CKS — Certified Kubernetes Security Specialist
CKS Certification Tutorial
Welcome to the CKS (Certified Kubernetes Security Specialist) tutorial track. This advanced series covers the security hardening skills needed to pass the CKS exam and secure production Kubernetes clusters.
What is CKS?
The CKS certification is offered by the Cloud Native Computing Foundation (CNCF) in collaboration with The Linux Foundation. It certifies that you possess the skills to secure container-based applications and Kubernetes platforms during build, deployment, and runtime.
Exam Details
| Detail | Info |
|---|---|
| Duration | 2 hours |
| Format | Performance-based (hands-on tasks in a live cluster) |
| Passing Score | 67% |
| Validity | 2 years |
| Cost | $395 USD (includes one free retake) |
| Prerequisites | Must hold a valid CKA certification |
CKS Exam Domains
| Domain | Weight |
|---|---|
| Cluster Setup | 10% |
| Cluster Hardening | 15% |
| System Hardening | 15% |
| Minimize Microservice Vulnerabilities | 20% |
| Supply Chain Security | 20% |
| Monitoring, Logging and Runtime Security | 20% |
What You’ll Learn
- Securing the Kubernetes API server and kubelet
- Implementing Pod Security Standards and Pod Security Admission
- Using network policies to isolate workloads
- Scanning container images for vulnerabilities (Trivy, Grype)
- Implementing OPA/Gatekeeper and Kyverno policies
- Managing Secrets encryption at rest and in transit
- Configuring audit logging and runtime threat detection (Falco)
- Applying CIS Kubernetes benchmarks
- Securing the container supply chain with image signing and admission control
- Sandboxing workloads with gVisor and Kata Containers
Prerequisites
Before starting this track, you must have completed the CKA Tutorial and hold a valid CKA certification (required for the CKS exam).
Chapters
| # | Chapter | Exam Domain |
|---|---|---|
| 1 | Introduction | Overview |
| 2 | Cluster Setup & Hardening | Cluster Setup (10%) |
| 3 | CIS Benchmarks & kube-bench | Cluster Setup (10%) |
| 4 | Cluster Hardening | Cluster Hardening (15%) |
| 5 | System Hardening | System Hardening (15%) |
| 6 | Pod Security Standards | Minimize Microservice Vulnerabilities (20%) |
| 7 | OPA Gatekeeper | Minimize Microservice Vulnerabilities (20%) |
| 8 | Secrets Management | Minimize Microservice Vulnerabilities (20%) |
| 9 | Image Security & Supply Chain | Supply Chain Security (20%) |
| 10 | Runtime Security & Falco | Monitoring & Runtime Security (20%) |
| 11 | Audit Logging | Monitoring & Runtime Security (20%) |
| 12 | Network Policies Advanced | Cluster Setup (10%) |
| 13 | Exam Tips & Mock Exam | All Domains |
