Certified Kubernetes Security Specialist (CKS)

The CKS was created by the Linux Foundation and the Cloud Native Computing Foundation (CNCF) as a part of their ongoing effort to help develop the Kubernetes ecosystem. The exam is online, proctored, performance-based test that requires solving multiple tasks from a command line running Kubernetes.

Proven security & Kubernetes skills are a career door opener! Show off your skills with this globally recognized, vendor-neutral certification.

Obtaining the CKS validates your in-demand cloud security skills, accelerates your career advancement, delivers industry-wide recognition of your professional credentials, and opens up valuable networking opportunities within the cloud security community.

Cluster Setup - 15%

• Use Network security policies to restrict cluster level access
• Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
• Properly set up Ingress with TLS
• Protect node metadata and endpoints
• Verify platform binaries before deploying

Cluster Hardening - 15%

• Use Role Based Access Controls to minimize exposure
• Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
• Restrict access to Kubernetes API
• Upgrade Kubernetes to avoid vulnerabilities

System Hardening - 10%

• Minimize host OS footprint (reduce attack surface)
• Using least-privilege identity and access management
• Minimize external access to the network
• Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities - 20%

• Use appropriate pod security standards
• Manage Kubernetes secrets
• Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
• Implement Pod-to-Pod encryption (Cilium, Istio)

Supply Chain Security - 20%

• Minimize base image footprint
• Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
• Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
• Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

Monitoring, Logging and Runtime Security - 20%

• Perform behavioral analytics to detect malicious activities
• Detect threats within physical infrastructure, apps, networks, data, users and workloads
• Investigate and identify phases of attack and bad actors within the environment
• Ensure immutability of containers at runtime
• Use Kubernetes audit logs to monitor access

1. After purchase the exam voucher, please log into your portal LFOSSA website, your exam voucher will be available under "Exam & Learning Voucher" (password-protected).

2. You need an LFID to register for and take Linux Foundation (LF) certification exams. If you already have a Linux Foundation ID (LFID), you can redeem your exam voucher at https://trainingportal.linuxfoundation.org/redeem . If you do not have a LFID, click here (https://trainingportal.linuxfoundation.org/access/saml/login) to create one.

3. Log in to your LF Education portal,  enter your exam voucher code in the Enter Registration Code field and click Validate, then check the box: " I agree to The Linux Foundation Training Terms, Conditions & Policies and the Thought Industries Terms & Conditions." 

4. A confirmation message “Congrats, your code has been validated” will appear upon successful validation, confirming your voucher is valid. Click Register to complete the exam voucher registration.

5. Log in to LF Education global website with your LFID.   After the registration process, the certification exam will be available in the learner's portal within 24 hours, then the candidate will be available to take and schedule exam. 

The exam is based on Kubernetes v1.37

The CKS exam environment will be aligned with the most recent K8s minor version within approximately 4 to 8 weeks of the K8s release date.

Candidate Handbook

Curriculum Overview

Exam Tips

Frequently Asked Questions

Linux Foundation Global Certification and Confidentiality Agreement

Verify Certification

The Exam Voucher is non-refundable upon purchase.

Exam Voucher is redeemable within 90 days post-purchase; Exam eligibility will be valid for 1 year from your registration date. You now have 90 days + 365 days for exam preparation!