Kubernetes CNPE: the CNCF Cloud Native Platform Engineer cert and what it tests
CNPE is CNCF's pro-tier platform engineering cert — Backstage, Crossplane, GitOps with Argo, internal developer platforms. Here's what it tests and who it's actually for.
CNPE — Cloud Native Platform Engineer — is the pro-tier platform engineering cert from CNCF. It went GA alongside CNPA (the Associate version) in early 2026 and is the first CNCF cert that focuses specifically on building internal developer platforms rather than just operating Kubernetes clusters. Hands-on terminal exam, $445, two hours, two free retakes within twelve months. Same format as CKA / CKAD / CKS. If you've taken any of those, the operational shape will feel familiar.
What's different is what's tested. CKA is "can you operate a cluster." CNPE is "can you build a platform that lets other teams use a cluster without having to learn it." Those are very different jobs.
The audience
CNPE is aimed at three roles specifically:
Senior platform engineers. You're the person on the platform team who designs the developer experience — golden paths, self-service templates, the question of how a backend developer goes from "I have an idea" to "my service is in production" without having to read kubectl docs.
SREs leading multi-tenant Kubernetes work. Your team runs the cluster and a layer above it that abstracts the cluster from product teams. CNPE maps to the upper-layer work: namespaces-as-tenants, RBAC at scale, cost attribution per team, golden-path templating.
DevOps leads at companies adopting platform engineering. The "DevOps team" is becoming "platform team" at a lot of orgs. CNPE is the first cert that signals you can do that role, not just operate the underlying infrastructure.
It's not a junior cert. CNPE assumes CKA-level Kubernetes fluency baseline, and the exam doesn't waste questions on basic kubectl. If you can't sketch a Deployment YAML from memory, take CKA first.
What's on the exam
CNCF published the official curriculum in late 2025. The five domains, with rough weighting from the exam guide and early candidate reports:
| Domain | Weight |
|---|---|
| Internal Developer Platforms (IDPs) and Backstage | ~25% |
| GitOps and continuous delivery (Argo CD, Flux) | ~20% |
| Crossplane and platform APIs | ~20% |
| Multi-tenant Kubernetes and policy (OPA, Kyverno) | ~20% |
| Observability and platform SLOs | ~15% |
Each of those is hands-on terminal work. You don't get multiple choice. You get a Linux shell, a kubeconfig, sometimes access to a Backstage instance or an Argo CD UI through a port-forward, and a list of tasks to complete.
What that looks like in practice — these are the kinds of tasks candidates report:
- Create a Backstage software template that scaffolds a new microservice with Helm chart, Argo CD application, and OpenAPI spec stubbed out. Verify the template works by instantiating a new entity.
- Configure Argo CD to sync applications from a Git repo with a custom health check on a CRD. Make the sync respect a PR-merge gate.
- Write a Crossplane Composition that exposes a "PostgresDatabase" abstraction backed by a CloudSQL instance. Apply a Composite Resource and verify the database is provisioned.
- Configure Kyverno policies to block any pod that doesn't define resource limits in three specific namespaces.
- Set up a multi-tenant ingress strategy with separate cert-manager Issuers per tenant.
- Configure SLOs for a platform service using a tool like Pyrra or sloth, and verify the SLO violates correctly when you induce error.
If those tasks sound abstract, that's because platform engineering is genuinely abstract work. The exam reflects that. Two hours feels short, and unfinished tasks get partial credit only if your work is checkpoint-able.
How it differs from CKA
CKA and CNPE are complementary, not competitive. The simplest way to think about the split:
| CKA | CNPE | |
|---|---|---|
| Tier | Associate | Professional |
| Audience | Cluster operators | Platform engineers |
| Focus | Operating Kubernetes | Building developer platforms |
| Tools | kubectl, etcd, kubeadm | Backstage, Argo, Crossplane, OPA / Kyverno, Helm |
| Exam length | 2 hours | 2 hours |
| Cost | $445 | $445 |
| Validity | 2 years | 2 years |
CKA tests: can you fix a broken cluster. CNPE tests: can you design the experience above the cluster so that nobody has to fix it.
Most platform engineers will end up holding both. The natural sequence is CKA → CKAD or CKS → CNPE, and ideally space them so the muscle memory from one carries into the next.
Why this cert matters now
Platform engineering became a real, branded discipline somewhere around 2022-2023, accelerated through 2024-2025, and is now a normal title at most mid-to-large companies. Backstage went from "Spotify thing" to "default tool" in that window. Crossplane went from research project to production at scale at companies like Upbound's customer base.
What was missing was the credential. CKA covered cluster operations; CKAD covered application developers; CKS covered security. None of them covered the "I'm building a developer platform" job, which is the fastest-growing slice of cloud-native work right now. CNPE fills that hole.
The salary side is still emerging. Platform engineers in major US metros land $160k–$220k base in 2026 per levels.fyi, with senior platform engineers at FAANG-tier shops pulling TC of $300k–$450k+. CNPE doesn't move those numbers on its own — production platform experience does. But the cert is the cleanest signal in the cloud-native ecosystem that you've worked at the platform layer specifically.
Study time and resources
This is going to be uneven because the cert is new. As of the GA, official prep is light:
- CNCF's curriculum repo has the domain breakdown and links to recommended reading. Use this as the spine.
- The Backstage docs are required reading. Specifically: software templates, the catalog, and TechDocs.
- Argo CD docs and the GitOps book by Codefresh are useful, but the exam tests Argo specifically (not Flux as an alternative — though both are mentioned, only Argo tasks have shown up in early reports).
- Crossplane docs including the Composition tutorials. Spend time on Compositions specifically. Configuring providers is mostly setup and doesn't get heavily tested.
- Kyverno and OPA Gatekeeper docs. Either / both can show up; Kyverno has been more common in early reports.
Time budget:
- Senior platform engineer already shipping IDPs: 4–6 weeks of focused study, mostly on Crossplane Compositions if you haven't used them.
- SRE / DevOps lead with strong Kubernetes but no IDP experience: 8–12 weeks. Build a small Backstage instance with three software templates as a study project. That alone covers maybe 30% of the exam.
- Engineer transitioning into platform work: 16+ weeks. Build something real first, then come back. The exam is unforgiving to candidates who only know the tools conceptually.
Common stumbles, early reports
A few things people consistently fumble:
Backstage templates are deeper than they look. The exam wants you to write a working software template — including a TechDocs page, a CI integration stub, and an Argo CD application manifest — under time pressure. The Backstage scaffolder syntax has enough quirks that you need real practice.
Crossplane Compositions vs CompositionRevisions. Knowing how revisions interact with deployed resources is not in most intro tutorials but shows up on the exam.
The Argo CD ApplicationSet generators. List, cluster, git, matrix, scm-provider generators each have specific use cases. The exam will hand you a scenario and ask which generator fits.
Multi-tenancy at the network layer. Beyond namespaces and RBAC, you need to know NetworkPolicies and how they interact with cilium / calico CNIs.
Bottom line
CNPE is the right cert for senior platform engineers and SREs who run developer platforms. It's overkill for engineers who just operate Kubernetes — CKA is the right cert there. It's premature for engineers new to cloud-native — earn CKA and ship a small platform project first.
The salary case is less about the cert and more about the role. Platform engineering is one of the higher-paying tracks in infrastructure right now, and CNPE is the cleanest way to make that experience legible to recruiters who don't know what Backstage is.
If you're prepping CNPE, run a timed exam simulation on CertLabPro or browse the CNPE question bank. The hands-on scenario tasks in the bank are the closest match to the real exam — straight-recall question dumps don't prep you for terminal-based work.
If you're undecided: are you building an IDP at work right now? If yes, this cert is worth the time and money. If no — and especially if you don't have a path to that work in the next 12 months — your $445 is better spent elsewhere.