CKS — Certified Kubernetes Security Specialist Guide

The CKS validates your ability to secure Kubernetes clusters and containerized applications. It's the most advanced Kubernetes security certification and requires CKA certification first.

Exam Overview

Detail	Value
Provider	CNCF / Linux Foundation
Format	100% hands-on (terminal-based)
Length	2 hours
Passing Score	67%
Price	~$395 USD (requires valid CKA)
Validity	2 years
Prerequisite	Active CKA certification

Domain Breakdown

Domain	Weight
Cluster Setup and Hardening	20%
Cluster Hardening	15%
System Hardening	15%
Minimize Microservice Vulnerabilities	20%
Supply Chain Security	10%
Monitoring, Logging, and Runtime Security	20%

Key Topics

Cluster Setup

• Use CIS benchmarks to harden kubelet, API server, etcd
• TLS certificates and rotation
• RBAC with least privilege, ServiceAccount management
• OPA/Gatekeeper and admission controllers
• Pod Security Standards (Privileged, Baseline, Restricted)

Supply Chain

• Image signing (Cosign), vulnerability scanning (Trivy)
• Pod Security Contexts and SecurityContext constraints
• Image policy webhooks

Runtime Security

• Falco for runtime threat detection
• Seccomp, AppArmor, gVisor/kata containers
• Audit logging

Access CKS practice questions →