Certified Kubernetes Security Specialist (CKS)
A hands-on, performance-based certification proving you can harden a Kubernetes cluster, secure its supply chain, and detect runtime threats from the command line. Requires a passed CKA to sit.
- src
- Linux Foundation Training & Certification — CKS certification page (training.linuxfoundation.org)
- chk
The CKS is the hardest of the three CNCF Kubernetes exams, and the reason is structural rather than academic. It assumes everything the CKA tested and then asks you to do it under an adversarial framing, in the same two hours.
The prerequisite is the fact people discover too late
You must have passed the CKA before you may attempt the CKS. This is not a recommendation. The Linux Foundation verifies it, and the CKA itself expires after two years — so a lapsed CKA means renewing it before you can book.
There is one piece of good news, new since 18 June 2026: passing or recertifying the CKS now automatically reinstates or extends your CKA under the CARE program, whether your CKA is still active or has already expired, with the CKA expiry realigned to your new CKS date. That changes the ownership maths considerably. Two credentials, one exam every two years.
Both credentials expire in two years
The CKS is valid for 2 years, the same window as the CKA rather than a shorter one. Before CARE that meant two separate renewal exams on two separate clocks. Now the CKS carries the CKA along with it, which makes staying current cheaper than it used to be — provided you keep renewing the CKS and not just letting it lapse.
What the weights tell you to study
The three 20% domains — Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security — are 60% of the score between them, and they are the ones a CKA holder has least exposure to. Cluster Setup and Cluster Hardening, at 15% each, are the closest to familiar ground.
Supply chain is where the gap is widest. Scanners, signatures, SBOMs and admission policy are day-job tools for very few Kubernetes administrators, and they are worth as much as cluster hardening and system hardening combined.
What actually fails people
Tool breadth, not Kubernetes depth. Falco, Trivy, kube-bench, Kyverno, cosign, AppArmor, seccomp and gVisor all appear. Each is shallow on its own; collectively they are more surface area than the CKA covers, and a candidate meeting any of them for the first time in the exam loses that task.
Time, again. The tasks are longer than the CKA's because hardening means editing a manifest, restarting a component, and then verifying the control actually took effect. Skipping verification is how people submit work that scores nothing.
Wider permitted docs, no more time to read them. Eight documentation domains are allowed rather than one. That is more places to get lost, not a safety net.
Before you book
Budget real hours against a cluster you are willing to break, and expect the security tooling to take longer than the Kubernetes parts. Reading about a hardening control and applying one under a timer are different skills, and only the second one is on the exam.
New to Linux and the command line?
This path assumes fundamentals you may not have yet. Our Foundations Pack is out and free — Linux, the shell and Git, with exercises that mark your work and explain why you got it wrong. We're writing an agents pack next; leave your email if you want to hear when it ships.
One email when the pack launches. No spam, unsubscribe any time.
Exam domains
Cluster Setup
15%Cluster Hardening
15%System Hardening
10%Minimize Microservice Vulnerabilities
20%Supply Chain Security
20%Monitoring, Logging and Runtime Security
20%Preparation path
- 1
Confirm your CKA is valid before you buy anything
You cannot sit the CKS without having passed the CKA, and the Linux Foundation checks. Look up your expiry date first. Since 18 June 2026, passing the CKS also reinstates or extends an expired CKA, but that is a reward for passing — it does not remove the entry requirement.
~1 hours - 2
Read the curriculum and the security checklist end to end
The CNCF publishes the exact competency list, and the Kubernetes security checklist maps almost one-to-one onto it. Read both before studying anything, so you know which of the six domains you already cover from CKA work and which are genuinely new ground.
~5 hours - 3
Harden a cluster you built yourself against the CIS benchmark
Run kube-bench against your own kubeadm cluster, then fix what it flags — API server flags, kubelet configuration, etcd permissions. This is Cluster Setup and Cluster Hardening, 30% of the exam, and reading about the controls teaches you far less than watching a check flip to PASS.
~20 hours - 4
Drill the pod-level controls until you can write them from memory
Pod Security Standards, security contexts, seccomp, AppArmor, secrets encryption at rest and sandboxed runtimes are the 20% Microservice Vulnerabilities domain plus half of System Hardening. Every one is a small YAML block, and writing them without the docs open is the difference between finishing and running out of time.
~22 hours - 5
Build a supply chain you can defend
Scan images with Trivy, cut a base image down to distroless, sign an artifact with cosign and enforce a permitted-registry policy with Kyverno. Supply Chain Security is 20% and the tools are unfamiliar to most CKA holders, which makes it the domain where preparation pays back fastest.
~20 hoursTrivy — vulnerability and misconfiguration scannerAqua Security · FreeKyverno policy engineKyverno · FreeSigning artifacts with cosignSigstore · FreeRuntime Class — selecting a sandboxed runtimeKubernetes · FreePractical Cloud SecurityChris Dotson · Paid · aff — Affiliate link — we may earn a commission at no extra cost to you. A free alternative is always listed alongside. - 6
Detect a threat instead of preventing it
Install Falco, write a rule, trigger it and read the output. Then turn on API server audit logging and find a specific action in the log. Monitoring and Runtime Security is 20%, and it is the one domain where hardening instincts do not help — the task is noticing, not blocking.
~16 hoursFalco documentationFalco · FreeAuditing — audit policy and backendsKubernetes · FreegVisor documentationgVisor · FreeKubernetes: Up and RunningBrendan Burns, Joe Beda, Kelsey Hightower, Lachlan Evenson · Paid · aff — Affiliate link — we may earn a commission at no extra cost to you. A free alternative is always listed alongside. - 7
Sit timed simulations with only the permitted docs open
Two hours, a timer, and the eight allowed documentation domains — kubernetes.io, Falco, Cilium, Istio, etcd, bom, ingress-nginx and the Kubernetes blog. Your registration includes two Killer.sh attempts. Use the first one early enough that its results can still change how you study.
~14 hours