan for cluster practice, not just study. It is the only performance-based exam of the eight.

    Start with Service Mesh: Istio & Linkerd
  • If you are

    You want the badge that opens the most doors

    None of these. The professional Kubernetes credentials carry more hiring weight — see the Kubernetes certification guide and start with CKA.

    Start with Kubernetes Troubleshooting Scenarios
Logistics

Cost, validity and where to register

All eight exams are bought and booked through the Linux Foundation training portal. As listed there in August 2026, each is $250 for the exam alone and includes one retake, a 12-month eligibility window in which to sit it, and a certification valid for two years. None has a prerequisite. Bundles that pair an exam with its LFS prep course are sold at higher prices, and annual subscriptions are advertised at a discount.

The question count is not published for any of them, so a specific number you find on a prep site is someone's guess. The pass mark is published, though not on the certification pages: the Linux Foundation candidate documentation puts every multiple-choice exam at 75 % — a higher bar than the 66 % on the hands-on CKA. Prices and policies change and the Linux Foundation runs frequent promotions, so check the official certification page before you buy rather than trusting a figure quoted anywhere else — including this one. Gnoseed is free, sells no vouchers, and is not affiliated with CNCF or the Linux Foundation.

FAQ

Common questions

Are the CNCF associate certifications worth it? +

Individually they are cheap and narrow: $250, two years of validity, and each certifies one project. They rarely appear by name in job adverts, so the honest value is the structure — a published blueprint that forces you through a tool properly, and a deadline that makes you finish. Pick the exam covering something you already touch at work; collecting badges for projects you do not use is the way to waste the money.

Which cloud native certification should I take first? +

If you are new to the ecosystem, KCNA — it is the only associate exam that covers the landscape rather than a single project, so it makes the others easier to place. If you already work with a specific tool every day, skip KCNA and take that tool's exam directly; none of the eight is a prerequisite for another.

Are the CNCF associate certifications multiple choice? +

Seven of the eight are: KCNA, KCSA, PCA, OTCA, CGOA, CAPA and CCA are all 90-minute multiple-choice exams. ICA is the exception — two hours, performance-based as well as multiple choice, and rated intermediate rather than beginner, so it needs real cluster practice.

How much do the CNCF associate certifications cost? +

As listed on the Linux Foundation certification pages in August 2026, each of the eight is $250 for the exam on its own, including one retake and a 12-month window to sit it. Course bundles cost more. Prices change often, so confirm on the official page before buying.

How long do these certifications last? +

Two years from the date you pass, for all eight. There is no upgrade path between them and no continuing-education route — renewal means sitting the exam again.

Is KCNA required before KCSA, PCA or the others? +

No. None of the eight associate exams has any prerequisite, including KCNA. They are parallel credentials over different projects, not a ladder, so you can take them in any order or take only the one that matches your work.

How is this different from the Kubernetes certifications guide? +

That guide covers the professional Kubernetes credentials — CKA, CKAD and CKS — which are performance-based, carry more hiring weight, and in the case of CKS require an active CKA. This one covers the associate tier around them: eight cheaper, mostly multiple-choice exams that each certify one project in the wider ecosystem.

Pick the project you already touch

Choose the exam that matches your actual work, then plant your first seed. Ten minutes a day is what turns a blueprint into recall you can rely on under exam conditions.

Start learning free