CertQuests
DevOps / SRE Roadmap: 5 certs, 18–24 months, the multi-discipline reality
The path is Cloud (CCP) → Linux (RHCSA) → Docker (DCA) → Kubernetes (CKA) → Terraform (TF Associate), in that order. Cloud gives you the substrate. Linux gives you the operating model. Docker and Kubernetes give you the deployment model. Terraform gives you the automation glue.
DevOps is the widest IT path — you can't skip steps because each builds on the prior. CKA is the highest-leverage single cert; if you can only do one of these, do CKA after Linux fundamentals. Coding skill (bash + Python or Go) is non-negotiable. Senior SRE roles at tech-forward companies pay well above this band; this path gets you in the door.
Who this path is for
This roadmap is built for someone targeting a DevOps Engineer / Platform Engineer / Site Reliability Engineer (SRE) Junior role at a tech-forward shop — SaaS, FinServ-tech, e-commerce. The job involves running CI/CD pipelines, debugging Kubernetes clusters, writing Terraform modules, building observability, and being the human-shaped layer between developers and production.
It is not the right path if your target is:
- Pure cloud architect — AWS or Azure paths are deeper on cloud-specific architecture.
- Network engineer — CCNA / CCNP track is the right shape.
- Security-specialized DevSecOps — add CKS and CompTIA Security+ on top of this path.
The 5-step path, in order
AWS Cloud Practitioner CLF-C02 (or AZ-900)
4–6 weeks ~60 hours Cloud foundationWhy here: DevOps without cloud is rare in 2026. CCP gives you the AWS vocabulary; substitute AZ-900 if your target shop is Microsoft-heavy. The cert itself is easy; the value is the mental model.
Red Hat Certified System Administrator (RHCSA)
8–12 weeks ~140 hours Linux fluencyWhy here: Kubernetes runs on Linux. Containers run on Linux. Your CI/CD agents run on Linux. If you can't troubleshoot systemd, manage permissions, parse a strace, and write reflexive bash, the rest of this path will collapse on you. RHCSA is the cleanest gate to Linux fluency — it's hands-on, time-pressured, and unforgiving of memorization.
Substitute CompTIA Linux+ if you don't want a hands-on exam, but RHCSA is the cert hiring managers actually respect.
Docker Certified Associate (DCA)
5–7 weeks ~80 hours ContainersWhy here: understand the container abstraction before the orchestrator. DCA covers image building, layering, networking, volumes, security — the primitives Kubernetes assumes you already know. Skipping this means CKA hits you twice as hard.
DCA is technically optional — you can absorb its content from CKA prep. We recommend doing it because the credential signal is real (it shows up in postings) and the focused study compounds when you hit CKA.
Certified Kubernetes Administrator (CKA)
10–14 weeks ~180 hours The leverWhy here: CKA is the single highest-leverage cert in the DevOps career. It's hands-on, time-pressured (2 hours, real cluster), and globally recognized. CKA on a resume in 2026 is a near-guaranteed interview at any platform-engineering shop.
The exam is genuinely hard. Most candidates pass on the second attempt. Budget for two tries ($395 each, but free retake on first attempt) and 100+ hours of kubectl reps in killercoda or a local kind cluster.
HashiCorp Terraform Associate
4–6 weeks ~70 hours IaC closerWhy here: Terraform is the dominant IaC tool. The associate cert is the easiest in this path — pure multiple-choice — but the credential is widely recognized and the study time compounds with everything else you've learned. State management, providers, modules, and backend handling are the real value.
Skip if your target shop uses Pulumi or pure CloudFormation, but Terraform is the safe default. Bonus: if the recent IBM-driven licensing turbulence pushes your shop to OpenTofu, the cert content is essentially identical.
What you'll be able to do at the end
- Stand up a Kubernetes cluster from scratch (kubeadm or managed), deploy a 3-tier app via Helm, and debug it when ingress breaks at 3am.
- Write Terraform modules for AWS or Azure that provision VPCs, EKS/AKS clusters, and the supporting IAM, with state in remote backends.
- Build a CI/CD pipeline (GitHub Actions, GitLab CI, or ArgoCD) that takes code → image → cluster, with rollbacks.
- Triage a "the cluster is broken" page using
kubectl describe,kubectl logs, and ad-hoc port-forwarding without panicking. - Read a Helm chart, understand the templating, and modify values.yaml to match your environment.
What this path is worth
Snapshot of the DevOps / SRE entry market in 2026 (US). Verify against current postings before negotiating.
Entry base (US)
$110k–$145kMid-market shops at the lower end. Tech-forward and SaaS at the upper end.
Mid-level after 2–3 yrs
$150k–$200kSRE at top-tier tech companies pushes higher. Adds CKS, AWS DevOps Pro, GoCD-style production exposure.
Open postings (US)
~88,000Largest single-track demand in IT. The supply is also growing fast — quality of homelab and code matter more than volume.
Top hiring sectors
Tech · FinServ · SaaSPure-tech and SaaS pay best. Financial services pay competitively. Healthcare and retail are growing fast.
Common mistakes that cost candidates offers
- Skipping Linux. The biggest mistake. CKA assumes Linux fluency; without it, you'll struggle for the entire exam. RHCSA is not optional.
- Not coding. "I'll learn coding later" is a trap. DevOps interviews include scripting questions and code review. Bash + one of Python/Go is the floor.
- No homelab. A Kubernetes homelab is non-negotiable. k3s on a Raspberry Pi cluster, kind on your laptop, or EKS on the AWS Free Tier — pick one, document on GitHub.
- Memorizing kubectl. CKA passes go to candidates with reflexive command knowledge. If you have to look up
kubectl get pods -n <ns> -o widemid-exam, you'll run out of time. - Ignoring observability. Modern SRE work is 50% Prometheus, Grafana, OpenTelemetry, and log analysis. The certs don't cover it deeply — learn it on your own. It's the difference between junior and mid-level.
Start step 1 right now — no signup
Every cert in this path has a free practice pack on CertQuests with engineer-written explanations on every question.
Frequently asked questions
How long does it take to become a DevOps engineer?
Realistic range: 18–24 months part-time. The path is wider than other IT careers because DevOps spans Linux, networking, cloud, containers, orchestration, and IaC. Many candidates land platform/junior DevOps roles after CCP + RHCSA + CKA (months 9–12) and finish the rest on the job.
AWS or Azure for DevOps?
AWS is the safer default — DevOps tooling and the SRE community lean AWS-heavy. Azure is fine if your target metro is Microsoft-heavy. The platform doesn't matter much; the patterns transfer.
Do I need to know how to code?
Yes — at minimum bash plus one of Python or Go. DevOps is automation, and automation is code. You don't need to be a senior developer, but you need to write maintainable scripts and read codebases. "I just use bash" is a junior signal.
Is CKA harder than RHCSA?
Both are hands-on and time-pressured. CKA is more conceptually challenging because Kubernetes has more moving parts; RHCSA is more about reflexive Linux command knowledge under pressure. Most candidates find CKA harder, but RHCSA's 3-hour exam is genuinely brutal.
Do I need CKAD or CKS too?
Not for entry-level. CKA is enough. CKAD (developer-side) or CKS (security) are second-cert moves once you have 1–2 years of K8s in production. Some senior platform roles list CKS as preferred.
What does a DevOps engineer earn?
US median for entry-level DevOps engineer in 2026 is roughly $110,000–$145,000 base, with major metros pushing 20–30% higher. SREs at top-tier tech companies (Stripe, Datadog, CloudFlare) push $180k+ base for mid-level. The full cert path anchors the upper end of entry-level offers.
Should I learn Ansible or Terraform first?
Terraform first. It's the dominant IaC tool by a wide margin in 2026 and the cert is universal. Ansible is still common for configuration management, but Terraform handles 80% of what you'll be asked to do, including config in many cases via cloud-init or user_data. Pick up Ansible after Terraform if your target shop uses it.
How we wrote this roadmap
No vendor affiliate revenue. We don't take money from AWS, Microsoft, Red Hat, Docker, the CNCF, HashiCorp, or any cert vendor mentioned. The sequence is based on what DevOps / SRE / Platform Engineer job descriptions actually require, plus interviews with hiring managers across SaaS, FinServ, and tech-forward retail in 2025–2026.
What we'll change without being asked: if a major cert is retired or if OpenTofu fully displaces Terraform in postings (it's gaining ground), we'll re-sequence within days. Tell us what you'd change. Last reviewed: April 27, 2026.