Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Five days of live online CKS training built around the CNCF exam curriculum, with hands-on labs on real clusters and lab work in every domain of the CKS exam. An active CKA certification is required before you can sit for the CKS exam.
Course Retake Included
Requires Active CKA
Five days for security engineers, platform teams, and Kubernetes administrators who already hold the CKA and need to harden clusters, workloads, and supply chains to the CNCF exam standard.
The CKS exam is solved at a command line against live clusters, so this class is built the same way. Over five full days you install and harden clusters with kubeadm, lock down the kube-apiserver and etcd, enforce RBAC and Pod Security Standards, scan images with Trivy, write NetworkPolicies, and detect runtime threats with Falco. Every topic maps to one of the six CNCF exam domains, so by the end of the week you have worked every domain hands-on before you schedule the real exam.
Every lecture and lab maps to one of six CKS domains: Cluster Setup, Cluster Hardening, System Hardening, Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security.
You may return for the full CKS class at no cost within one year of your original session. A second pass through the hardening, scanning, and runtime labs sharpens exam-day speed.
You work in live clusters, not simulations. Labs use kubeadm, kube-bench, Falco, Trivy, Tracee, AppArmor, gVisor, Gatekeeper, and Linkerd, open source tools that map directly to the CKS exam domains.
Immersive classroom instruction with direct instructor access, hands-on labs and peer collaboration.
The same instructors and curriculum, delivered live from anywhere on our virtual learning platform.
Save on this course with a current special offer
Team pricing, military discounts and a limited-time offer of the week. See what applies before you book.
Tell us about your training needs and we'll create a personalized plan.
The Certified Kubernetes Security Specialist (CKS) is issued by CNCF with the Linux Foundation and proves you can secure Kubernetes platforms and workloads. An active CKA is required.
Five full-day live online sessions move from cluster installation through control plane hardening, image scanning, RBAC, network security, and threat detection. Most topics pair a lecture with a lab.
You build clusters with kubeadm, then defend them. Labs run kube-bench against the CIS Benchmark, deploy Falco, scan images with Trivy, apply AppArmor, isolate kernels with gVisor, and enforce policy.
Six CKS domains: Cluster Setup 15%, Cluster Hardening 15%, System Hardening 10%, Minimize Microservice Vulnerabilities 20%, Supply Chain Security 20%, and Monitoring, Logging and Runtime Security 20%. All covered.
Instructor access does not end on Friday. Post-class mentoring gives you 180 days to bring questions from your own lab practice back to an instructor while you prepare.
If you want another pass through the material, you may retake the class at no cost within one year of your original session. Every lab rewards a second run.
A structured path designed for working professionals.
Each day builds on the last—momentum is everything.
Five days of live labs to get you cluster-hardened, CKS-ready, and back to work.
The credential, the capability, and the continued readiness — all in one boot camp.
Real questions from real professionals who passed.
Here's
how we answer them.
The Certified Kubernetes Security Specialist (CKS) is a performance-based certification issued by the Cloud Native Computing Foundation (CNCF) with the Linux Foundation. It proves you can secure container-based applications and Kubernetes platforms during build, deployment, and runtime. Candidates must hold an active CKA before attempting the CKS exam, which makes it the advanced security credential in the CNCF Kubernetes track.
The class runs five full-day live online sessions, Monday through Friday, led by a live instructor. Each day pairs lectures with hands-on labs on real clusters, ending with threat analysis and detection on the final day. This CKS training follows the CNCF exam curriculum, so the five days cover all six exam domains.
No. The CKS exam is purchased separately from the Linux Foundation for $445. That fee includes one retake and a 12-month window to schedule your attempt. You take the exam online on your own schedule after class, once you have worked through every domain in the labs.
The CKS exam is a 2-hour online, proctored, performance-based test solved from a command line. You work through tasks in live Kubernetes clusters running v1.35, the current exam environment. The exam is purchased separately from the Linux Foundation for $445, which includes one retake and a 12-month scheduling window.
CNCF does not publish the passing score for the CKS exam. The exam is performance-based and solved from a command line, so preparation means completing tasks in live clusters, not memorizing answers. The practical approach is to be able to complete every task type across the six domains under time pressure, which is what the labs in this class are built for.
You must hold an active CKA certification before you can attempt the CKS exam, and this class assumes that level of Kubernetes knowledge. For the class itself you need working knowledge of Kubernetes, basic Linux skills, and familiarity with a text editor such as vi, vim, or nano. If you do not yet hold the CKA, start with our CKA Boot Camp.
CKS training is for anyone who holds a CKA and is interested in or responsible for cloud security: security engineers, platform and DevOps engineers, Kubernetes administrators, and SREs who need to harden clusters, workloads, and supply chains. It also suits security professionals moving into container environments who already have the CKA baseline.
You work in live Kubernetes clusters, not simulations. Labs include installing and upgrading clusters with kubeadm, enabling audit logging, deploying Falco, configuring encryption at rest, running kube-bench, snapshotting and restoring etcd, scanning images with Trivy, applying AppArmor profiles and gVisor, configuring RBAC and service accounts, enabling Pod Security Standards and Gatekeeper, and deploying NetworkPolicy and mTLS with Linkerd.
The CKS is the security specialization and requires an active CKA. The CKA covers day-to-day cluster administration. The CKAD covers designing, building, and deploying applications that run on Kubernetes. If you run clusters, earn the CKA first and then the CKS. If you build applications, the CKAD is the closer fit.
The CKS certification is valid for 2 years from the date you pass. Renewal requires passing the current version of the CKS exam again before your certification expires. Confirm the exact renewal steps and dates that apply to your certification in your Linux Foundation training portal.
No. CNCF certifications, including the CKS, are not listed on the DoD 8140 Approved Qualifications Matrix. If you need a credential for a DoD 8140 work role, check the current Approved Qualifications Matrix before enrolling and choose a listed certification for that requirement. The CKS remains a respected technical credential for Kubernetes security work in any environment.
Your $445 Linux Foundation exam purchase includes one retake, so you get a second attempt at no extra cost within your 12-month window. If you want more preparation first, you may retake the full class at no cost within one year of your original session. Post-class mentoring is also available to help you work through the domains that gave you trouble.
Many certifying bodies accept vendor and technical training hours toward continuing education requirements. Each body sets its own rules on which activities count and how to document them, so check with your certifying body before submitting. Keep your enrollment confirmation and class dates for your records.
Study guides and planning articles to help you prepare for the CKS exam and decide what comes next.
Weighing this against another certification? Compare them head to head in Certification Matchups →
Nothing on the CKA, CKAD, or CKS is multiple choice. You get a remote desktop, a set of live Kubernetes...
A kubeadm cluster will run for a full year without a single complaint, then lock you out the morning after...
A student finishes a practice exam, turns the laptop around, and points at the screen. It says 68 percent. The...
