Free Online Course · Self-paced · Hands-on

CKS Tutorial: Certified Kubernetes Security Specialist Course

Free CKS exam prep course covering all six Linux Foundation security domains, with hands-on kubeadm labs for kube-bench, Trivy, Cosign, Falco, and gVisor.

  • 7 chapters
  • 40 lessons
  • ~16h
  • Advanced
  • Tested with Kubernetes (kubeadm, kubelet, kubectl) 1.36.x
  • Updated Sep 2026
Start the course View syllabus
CKS Tutorial: Certified Kubernetes Security Specialist Course
By Last updated

About this course

This is a free, self-paced course for the Certified Kubernetes Security Specialist (CKS) exam from the Linux Foundation and CNCF. The CKS is a specialization rather than a starting point, so the course assumes you have passed the CKA and can already install, operate, and troubleshoot a cluster. After a short foundation refresher, the syllabus covers all six domains of the current CKS curriculum.

The CKS tests tools as much as Kubernetes objects, and you do not learn a tool's flags and failure modes by reading about it. Each lesson here installs the tool on a kubeadm cluster and uses it for real: kube-bench against the control plane, Trivy and Cosign against images you build, Falco watching live syscalls, and Cilium encrypting traffic you then capture on the wire. When the lesson is done you tear the tool down, so your lab stays close to a clean cluster for the next one.

Work through the chapters in order if Kubernetes security is new to you, since the supply chain and runtime chapters build on the hardening ones. If you already run hardened clusters, the three 20% domains carry 60% of the exam between them, so start with Pod Security Standards, Supply Chain Security, or the Falco lessons in Monitoring, Logging and Runtime Security.

What you'll learn

  • Restrict cluster traffic with NetworkPolicy, set up Ingress with TLS, and audit components against the CIS benchmark with kube-bench
  • Protect node metadata and kubelet endpoints, and verify Kubernetes binaries before you deploy them
  • Harden API server access, RBAC, and ServiceAccounts, and upgrade clusters to pick up security fixes
  • Reduce the host attack surface and confine containers with seccomp, AppArmor, and Linux capabilities
  • Enforce Pod Security Standards, isolate tenants, sandbox workloads with gVisor, and encrypt Pod traffic with Cilium or Istio
  • Secure the supply chain with minimal images, Trivy scans, SBOMs, Cosign signatures, ImagePolicyWebhook, Kubesec, and KubeLinter
  • Detect and investigate runtime threats with audit logs, Falco, immutable containers, and an incident response workflow

Who this course is for

  • CKA holders who want to prove they can secure the clusters they already run
  • Platform and security engineers asked to harden self-managed kubeadm clusters against the CIS benchmark
  • DevSecOps engineers who own image scanning, signing, and admission policy in CI/CD
  • Anyone preparing for the Linux Foundation CKS exam

Prerequisites

  • A passed CKA exam, which the Linux Foundation requires before you can attempt the CKS
  • Comfortable Linux administration on nodes over SSH, including systemd, users, file permissions, and firewalls
  • A kubeadm lab (one control plane, two workers) with containerd on VMs you can rebuild, because lessons install Cilium, Istio, Falco, and gVisor
  • One Ubuntu node or VM for the AppArmor lesson

Exam objectives covered

Certified Kubernetes Security Specialist (CKS) blueprint — 6 domains · official objectives

  1. Cluster Setup15%

    • Use Network security policies to restrict cluster level access
    • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
    • Properly set up Ingress with TLS
    • Protect node metadata and endpoints
    • Verify platform binaries before deploying

  2. Cluster Hardening15%

    • Use Role Based Access Controls to minimize exposure
    • Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
    • Restrict access to Kubernetes API
    • Upgrade Kubernetes to avoid vulnerabilities

  3. System Hardening10%

    • Minimize host OS footprint (reduce attack surface)
    • Using least-privilege identity and access management
    • Minimize external access to the network
    • Appropriately use kernel hardening tools such as AppArmor, seccomp

  4. Minimize Microservice Vulnerabilities20%

    • Use appropriate pod security standards
    • Manage Kubernetes secrets
    • Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
    • Implement Pod-to-Pod encryption (Cilium, Istio)

  5. Supply Chain Security20%

    • Minimize base image footprint
    • Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
    • Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
    • Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

  6. Monitoring, Logging and Runtime Security20%

    • Perform behavioral analytics to detect malicious activities
    • Detect threats within physical infrastructure, apps, networks, data, users and workloads
    • Investigate and identify phases of attack and bad actors within the environment
    • Ensure immutability of containers at runtime
    • Use Kubernetes audit logs to monitor access

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Kubernetes (kubeadm, kubelet, kubectl) 1.36.x Rocky Linux 10.2 control plane and workers with containerd 2.2
Ubuntu 24.04 LTS Node for the AppArmor lesson (AppArmor 4.0), since the Rocky Linux nodes do not run AppArmor
Trivy / Cosign 0.72.x / 3.1.x Image scanning, SBOMs, and signing; the release-artifact lesson verifies Kubernetes binaries with Cosign 2.4
Falco 0.44.x Installed with Helm chart 9.1.0 and modern eBPF for the runtime security and incident response lessons
Cilium / Istio 1.19.x / 1.30.x Pod-to-Pod encryption with WireGuard and with Istio mutual TLS

Syllabus

7 chapters · 40 lessons · ~16h of reading

  1. 1 Before You Begin — CKA Foundation and Security Lab 6 lessons · ~1h 34m
    1. Part 1 Install Kubernetes with kubeadm (multi-node cluster) 25 min read
    2. Part 2 Install kubectl and configure kubeconfig 15 min read
    3. Part 3 kubectl commands and YAML examples 14 min read
    4. Part 4 Kubernetes architecture and control plane components 15 min read
    5. Part 5 Authentication, authorization, and admission control 11 min read
    6. Part 6 Kubernetes security architecture and attack surface 14 min read
  2. 2 Cluster Setup — 15% 5 lessons · ~1h 9m
    1. Part 7 NetworkPolicy with examples 20 min read
    2. Part 8 Audit the CIS benchmark with kube-bench 14 min read
    3. Part 9 Ingress with host, path, and TLS examples 16 min read
    4. Part 10 Protect node metadata and kubelet endpoints 10 min read
    5. Part 11 Verify Kubernetes release binaries and images 9 min read
  3. 3 Cluster Hardening — 15% 5 lessons · ~1h 18m
    1. Part 12 Kubernetes RBAC with examples 10 min read
    2. Part 13 Kubernetes ServiceAccounts with examples 10 min read
    3. Part 14 Harden Kubernetes API server access 14 min read
    4. Part 15 PKI, CSR, and certificate renewal 17 min read
    5. Part 16 Upgrade a Kubernetes cluster with kubeadm 27 min read
  4. 4 System Hardening — 10% 5 lessons · ~1h 4m
    1. Part 17 Harden Linux nodes for Kubernetes 20 min read
    2. Part 18 Use seccomp profiles in Kubernetes 11 min read
    3. Part 19 Use AppArmor profiles in Kubernetes 11 min read
    4. Part 20 SecurityContext with practical examples 12 min read
    5. Part 21 Linux capabilities in Kubernetes 10 min read
  5. 5 Minimize Microservice Vulnerabilities — 20% 6 lessons · ~1h 23m
    1. Part 22 Pod Security Standards and admission 14 min read
    2. Part 23 Kubernetes Secrets with examples 12 min read
    3. Part 24 Multi-tenancy and workload isolation 14 min read
    4. Part 25 Sandboxed containers with RuntimeClass and gVisor 13 min read
    5. Part 26 Encrypt Pod traffic with Cilium WireGuard 16 min read
    6. Part 27 Enable Istio mutual TLS with PeerAuthentication 14 min read
  6. 6 Supply Chain Security — 20% 7 lessons · ~1h 29m
    1. Part 28 Build secure minimal container images 14 min read
    2. Part 29 Scan container images with Trivy 12 min read
    3. Part 30 Generate and scan container SBOMs with Trivy 12 min read
    4. Part 31 Sign and verify container images with Cosign 13 min read
    5. Part 32 Allow trusted images with ImagePolicyWebhook 14 min read
    6. Part 33 Scan Kubernetes YAML with Kubesec and KubeLinter 13 min read
    7. Part 34 Secure container image promotion in CI/CD 11 min read
  7. 7 Monitoring, Logging and Runtime Security — 20% 6 lessons · ~1h 27m
    1. Part 35 kubectl logs, Events, and describe 18 min read
    2. Part 36 Debug Pods with kubectl exec and kubectl debug 9 min read
    3. Part 37 Build immutable containers in Kubernetes 13 min read
    4. Part 38 Kubernetes audit logging 14 min read
    5. Part 39 Runtime security with Falco 16 min read
    6. Part 40 Incident response and forensics 17 min read

Hands-on labs

6 guided builds you run yourself

  1. Audit a cluster against the CIS benchmark

    Run kube-bench, map a FAIL result to the file behind it, fix it, and confirm the check passes.

  2. Confine a container with seccomp

    Install a custom Localhost profile on the kubelet path and trace a denied syscall through logs and exit codes.

  3. Sandbox a workload with gVisor

    Install runsc on a worker, register it with containerd, and schedule Pods onto it through a RuntimeClass.

  4. Encrypt Pod traffic with Cilium WireGuard

    Turn on transparent encryption and capture cross-node traffic before and after to prove it is encrypted.

  5. Sign and verify images with Cosign

    Sign an image with a local key and a keyless identity, attach an SPDX attestation, and check that verification fails when it should.

  6. Detect runtime threats with Falco

    Deploy Falco with Helm, trigger alerts from inside a container, and write and tune a custom rule.

Where to go after this course

  • Book the CKS examConfirm eligibility, price, and the Kubernetes version on the Linux Foundation page before you schedule.
  • CKA courseRefresh cluster administration if your CKA was a while ago, since every CKS task assumes it.
  • Kubernetes Operator courseIts RBAC, hardening, and supply chain lessons apply the same controls to controllers you write yourself.

Frequently Asked Questions

Do I need an active CKA to take the CKS?

The Linux Foundation's wording is that CKS candidates must have taken and passed the CKA exam before attempting the CKS. It does not say the CKA has to be current. Your Linux Foundation portal checks eligibility when you schedule, so confirm it there and on the official CKS page if your CKA has lapsed.

What is the CKS exam format?

The CKS is an online, proctored, performance-based exam. You get two hours to solve a set of tasks from a command line on running Kubernetes clusters, and you need 67% to pass, one point higher than the CKA and CKAD. The exam environment currently runs Kubernetes v1.35 and moves to the newest minor release within about four to eight weeks of each Kubernetes release. Check the official CKS page for the current version.

How much does the CKS cost, and how long is it valid?

The exam-only registration is listed at $445. It includes two exam attempts, two sessions on the Killer.sh exam simulator, and 12 months to schedule and sit the exam. The CKS is valid for two years, and you renew it by passing the exam again before it expires. Under the Linux Foundation CARE program, earning or renewing the CKS on or after June 18, 2026 also extends your CKA to the same expiry date. Confirm the current price on the official CKS page.

What documentation can I use during the CKS exam?

The CKS allows more sites than the CKA or CKAD. Besides kubernetes.io/docs and the Kubernetes blog, you can open the documentation for Falco, bom, etcd, the NGINX Ingress Controller, Cilium, and Istio, plus any links a task provides in its Quick Reference box. You may use the search box on kubernetes.io, but you must not open external search results. The list changes between exam versions, so check the Linux Foundation's resources allowed page before exam day.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)