Kubernetes CNPA: CNCF's new Cloud Native Platform Associate cert

CNPA — Cloud Native Platform Associate — launched in 2024 as CNCF's entry-level platform engineering cert. The pitch is straightforward: platform engineering is the role that grew up around DevOps and SRE, and the existing CNCF lineup (KCNA, CKA, CKAD, CKS) didn't have a credential aimed at the platform-engineer-as-product-builder role specifically. CNPA fills that gap. It's $250, 60 multiple-choice questions, 90 minutes, and as of early 2026 it's more theory-focused than CKA's hands-on terminal grind.

Whether it's worth your $250 depends on whether your team is actually building an internal developer platform. If yes, the cert is a useful forcing function on the vocabulary and the design patterns. If no — or if you're just curious about the badge — the answer is "skip it for now."

What CNPA tests

The current blueprint, refreshed in early 2026:

• Platform engineering fundamentals (~20%): the platform-as-product mindset, the difference between SRE and platform engineering and DevOps, golden paths, paved roads, T-shaped vs E-shaped teams, the cognitive load argument from Team Topologies.
• Internal developer platforms (IDPs) (~25%): what an IDP is, the major reference architectures, build vs buy, the Backstage ecosystem, Spotify's portal model, Humanitec's reference IDP, Port and Cortex as alternatives.
• GitOps and continuous delivery (~20%): GitOps principles per CNCF working group, ArgoCD vs Flux trade-offs, progressive delivery (Argo Rollouts, Flagger), pull-based vs push-based pipelines.
• Infrastructure as code at platform scale (~15%): Crossplane and the composition model, Terraform vs Pulumi vs Crossplane for platform abstractions, control plane patterns, configuration management (Kustomize, Helm) at platform scale.
• Observability and platform metrics (~10%): SRE-style SLOs, the four golden signals, OpenTelemetry, what to measure on a platform (DORA metrics, time-to-first-deploy, platform satisfaction).
• Security and policy as code (~10%): OPA / Gatekeeper, Kyverno, supply chain security at platform scope (Sigstore, SLSA awareness), policy guardrails vs gates.

60 questions, 90 minutes, multiple-choice / multi-select. Online via PSI Bridge. $250 USD, includes one free retake. Validity 2 years (CNCF cut from 3 to 2 years in April 2024). Renewal currently requires re-sitting the exam — no online assessment shortcut yet.

Theory vs hands-on: the honest version

CKA, CKAD, and CKS are hands-on terminal exams. You SSH into a real cluster, you fix things, you get scored on outputs. CNPA is not that. CNPA is multiple-choice. You answer questions about platform engineering concepts, GitOps patterns, IDP architectures, and policy frameworks.

This is a deliberate design choice from CNCF. Platform engineering as a discipline is younger than Kubernetes operations, the tooling ecosystem is more diverse (no single "kubectl of platform engineering" yet), and the role is more about judgment and design than about operational reflexes. A multiple-choice exam covers vocabulary and decision-making in a way a terminal exam can't easily replicate.

The trade-off is that CNPA's signal value is correspondingly different. CKA tells employers "this person can fix a broken cluster." CNPA tells employers "this person knows the platform engineering literature." Both are useful, but they map to different roles. Don't take CNPA expecting it to certify implementation skills — it doesn't.

Who CNPA is for

The audience clusters into a few groups:

• Platform engineers at companies building IDPs. This is the core audience. If your team is rolling out Backstage, building Crossplane compositions, defining golden paths for service teams, or arguing about ArgoCD vs Flux in design reviews — this cert is calibrated for you.
• SREs whose role is shifting toward platform. A lot of SRE teams renamed themselves "Platform" in 2022–2024. CNPA is the credential that matches the renamed scope.
• Engineering managers running platform teams. The exam content is heavy on team topology, product mindset, and design judgment — managerially relevant material in a way that CKA isn't.
• Consultants pitching platform engineering services. Thoughtworks, Cprime, Container Solutions, the cloud-native consultancy bench. The cert helps with credibility on platform-as-product engagements.

Notably absent from that list: backend engineers, frontend engineers, data engineers. CNPA isn't for general engineers who happen to use a platform — it's for the people building the platform.

CNPA vs CNPE vs CKA

The CNCF lineup as of early 2026:

Cert	Level	Cost	Format	What it tests
KCNA	Associate	$250	MCQ	K8s fundamentals
KCSA	Associate	$250	MCQ	K8s security fundamentals
CNPA	Associate	$250	MCQ	Platform engineering concepts
CKA	Pro	$445	Hands-on	K8s admin operations
CKAD	Pro	$445	Hands-on	K8s app development
CKS	Pro	$445	Hands-on	K8s security operations
CNPE	Pro	$445	Hands-on	Platform engineering implementation

CNPE — Cloud Native Platform Engineer — is the pro-tier counterpart to CNPA, also launched in 2024. CNPE is hands-on: you build pieces of an IDP under time pressure, configure GitOps pipelines, write Crossplane compositions, set up Backstage scaffolds. It's the cert that maps to "this person can build a platform" while CNPA maps to "this person understands platforms."

If you're senior on platform engineering, CNPE is the better signal. If you're entering or adjacent to the field, CNPA is the entry point.

CKA remains the load-bearing CNCF cert for most Kubernetes work — CNPA does not replace it. The platform engineer who doesn't know kubectl describe pod cold is not a platform engineer. CNPA layers on top of CKA-level knowledge, not in place of it.

Prep time

Background	Hours	Calendar
Platform engineer at IDP-building shop	20–35	3–5 weeks
SRE / cloud engineer with K8s daily	40–60	5–8 weeks
Generalist DevOps engineer	60–90	8–12 weeks
Brand new to platform engineering	100+	12+ weeks

The exam-prep ecosystem for CNPA is still thin in 2026. CNCF's own training course is the primary path. Team Topologies (Skelton & Pais) is required reading for the IDP and team-design content. Platform Engineering on Kubernetes (Camila Martins) covers the technical patterns. The Humanitec reference IDP repo and the Backstage docs cover the practical examples that the exam expects you to recognize.

KCNA is not formally a prereq but is informally helpful — about 15–20% of CNPA content overlaps Kubernetes fundamentals that KCNA tests directly.

Salary signal

Platform engineering as a job title has been outpacing the broader DevOps market on compensation since 2022. Per levels.fyi 2025–2026 data:

• Platform engineer at FAANG / hyperscalers: total comp $230k–$320k.
• Platform engineer at series-B/C startup: $160k–$210k base + equity.
• Senior platform engineer at large enterprise: $170k–$220k base.
• Staff/Principal platform engineer: $250k–$400k+ total comp at top end.

BLS OEWS May 2024 doesn't break platform engineering out separately, but the closest SOC code (15-1244 Network and Computer Systems Administrators) shows median around $96k and 90th percentile around $158k — platform engineers consistently sit above the 90th because the job has shifted upmarket in seniority.

CNPA itself doesn't add a hard $X to your salary. It's a vocabulary cert with implementation-adjacent content. The signal is "this person is taking platform engineering seriously as a discipline." That signal lands well at companies actively building IDPs, marginally elsewhere.

Should you take it?

Take CNPA if:

• Your team is building or operating an internal developer platform.
• You're an SRE / DevOps engineer transitioning into a platform role.
• Your employer reimburses CNCF certs (many do).
• You're a consultant and platform engineering is part of your service offering.

Skip CNPA if:

• You're a backend or frontend engineer who uses a platform — CNPA is for the builders, not the consumers.
• You don't have CKA-level Kubernetes knowledge yet. Build that first; CNPA without CKA is upside-down.
• You're chasing salary uplift specifically. CNPE delivers more signal, CKA delivers more breadth, and platform engineering jobs care more about portfolio than credentials at the senior end.

If CNPA is the right fit, browse the CNPA practice bank on CertLabPro or start a timed exam. The exam rewards recognition of patterns and trade-offs from the platform engineering literature — drilling realistic items is the fastest way to lock in the vocabulary the exam expects you to recognize without translating from your own team's local terms.