Certified Kubernetes Security Specialist

Kubernetes security, under exam conditions

Learn the control. Perform it under time pressure. Then find it already broken and fix it. Every objective of the CKS curriculum, in six domains, with ninety-six hands-on labs against a real cluster.

Start course Official curriculum
  • 7 modules
  • 41 lessons
  • 96 hands-on labs
  • No sign-up, no backend

How the labs work

Three stages for every objective

Reading about a control and performing it with a timer running are different skills. Each curriculum topic is three separate labs, each in a fresh environment, so a cluster you wreck in the third one costs you nothing.

Stage 1Learn hints open · nothing hidden
Stage 2Required exam conditions · timed
Stage 3Inferno an incident · misleading config

Build the mental model, prove you can perform it, then prove you can still perform it when the cluster is lying to you.

The curriculum

Six domains, weighted as the exam weights them

The modules below are the CNCF's own domains, in the CNCF's own order, carrying the CNCF's own weightings. Where you spend your time should follow those percentages.

DomainWeightSubdomains
Cluster Setup10%5
Cluster Hardening15%6
System Hardening15%6
Minimize Microservice Vulnerabilities20%7
Supply Chain Security20%4
Monitoring, Logging & Runtime Security20%4

Weightings from the CNCF certification page. Check it before you sit the exam, because the blueprint does change.

Course pathway

Seven modules, one syllabus

One lesson per curriculum subdomain, plus a production-reality lesson closing each domain for what changes once a cloud provider runs half your cluster.

Every module

Jump to any domain

Progress is tracked per module, entirely in your browser.

Tooling

What you will actually use

  • Kubernetes
  • NetworkPolicy
  • RBAC
  • Pod Security
  • seccomp
  • AppArmor
  • Falco
  • Trivy
  • kube-bench
  • Audit logs

Before you start

  • Kubernetes at roughly CKA level; this course does not re-teach pods and deployments
  • Comfortable with kubectl, YAML, and editing files over SSH
  • Linux fundamentals: processes, systemd, file permissions
  • A browser. The labs run in one, so there is nothing to install

You'll be able to

  • Write a NetworkPolicy that isolates a workload without breaking DNS
  • Trace a permission through RBAC to the binding that actually grants it
  • Confine a container with seccomp and AppArmor, and debug an over-strict profile
  • Answer "who did this, and when" from an audit log under time pressure

Start where the exam starts

Module 1 opens on Cluster Setup, the first domain of the curriculum, with a four-namespace cluster that has no network policy at all.

Start course How the labs work