The CKS is one of the few security certifications where you cannot pass by recognising the right answer: you have two hours at a live command line to fix insecure Kubernetes clusters, and the exam moves to each new Kubernetes minor release within weeks. This guide sets out what the Linux Foundation and the Cloud Native Computing Foundation (CNCF) publish about the Certified Kubernetes Security Specialist: the performance-based format, the six curriculum domains and their weights, the CKA prerequisite, price, validity and the June 2026 change that lets a CKS pass extend your CKA. It adds a phased preparation plan and shows where the CKS fits for platform, cloud and security engineers. Facts were checked on the Linux Foundation pages and the cncf/curriculum repository on 24 October 2026; prices and the Kubernetes version change often, so confirm on the linked pages before you book.
Key takeaways
- It is a hands-on exam. The CKS is an online, proctored, performance-based test of 15 to 20 tasks solved at a command line in two hours, with a pass mark of 67%.
- The CKA comes first. The Linux Foundation requires candidates to have taken and passed the Certified Kubernetes Administrator (CKA) exam before attempting the CKS.
- The version moves. The exam environment runs Kubernetes v1.35 at the time of checking and is realigned with each new minor release within roughly four to eight weeks.
- Supply chain and runtime carry the weight. Three domains, microservice vulnerabilities, supply chain security and monitoring, logging and runtime security, make up 60% of the exam between them.
- Renewal is by re-examination. The CKS is valid for two years and is renewed by passing the exam again; since 18 June 2026 a CKS pass also reinstates or extends your CKA.
Who the certification is for
The CNCF curriculum describes the CKS as proving that a Kubernetes security specialist can secure container-based applications and Kubernetes platforms during build, deployment and runtime, and names Kubernetes administrators, cloud security engineers and other IT professionals as the intended audience. The Linux Foundation rates it as intermediate.
- Good fit: platform and SRE engineers who already run clusters and are now accountable for hardening them; cloud security engineers who review Kubernetes configurations and want to do the work, not only audit it; DevSecOps engineers who own image pipelines and admission policy.
- Useful for teams: a security team that reviews Kubernetes findings gains a shared, practical baseline with the platform team. The CKS curriculum overlaps closely with what a cluster security review checks. See the Kubernetes Security Guide.
- Weaker fit: people who have never administered a cluster (the CKA prerequisite exists for a reason), and security managers who need breadth over depth, who may be better served by a broader credential. See the Cybersecurity Certifications Guide.
Exam format and domains
Format
| Item | What the Linux Foundation publishes | Source |
|---|---|---|
| Type | Online, proctored, performance-based; tasks solved from a command line running Kubernetes | LF CKS page |
| Number of tasks | 15 to 20 performance-based tasks | LF important instructions (CKS) |
| Duration | 2 hours | LF CKS page; LF FAQ |
| Passing score | 67% or above | LF FAQ |
| Kubernetes version | v1.35 at the time of checking; aligned with the newest minor release within about 4 to 8 weeks of its release | LF CKS page; LF FAQ |
| Delivery | Remote proctoring on the PSI Bridge platform through the PSI Secure Browser, working in a remote desktop | LF FAQ |
| Environment | Each task names a host; you connect from a base node, return to it after each task, and nested SSH is not supported; task hosts have kubectl (aliased to k, with completion), yq, curl, wget and man | LF important instructions (CKS) |
| Results | Emailed within 24 hours of completion | LF important instructions (CKS) |
| Retake | One retake included in the exam purchase | LF CKS page |
During the exam you may use a browser inside the exam environment to reach a fixed list of documentation: kubernetes.io/docs and the Kubernetes blog, plus the Falco, bom, etcd, NGINX Ingress Controller, Cilium and Istio documentation. You may search the Kubernetes documentation but must not open external search results. Helm documentation, allowed in the CKA, is not on the CKS list.
Domains and weights
| Domain | Weight | Competencies in the curriculum | Related NHI Mgmt Group guide |
|---|---|---|---|
| Cluster Setup | 15% | Network policies to restrict cluster-level access; reviewing component configuration (etcd, kubelet, kubedns, kube-apiserver) against the CIS benchmark; Ingress with TLS; protecting node metadata and endpoints; verifying platform binaries before deployment | Kubernetes Security Guide |
| Cluster Hardening | 15% | RBAC to minimise exposure; care with service accounts (disable defaults, minimise permissions); restricting access to the Kubernetes API; upgrading Kubernetes to avoid vulnerabilities | Kubernetes RBAC Guide |
| System Hardening | 10% | Minimising the host OS footprint; least-privilege identity and access management; minimising external network access; kernel hardening with AppArmor and seccomp | Container Runtime Security Guide |
| Minimize Microservice Vulnerabilities | 20% | Pod Security Standards; managing Kubernetes Secrets; isolation techniques (multi-tenancy, sandboxed containers); pod-to-pod encryption (Cilium, Istio) | Kubernetes Admission Control Guide |
| Supply Chain Security | 20% | Minimal base images; understanding the supply chain (SBOM, CI/CD, artifact repositories); permitted registries, signing and validating artifacts; static analysis of workloads and images (Kubesec and KubeLinter are named as examples) | Container Image Security Guide |
| Monitoring, Logging and Runtime Security | 20% | Behavioural analytics to detect malicious activity; detecting threats across infrastructure, apps, networks, data, users and workloads; identifying attack phases and bad actors; container immutability at runtime; Kubernetes audit logs to monitor access | Container Runtime Security Guide |
Weights and competencies are taken from the Linux Foundation CKS page and the CKS curriculum PDF (labelled v1.34) in the cncf/curriculum GitHub repository. Two points to note: the curriculum PDF still carries the v1.34 label while the exam runs v1.35, and the README in the same repository lists Cluster Setup at 10% and System Hardening at 15%, the reverse of the PDF and the Linux Foundation page. The placement of the network access and kernel hardening items between domains also differs slightly in the PDF layout. Treat the weights as a guide to effort, not a precise score plan, and check which version the Linux Foundation page links to when you book.
Prerequisites and experience
- CKA pass: the Linux Foundation states that candidates must have taken and passed the CKA before attempting the CKS. The pages read do not say whether the CKA must still be in date when you sit the CKS; the June 2026 CARE policy (below) applies "whether a candidate's CKA certification is still active or has already expired", which suggests an expired CKA is not a barrier, but confirm with the Linux Foundation before you buy if yours has lapsed.
- No formal work experience: there is no experience-years requirement or endorsement step, unlike ISC2 or ISACA credentials. In practice the exam assumes you can already create and debug workloads, edit manifests quickly and find your way around kubelet and API server configuration on a node.
- Linux fluency: tasks run on Linux hosts with sudo, systemd services, static Pod manifests and log files. Comfort with vi or another terminal editor and with yq matters, because the INSERT key is blocked in the remote desktop and copy and paste use Ctrl+Shift+C and Ctrl+Shift+V.
- Identification and setup: an unexpired, government-issued, original physical ID whose name matches your exam checklist; a single monitor; no virtual machines; a private, clear and well-lit room.
Preparation plan
Most of the effort goes into speed under time pressure, not learning concepts. A plan for someone who passed the CKA in the last year and runs clusters at work:
- Weeks 1 to 2, map the gap. Read the curriculum line by line and mark each competency as "do weekly", "have done once" or "never done". Build a local multi-node cluster on the current exam minor version (v1.35 at the time of writing) with kubeadm so you can change API server and kubelet flags and break things safely.
- Weeks 3 to 4, cluster setup and hardening. Write default-deny NetworkPolicies, run a CIS Kubernetes Benchmark scan and remediate findings, restrict API server access, tighten RBAC and service account token mounting, and practise a kubeadm upgrade. See the Kubernetes Service Account Token Guide.
- Weeks 5 to 6, workloads and supply chain. Enforce Pod Security Standards with Pod Security Admission, practise Secrets handling and encryption at rest, run a sandboxed runtime class, generate an SBOM, restrict image registries with admission control, and run static analysis on manifests and images.
- Weeks 7 to 8, system and runtime. Load and apply AppArmor profiles and seccomp profiles, enable and read Kubernetes audit logs with a policy file, write and tune Falco rules, and make containers immutable (read-only root filesystem, no privilege escalation).
- Week 9, documentation drill. Practise finding every topic only through the allowed documentation sites. Know where the audit policy, Pod Security, NetworkPolicy, seccomp and AppArmor pages sit on kubernetes.io and where Falco rule syntax is documented.
- Week 10, simulate and book. Use the two Killer.sh simulator sessions included with the exam (36 hours of access each, 17 questions per session, different questions each time). Use the first to find weak areas and the second a few days before the exam. Book within the 12-month eligibility window.
If you do not run clusters daily, add four to six weeks before step 1 to rebuild CKA-level speed. The Linux Foundation sells a bundle with its Kubernetes Security Essentials course (LFS260); third-party courses exist too. The curriculum and the allowed documentation are the authoritative scope whichever you choose.
Cost, renewal and continuing education
| Item | Published detail |
|---|---|
| Exam only | USD 445 (includes one retake and two simulator attempts) |
| Exam with THRIVE-ONE annual subscription | USD 625 |
| Exam with LFS260 Kubernetes Security Essentials | USD 645 |
| Eligibility window | 12 months from purchase to schedule and take the exam |
| What you receive | PDF certificate and digital badge |
| Validity | 2 years |
| Renewal | Retake and pass the exam before the expiry date; no CPE scheme or annual fee |
| CKA link (CARE programme) | From 18 June 2026, passing or recertifying the CKS reinstates or extends the CKA and aligns its expiry date with the new CKS date |
Prices are list prices on the Linux Foundation page on 24 October 2026; the Linux Foundation runs frequent promotional discounts, so check before buying. Because renewal means sitting the current exam, a renewal in 2028 will test the Kubernetes version and curriculum of that time, not the one you studied. Plan a refresh of two to four weeks before your expiry, focused on curriculum changes since your first attempt. The CARE change means a CKS holder who keeps the CKS current no longer needs to renew the CKA separately.
Where it fits on the career path
| Credential | Focus | Relation to the CKS |
|---|---|---|
| KCNA and KCSA (CNCF associate exams) | Cloud native and Kubernetes security fundamentals | Optional knowledge-level starting points; not prerequisites |
| CKA | Cluster administration, hands-on | Mandatory prerequisite; a CKS pass now extends it |
| CKAD | Application development on Kubernetes, hands-on | Parallel developer track; useful for workload-focused tasks |
| CKS | Securing clusters and workloads across build, deploy and runtime | The specialist, hands-on security exam in the CNCF line |
| Cloud security credentials (vendor or vendor-neutral) | Cloud platform controls, identity, data | Complementary breadth around managed Kubernetes |
The CKS signals that you can do the work, which suits platform security engineer, cloud security engineer and DevSecOps roles. It does not cover cloud provider controls around managed clusters, such as cloud IAM bindings for nodes and workloads, which is where many real incidents start: the Tesla Kubernetes cryptojacking incident began with an exposed console and ended with cloud credentials. Pair it with cloud platform knowledge and workload identity practice. See the Kubernetes NHI Security Guide and the Cybersecurity Careers Guide.
Where identity fits
A large share of the curriculum is non-human identity work: RBAC for users and service accounts, disabling default service accounts and token automounting, restricting API access, managing Secrets and least privilege on nodes. These are the controls that decide what a compromised Pod can reach. Engineers who prepare for the CKS should treat service accounts as identities with owners, scopes and lifetimes, not as plumbing.
Common failure patterns
- Studying an old version: using courses or practice sets built for an earlier Kubernetes minor release, where flags, defaults or APIs (for example the removal of PodSecurityPolicy in favour of Pod Security Admission) differ.
- Breaking the control plane: editing a static Pod manifest for the API server with a typo, then losing minutes waiting for it to recover. Back up the manifest before each change and check with the container runtime logs.
- Working on the wrong host: forgetting to SSH to the host named in the task, or not returning to the base node afterwards.
- Documentation dependence: knowing a topic exists but not where it is on the allowed sites, which is fatal at two hours for 15 to 20 tasks.
- Skipping runtime tooling: under-preparing Falco rules, audit policy and AppArmor or seccomp profiles, which sit in heavily weighted domains.
- Ignoring the expiry date: letting the two-year validity lapse and having to sit the then-current exam from cold.
Practitioner checklist
- Confirm your CKA status and, if it has lapsed, check eligibility with the Linux Foundation before buying.
- Check the current exam Kubernetes version and build your practice cluster on that minor release.
- Download the current CKS curriculum from the cncf/curriculum repository and self-rate every competency.
- Practise each domain end to end on a real cluster, not only in a simulator.
- Bookmark the allowed documentation pages and practise finding answers only there.
- Use both included simulator sessions, spaced at least a week apart.
- Book within the 12-month eligibility window and test your room, ID and system against the PSI requirements.
- Diary your expiry date and a refresh block before it; note that a CKS renewal also extends your CKA.
Standards and references
- Linux Foundation: Certified Kubernetes Security Specialist (CKS)
- CNCF: Certification curriculum repository (CKS curriculum)
- Linux Foundation: Frequently asked questions, CKA, CKAD and CKS
- Linux Foundation: Important instructions, CKS
- Linux Foundation: Resources allowed during the exam
- Linux Foundation and CNCF: Expanding CARE, passing CKS can now extend your CKA certification
Related NHI Mgmt Group resources: Kubernetes Security Guide · Cybersecurity Certifications Guide · Kubernetes RBAC Guide · Top 10 Kubernetes Security Risks · Cybersecurity Careers Guide