In December 2025, I earned the Kubestronaut status. A few months later, the Golden: every CNCF certification, plus the LFCS — sixteen exams in total. This post is not a medal hung on the wall: it is the method I wish I had read before starting, with the order to take them in, the work routine, and an honest paragraph about what all of this really proves.
What the Golden Kubestronaut track is
The CNCF distinguishes two tiers. The Kubestronaut: the five Kubernetes certifications — KCNA, KCSA, CKA, CKAD, CKS. The Golden Kubestronaut: all the rest of the CNCF catalog on top, plus the Linux Foundation's LFCS. Sixteen certifications in all:
- Fundamentals (multiple-choice): KCNA, KCSA
- Hands-on (terminal, 2 h): CKA, CKAD, CKS, LFCS
- Specialized (multiple-choice, with rare exceptions): PCA (Prometheus), ICA (Istio), CCA (Cilium), CAPA (Argo), CGOA (GitOps), KCA (Kyverno), OTCA (OpenTelemetry), CNPA and CNPE (Platform Engineering), CBA (Backstage)
Individual certifications expire and get renewed; the Golden status, however, is earned for life. Only a few hundred people in the world hold it.
TODO(Khalil): check the current figure on cncf.io before publishing.
In what order to take them
There is no imposed order, but there are orders that waste time. Mine follows a simple logic: build the vocabulary, then the hands, then the breadth.
Foundations first: KCNA, then KCSA
The KCNA draws the map of the ecosystem: orchestration, observability, delivery, security. The KCSA lays out Kubernetes' threat model. Two approachable multiple-choice exams that install the vocabulary every following exam takes for granted. Start there, even — especially — if you already practice: you always discover blind spots.
Then the hands-on ones: CKA, CKAD, CKS, LFCS
The heart of the track. The CKA first: it is the one that forges terminal reflexes, and it is a prerequisite for the CKS. The CKAD next, right after — the overlap with the CKA is significant, so capitalize on the training. The CKS third: it is the most demanding exam of the lot; save it for the moment when kubectl has become an extension of your hands. The LFCS closes this block; if your Linux fluency is shaky, take it before the CKA rather than after the CKS.
Finally the specialized ones, grouped by affinity
Ten exams remain. The mistake would be to take them in random order: group them by domain to pool your revision. My groupings: CGOA + CAPA (GitOps and Argo echo each other), CCA + ICA (networking and mesh), PCA + OTCA (observability), KCA (policies), CBA + CNPA (platform). And the CNPE last: it is a hands-on exam that feeds on everything the others have laid down.
My working method
One certification at a time, with a date
I book the exam before I start studying. A date on the calendar turns "someday" into a work plan. Three to four weeks per specialized certification, more for the hands-on ones — and only one certification open at a time.
Hands before flashcards
For every tool, I deploy. A throwaway cluster (kind or k3d on the laptop, an ephemeral managed cluster for whatever requires the cloud), the tool installed from its official documentation, the tutorials walked through at the terminal. For Istio or Cilium, reading the architecture is not enough: it is by breaking the configuration that you come to understand the exam questions. The official curriculum of each certification, published by the CNCF, serves as a shopping list: every line must have been practiced, not just read.
Mock exams, on repeat
For the hands-on exams, the killer.sh sessions included with registration are precious — deliberately harder than the real exam. First session one week out, the second at two or three days: the score matters little, the debriefing is what counts. For the multiple-choice exams, I built my own mock exam applications in React, fed by the official curricula — studying by coding your own revision tool is two lessons for the price of one.
Exam day
The exams take place online, proctored: empty room, clean desk, ID document, locked-down browser. A few rules that served me on every sitting:
- Triage the questions. The points are independent: take the quick questions first, flag the long ones, come back to them. Never let a 4% question steal fifteen minutes from you.
- Imperative first. On the hands-on exams,
kubectl create,kubectl run, and--dry-run=client -o yamlproduce a starting YAML faster than any copy-paste from the documentation — which remains accessible during the exam, but eats time. - Check the context. Every practical question specifies its cluster and namespace. A perfect answer in the wrong place is worth zero.
My working environment fits in a few lines, worth knowing by heart even though most of it now comes preconfigured in the exam environment:
alias k=kubectl
export do="--dry-run=client -o yaml" # k run web --image=nginx $do > pod.yaml
export now="--grace-period=0 --force" # suppression sans attendre
source <(kubectl completion bash)
complete -o default -F __start_kubectl kWhat it changes — and what it doesn't prove
Let's be honest, this is the most important paragraph.
What the track gave me. A complete, structured map of the cloud-native ecosystem, including the territories my daily work never crossed — Backstage, the depths of OpenTelemetry. A shared vocabulary with any team, anywhere. And for the trainer that I am, a legitimacy that is simple to verify: I prepare people for exams I have taken, every single one.
What it doesn't prove. Sixteen certifications do not replace one night on call with a production cluster. A multiple-choice exam is passed with memory; an incident is resolved with judgment, and judgment cannot be examined in 90 minutes. The status proves discipline, breadth of spectrum, and genuine terminal fluency for the hands-on exams. Depth comes from the field — certifications organize it, they do not manufacture it.
Would I do it again? Without hesitation. Not for the title: for the constraint. Forcing yourself to walk the full perimeter of your ecosystem, methodically, is a luxury daily work never offers.
Preparing a certification from the track — or want to bring your team along? I offer preparation courses for each of the sixteen, taught by someone who just sat the same exams.