Certifications guide

Which Cloud Native Certification Should You Take?

CNCF now runs seven associate-level certifications, and they are not a ladder — each one covers a different project. This guide sets them side by side so you can pick the one your job actually rewards, instead of collecting the cheapest badge.

certifications compared
7
certifications compared
read
11 min read
read
last updated
August 2026
last updated
Overview

Seven associate exams, one decision

Most people meet cloud native certification through the Kubernetes credentials — CKA, CKAD and CKS — and assume everything else is a step on the same ladder. It is not. Alongside them, CNCF and The Linux Foundation run seven associate-level exams, and each one certifies a different project or concern: the cloud native landscape as a whole, its security model, its metrics stack, its tracing standard, its service mesh, its delivery model, and the Argo project. Passing one says nothing about the others.

They are also remarkably uniform in shape, which makes the choice a question of subject rather than of difficulty. Every one of the seven has no prerequisites, costs $250 for the exam alone, is valid for two years, carries a 12-month eligibility window and includes one retake. Six of the seven are 90-minute multiple-choice exams rated at beginner level. Only ICA breaks the pattern — two hours, performance-based as well as multiple choice, and rated intermediate — which makes it the one that genuinely needs cluster time rather than recall.

That uniformity is the useful part: since none of them gates another and all of them cost the same, there is no ordering to obey and no reason to take one you do not care about. The right question is which project you already touch, or want to touch next. Below, each exam is broken down with what it tests and who it suits, followed by a decision guide. Every figure here was read off the Linux Foundation certification pages in August 2026 — confirm the current price and policy at the source before you buy, because bundles and terms change. Gnoseed neither sells, proctors nor guarantees any of these exams; it is a free study companion.

Side by side

How the seven compare

Aspect KCNAKubernetes and Cloud Native AssociateKCSAKubernetes and Cloud Native Security AssociatePCAPrometheus Certified AssociateOTCAOpenTelemetry Certified AssociateICAIstio Certified AssociateCGOACertified GitOps AssociateCAPACertified Argo Project Associate
Focus The broad on-ramp to the whole landscapeThe security model and threat model, not the hardening commandsMetrics, PromQL and the Prometheus data modelTraces, the Collector and vendor-neutral instrumentationThe one that puts you in a live meshThe principles and vocabulary, deliberately tool-agnosticThe whole Argo project, not just Argo CD
Level Associate · beginnerAssociate · beginnerAssociate · beginnerAssociate · beginnerAssociate · intermediateAssociate · beginnerAssociate · beginner
Format Multiple choice · 90 minMultiple choice · 90 minMultiple choice · 90 minMultiple choice · 90 minPerformance-based and multiple choice · 2hMultiple choice · 90 minMultiple choice · 90 min
Prerequisite NoneNoneNoneNoneNoneNoneNone
Best for Newcomers, students, people moving into cloud-native rolesAnyone whose job touches cluster security without being CKS-deepSREs, platform engineers, anyone who owns the metrics stackEngineers instrumenting services and running the CollectorPlatform engineers running a service mesh in productionAnyone delivering with Argo CD, Flux or a home-grown reconcilerEngineers running Argo CD, Workflows, Events or Rollouts
Breakdown

The seven associate certifications, one by one

What each exam tests, who it is for, and the Gnoseed decks that map to it. Where a certification already has its own domain-by-domain guide on this site, it is linked from the summary.

KCNA

Kubernetes and Cloud Native Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

KCNA is the widest and shallowest of the seven: container orchestration, Kubernetes architecture, application delivery, observability and cloud native architecture, all at a conceptual level and none of it hands-on. It is the only associate exam that tries to cover the landscape rather than one project, which makes it the natural first badge — and the least informative one about any particular skill.

Choose this if…

  • You are new to Kubernetes and the cloud native ecosystem
  • You want a recognised credential before attempting a hands-on exam
  • Your role is adjacent — product, pre-sales, junior dev — and you need vocabulary you can trust
KCSA

Kubernetes and Cloud Native Security Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

KCSA covers cluster component security, security fundamentals, the Kubernetes threat model, platform security, the cloud native security overview and compliance frameworks. It has the flattest blueprint of any CNCF associate exam, so "study the biggest domain first" is bad advice here. Its own <a href="/guides/kubernetes-cloud-native-security-associate">KCSA guide</a> maps it domain by domain — including the 4Cs framing the exam still asks for and the upstream docs no longer teach.

Choose this if…

  • Security is part of your remit but CKS is more than you need
  • You want the vocabulary — threat model, 4Cs, compliance scope — rather than the terminal drills
  • You already operate clusters and want the security lens on them
PCA

Prometheus Certified Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

PCA is about observability fundamentals, the Prometheus architecture, PromQL, instrumentation and exposition, and alerting. Because it is multiple choice rather than terminal-based, it rewards knowing the data model and the query semantics cold — the shape of knowledge flashcards are unusually good at. It has its own <a href="/guides/prometheus-certified-associate">PCA guide</a>.

Choose this if…

  • You maintain or query Prometheus regularly
  • Alerting rules and PromQL are part of your week
  • You want a credential that certifies a tool you actually run
OTCA

OpenTelemetry Certified Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

OTCA covers the OpenTelemetry API and SDK, the Collector and its pipelines, semantic conventions, and the signals themselves. It pairs naturally with PCA — Prometheus certifies the metrics you scrape, OpenTelemetry certifies how the telemetry is produced and shipped in the first place. It has its own <a href="/guides/opentelemetry-certified-associate">OTCA guide</a>.

Choose this if…

  • You instrument applications rather than only scrape them
  • You run or configure the OpenTelemetry Collector
  • You want a credential that is deliberately vendor-neutral
ICA

Istio Certified Associate

Associate · intermediatePerformance-based and multiple choice · 2hPrereq: None

ICA is the outlier of the seven: two hours instead of ninety minutes, performance-based as well as multiple choice, and rated intermediate rather than beginner. Its blueprint changed in August 2025 — five domains became four, Installation rose to 20%, and Troubleshooting replaced Advanced Scenarios — so material predating that is misleading. Its own <a href="/guides/istio-certified-associate">ICA guide</a> covers the current split and says plainly which parts flashcards cannot buy you.

Choose this if…

  • Istio is running in an environment you are responsible for
  • You can get cluster time to practise, not just study time
  • You want the associate credential with the most hands-on weight
CGOA

Certified GitOps Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

CGOA was launched with the CD Foundation and is unusual in how little of it is about tools: GitOps principles are 30% and terminology another 20%, so half the exam is the OpenGitOps vocabulary rather than any product. Candidates who arrive expecting an Argo CD exam are the ones who fail it. Its own <a href="/guides/certified-gitops-associate">CGOA guide</a> is blunt about which parts of the GitOps track are on the blueprint and which are not.

Choose this if…

  • You practise GitOps and want the concepts named precisely
  • Your team argues about what counts as GitOps
  • You want a delivery credential that is not tied to one product
CAPA

Certified Argo Project Associate

Associate · beginnerMultiple choice · 90 minPrereq: None

The trap in CAPA is its shape: <strong>Argo Workflows is 36% of the blueprint, a larger domain than Argo CD at 34%</strong>, with Rollouts at 18% and Events at 12%. Most candidates prepare as though it were an Argo CD exam and lose half the paper. Its own <a href="/guides/certified-argo-project-associate">CAPA guide</a> maps all four domains, which Gnoseed now covers across two tracks.

Choose this if…

  • You run more of the Argo project than just Argo CD
  • Batch or event-driven pipelines are part of your platform
  • You already hold or plan CGOA and want the tooling depth
Decision guide

Still not sure? Pick by what is on your screen today

Since none of these exams gates another and all seven cost the same, the only sensible ordering is the one your work already suggests.

  • If you are

    New to cloud native altogether

    Take KCNA first. It is the only one that maps the landscape, which makes every later exam easier to place.

    Start with Kubernetes Fundamentals
  • If you are

    You own the monitoring stack

    PCA if you mostly query and alert on Prometheus; OTCA if you are the one adding instrumentation. Together they cover the pipeline end to end.

    Start with Prometheus & Observability
  • If you are

    Security is in your job title

    KCSA. It certifies the threat model and compliance vocabulary that CKA never asks for, without demanding CKS-level terminal work.

    Start with Kubernetes Security & Cluster Hardening
  • If you are

    You deploy with Argo CD or Flux

    CGOA for the principles, then CAPA if your platform runs Workflows, Events or Rollouts as well — and budget most of your CAPA time for Workflows.

    Start with GitOps with Argo CD & Flux
  • If you are

    A service mesh is in production and it is yours

    ICA — but plan for cluster practice, not just study. It is the only performance-based exam of the seven.

    Start with Service Mesh: Istio & Linkerd
  • If you are

    You want the badge that opens the most doors

    None of these. The professional Kubernetes credentials carry more hiring weight — see the Kubernetes certification guide and start with CKA.

    Start with Kubernetes Troubleshooting Scenarios
Logistics

Cost, validity and where to register

All seven exams are bought and booked through the Linux Foundation training portal. As listed there in August 2026, each is $250 for the exam alone and includes one retake, a 12-month eligibility window in which to sit it, and a certification valid for two years. None has a prerequisite. Bundles that pair an exam with its LFS prep course are sold at higher prices, and annual subscriptions are advertised at a discount.

Neither the question count nor the pass mark is published for any of the seven, so any specific number you find on a prep site is someone's guess. Prices and policies change and the Linux Foundation runs frequent promotions, so check the official certification page before you buy rather than trusting a figure quoted anywhere else — including this one. Gnoseed is free, sells no vouchers, and is not affiliated with CNCF or the Linux Foundation.

FAQ

Common questions

Which cloud native certification should I take first? +

If you are new to the ecosystem, KCNA — it is the only associate exam that covers the landscape rather than a single project, so it makes the others easier to place. If you already work with a specific tool every day, skip KCNA and take that tool's exam directly; none of the seven is a prerequisite for another.

Are the CNCF associate certifications multiple choice? +

Six of the seven are: KCNA, KCSA, PCA, OTCA, CGOA and CAPA are all 90-minute multiple-choice exams. ICA is the exception — two hours, performance-based as well as multiple choice, and rated intermediate rather than beginner, so it needs real cluster practice.

How much do the CNCF associate certifications cost? +

As listed on the Linux Foundation certification pages in August 2026, each of the seven is $250 for the exam on its own, including one retake and a 12-month window to sit it. Course bundles cost more. Prices change often, so confirm on the official page before buying.

How long do these certifications last? +

Two years from the date you pass, for all seven. There is no upgrade path between them and no continuing-education route — renewal means sitting the exam again.

Is KCNA required before KCSA, PCA or the others? +

No. None of the seven associate exams has any prerequisite, including KCNA. They are parallel credentials over different projects, not a ladder, so you can take them in any order or take only the one that matches your work.

How is this different from the Kubernetes certifications guide? +

That guide covers the professional Kubernetes credentials — CKA, CKAD and CKS — which are performance-based, carry more hiring weight, and in the case of CKS require an active CKA. This one covers the associate tier around them: seven cheaper, mostly multiple-choice exams that each certify one project in the wider ecosystem.

Pick the project you already touch

Choose the exam that matches your actual work, then plant your first seed. Ten minutes a day is what turns a blueprint into recall you can rely on under exam conditions.

Start learning free