Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about the CKS, the hands-on Kubernetes security certification from the Cloud Native Computing Foundation, as of September 2026. This guide covers the performance-based exam, the six domains and their weights, the active CKA prerequisite, cost and validity, DoD 8140 status, the roles it fits, and how it compares with the CKA, the CKAD and the CCSP.
The Certified Kubernetes Security Specialist is the security certification for people who already run Kubernetes. It is issued by the Cloud Native Computing Foundation (CNCF) through the Linux Foundation, and it is the only credential in the CNCF Kubernetes line that requires another one first.
It validates the skills needed to secure container-based applications and Kubernetes platforms during build, deployment and runtime. In practice that means hardening the cluster and the hosts underneath it, locking down the API with RBAC, enforcing Pod Security Standards, securing the image supply chain, and detecting and investigating attacks once workloads are live.
There is no multiple choice. The exam is performance-based: you get two hours at a command line in a live Kubernetes cluster and a set of tasks to complete, currently on Kubernetes v1.35. Candidates must hold an active CKA before they can attempt it. The exam is administered by the Linux Foundation, and the certification is valid for two years.
Network policies, CIS benchmarks, Ingress with TLS, node metadata protection and binary verification. 15%.
RBAC, service accounts, restricting API access and upgrading Kubernetes. 15%.
Host OS footprint, least-privilege IAM, network access and kernel hardening with AppArmor and seccomp. The smallest domain at 10%.
Pod Security Standards, secrets management, isolation techniques and Pod-to-Pod encryption. 20%.
Base image footprint, SBOM and CI/CD security, artifact protection and static analysis. 20%.
Behavioral analytics, threat detection, attack investigation, container immutability and audit logs. 20%.
Four things that set CKS apart from the other Kubernetes certifications and from written cloud security exams.
CKS is a performance-based exam. Every item is a task you complete in a real Kubernetes cluster from the command line, inside two hours, so there is nowhere to hide a gap in hands-on skill. Hiring managers know that, which is why the credential reads as proof of ability rather than proof of reading.
You cannot register for CKS without an active CKA, which makes it the one CNCF credential with a built-in floor. Anyone holding it has already proven they can administer a cluster, and CKS shows they can secure one. Employers read the pair as a single, deeper signal.
Supply Chain Security and Monitoring, Logging and Runtime Security each weigh 20 percent, so two fifths of the exam sits outside classic cluster configuration. Our comparison of CKA, CKAD and CKS explains how the security exam differs from the two below it.
CKS is not a DoD 8140 credential. It does not appear in the Qualification Matrix V2.1, so on its own it will not satisfy a cyber-coded position requirement. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the market instead. Kubernetes runs production workloads across enterprise, cloud provider and government environments, the CNCF is the body that stewards the project, and CKS is the CNCF's own test of whether someone can secure it. Teams that run clusters ask for it because a passing result means the holder did the work in a live cluster, not on paper. Federal cloud teams ask for it even though it sits outside the 8140 matrix.
Everything you need to know about the certification, the performance-based exam, and how to keep it current, as of September 2026.
CKS is the top of the CNCF Kubernetes security path, and most people who earn it go one of three ways: broader cloud security, the security specialty of their cloud provider, or the developer-side Kubernetes exam they skipped on the way up.
The step outward. ISC2's CCSP covers cloud security design, data protection, operations and compliance across providers rather than inside one platform. It uses a 100 to 150 item adaptive exam over three hours and asks for five years of experience. CKS holders who move into architecture or governance roles take it to prove breadth.
The step into your cloud. The AWS Certified Security Specialty and Microsoft's Azure Security Engineer cover the identity, key management, logging and network controls around a managed Kubernetes service. Most clusters run on one of these platforms, and the specialty covers the half of the security picture that CKS leaves to the provider.
The sideways move. The CKAD tests building, deploying and configuring applications on Kubernetes from the developer's chair, with no prerequisite and the same two-hour, performance-based format. Many CKS holders add it to complete the CNCF set, and it sharpens the workload configuration skills the security exam assumes you have.
CKS sits at the specialist tier of the CNCF path. The CKA is the required first rung, CKS builds directly on it, and from there the path goes outward into cloud security or deeper into your cloud provider's security stack.
The cluster groundwork
Security on a live cluster
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue CKS specifically. Here's a straight answer to both.
One hard prerequisite, and no other paperwork.
CKS is the one CNCF certification with a gate in front of it. You must have taken and passed the Certified Kubernetes Administrator exam, and your CKA must be active when you sit CKS. Beyond that there is no experience form, no endorsement and no required training: you buy the exam from the Linux Foundation, which gives you 12 months to schedule it, and you book an online proctored slot. If you don't hold a CKA yet, that exam is the first step, and our CKA guide covers it.
Knowing the concepts is not the same as doing them at speed.
Every task has to be completed at a terminal in a real cluster, and the clock does not stop while you look something up. Candidates who understand RBAC, network policies and Pod Security Standards but have not practiced writing them from scratch run out of time. The preparation that works is repetition: build each control in a lab cluster until the YAML and the kubectl commands come without thinking, then do it again against the clock.
CKS is hired for by teams that run Kubernetes in production and need someone accountable for securing it. The six roles below are where the credential does the most work on a resume.
The role the exam was built for. Owns the hardening of clusters and the workloads on them: RBAC, network policies, Pod Security Standards, secrets handling and audit logging, which map one to one onto the CKS domains.
Builds and runs the internal Kubernetes platform other teams deploy to. CKS shows the platform is being built with security controls in place rather than added later, which is the question a platform team gets asked in every security review.
Sits between the pipeline and the cluster. The supply chain domain, with base image minimization, SBOMs, artifact protection and static analysis of manifests and images, is this role's daily work.
Secures workloads on a managed Kubernetes service and the cloud around it. CKS covers the in-cluster half; the provider's own security controls cover the rest, and employers often ask for both.
Keeps production clusters healthy and is increasingly asked to keep them secure. The runtime security domain, with behavioral detection, audit logs and container immutability, is where SRE and security work overlap.
Designs the security model for container platforms across an organization. CKS gives an architect hands-on credibility with the engineers who implement the design, and CCSP is the usual next credential for the breadth.
CKS is the third of the three CNCF Kubernetes certifications, and CCSP is the broad cloud security credential people weigh against it. Here's how the four line up.
| CKS | CKA | CKAD | ISC2 CCSP | |
|---|---|---|---|---|
| Issuer | CNCF via the Linux Foundation | CNCF via the Linux Foundation | CNCF via the Linux Foundation | ISC2 |
| Level | Specialist (security) | Administrator | Developer | Vendor-neutral, advanced |
| Focus | Securing clusters, workloads, the supply chain and runtime | Installing, configuring and troubleshooting clusters | Building, deploying and configuring applications on Kubernetes | Cloud security design, data, operations and compliance |
| Prerequisites | Active CKA | None | None | 5 yrs IT (3 in security, 1 in a domain) |
| Exam | Performance-based, live cluster, 2 hrs | Performance-based, live cluster, 2 hrs | Performance-based, live cluster, 2 hrs | Adaptive (CAT), 100 to 150 items, 3 hrs |
| Domains | 6 | 5 | 5 | 6 |
| Passing Score | Not published by CNCF | See training.linuxfoundation.org | See training.linuxfoundation.org | 700 of 1000 |
| Exam Cost | $445 | $445 | $445 | ~$599 |
| Validity | 2 years | 2 years | 2 years | 3 years (90 CPEs) |
| Good Fit For | Cluster administrators moving into security | Cluster operators and platform engineers | Developers deploying to Kubernetes | Senior cloud security architects and engineers |
Pricing varies by region and taxes. CKA and CKAD facts reflect the Training Camp CKA and CKAD guides and training.linuxfoundation.org on September 29, 2026. CCSP facts reflect the live Training Camp CCSP guide, which describes the ISC2 outline effective August 1, 2026. None of the CNCF certifications appear on the DoD 8140 Matrix; their recognition is market-driven rather than DoD-listed. CCSP is on the Matrix.
Our Certified Kubernetes Security Specialist boot camp is five days of live online, hands-on, lab-based training built around the CNCF exam curriculum, with labs across all six domains, post-class mentoring and a free course retake within one year, for $2,895. The CKS exam is not included; you purchase it from the Linux Foundation for $445. See all of our Linux Foundation training courses.
Which Kubernetes exam to take first, why incident response skills matter in the cloud, and how to turn the CNCF curriculum into a study plan.
The three CNCF Kubernetes exams side by side: what each one tests, why CKS requires the CKA, and how to pick a starting point based on whether you run clusters or build for them.
The runtime security domain of CKS is about spotting and investigating an attack in progress. This piece explains why that skill set is in demand across cloud teams, not only on security ones.
System Hardening on CKS reaches down to the host operating system. A look at the Linux+ exam, its performance-based questions, and the Linux fundamentals that make Kubernetes security work easier.
For anyone deciding between the two directions CKS sits between. How cloud and security work overlap, and how to choose an order based on the job you want.
The CNCF curriculum is the objectives document for CKS. How to read one, turn each bullet into a lab exercise, and track what you have practiced before exam day.
CKS is valid for two years and CCSP for three with CPEs. A comparison of how the major certification bodies handle renewal, so you can plan a stack of credentials that stays current.
Many teams reconsidering their VMware footprint are moving workloads onto Kubernetes. What changed in the VMware certification program and how that shift affects platform careers.
The CKS exam is organized into six domains, each carrying its own weight. Minimize Microservice Vulnerabilities, Supply Chain Security, and Monitoring, Logging and Runtime Security each carry 20 percent, and together they make up three fifths of the exam. Click any domain for what it covers.
How the cluster is put together securely from the start: network security policies that limit which Pods can talk to each other, a CIS benchmark review of the control plane and node components, Ingress objects that terminate TLS, and protection for node metadata and endpoints. It also covers verifying the platform binaries you install against their published checksums before you trust them.
Locking down the Kubernetes API itself. RBAC roles and bindings that grant only what a subject needs, service accounts that are scoped tightly and not left with default tokens, restrictions on who and what can reach the API server, and keeping the cluster upgraded so known vulnerabilities are patched.
The smallest domain and the one that reaches below Kubernetes to the host. Minimizing the operating system footprint on nodes, applying least-privilege IAM to the identities the cluster uses, cutting network access to what the workloads need, and kernel hardening with AppArmor and seccomp profiles.
Keeping individual workloads from becoming the weak point. Pod Security Standards and how to enforce them, secrets management that keeps credentials out of manifests and images, isolation techniques such as sandboxed container runtimes, and Pod-to-Pod encryption.
Everything that happens to code and images before they reach the cluster. Minimizing the base image footprint, securing the CI/CD pipeline and producing an SBOM, protecting artifacts and the registries that hold them, and running static analysis against workload manifests and container images.
Detecting and investigating what happens once containers are running. Behavioral analytics for process and syscall activity, threat detection inside the cluster, investigating an attack across hosts and containers, enforcing container immutability, and configuring Kubernetes audit logs so you can reconstruct what happened.
Domains and weights reflect the CNCF Certified Kubernetes Security Specialist curriculum for the Kubernetes v1.35 exam environment as published on training.linuxfoundation.org and verified on September 29, 2026. The environment moves to each new Kubernetes minor version within about four to eight weeks of release, so confirm the current version before scheduling.
The questions candidates ask most often when researching the Certified Kubernetes Security Specialist.
CKS stands for Certified Kubernetes Security Specialist. It's the security certification issued by the Cloud Native Computing Foundation (CNCF) through the Linux Foundation, and it validates that you can secure container-based applications and Kubernetes platforms during build, deployment and runtime. Unlike most security certifications, it's entirely hands-on: you solve tasks in a live cluster rather than answering multiple choice questions.
Yes. You must have taken and passed the Certified Kubernetes Administrator exam, and your CKA must be active when you attempt CKS. It's the only CNCF Kubernetes certification with a prerequisite. If you don't hold a CKA yet, start there; our CKA guide covers that exam.
CKS is an online, proctored, performance-based exam. You get two hours at a command line in a live Kubernetes cluster and a set of tasks to complete; there are no multiple choice questions. The exam environment runs Kubernetes v1.35 as of September 2026, and the Linux Foundation moves it to each new minor version within about four to eight weeks of a Kubernetes release.
The six domains are Cluster Setup (15 percent), Cluster Hardening (15 percent), System Hardening (10 percent), Minimize Microservice Vulnerabilities (20 percent), Supply Chain Security (20 percent), and Monitoring, Logging and Runtime Security (20 percent). The three 20 percent domains together make up three fifths of the exam, so workload security, the supply chain and runtime detection deserve most of your lab time.
CNCF does not publish a passing score on the CKS exam page. You receive your result after the exam has been graded, and the exam purchase includes one retake if you need it. The practical approach is to complete as many tasks as you can in the two hours and check each one before moving on.
The exam costs $445 USD and is purchased directly from the Linux Foundation. That price includes one retake and a 12-month window to schedule the exam after you buy it. The exam is delivered online with a proctor, so there's no test center to travel to.
No. CNCF certifications don't appear on the DoD 8140 Approved Qualifications Matrix V2.1, so CKS on its own won't satisfy a cyber-coded position requirement. Government teams that run Kubernetes still ask for it because the exam proves hands-on cluster security skill, but that demand comes from the market, not the matrix. See the full DoD 8140 work role paths.
CKS is valid for two years from the date you earn it. The Linux Foundation sets the renewal terms, so check its current certification renewal policy well before your expiration date. Two years is shorter than the three-year cycle most security certifications use, which reflects how quickly Kubernetes itself changes.
CKS is hired for by teams that run Kubernetes in production: Kubernetes Security Engineer, Platform Engineer, DevSecOps Engineer, Cloud Security Engineer, Site Reliability Engineer and Cloud Native Security Architect. Because the prerequisite is a CKA, employers read it as proof that you can both run a cluster and secure one, which is a rarer combination than either skill alone.
CKA comes first if you want CKS, because CKS requires it. CKAD is the developer-side exam with no prerequisite, so someone who builds applications for Kubernetes rather than operating clusters can start there instead. All three share the same two-hour, performance-based format and the same $445 price. Our article on which Kubernetes certification to take first walks through the decision in detail.
It's a demanding exam, and the difficulty is time rather than trick questions. You have two hours to complete security tasks in a live cluster, and each one requires you to write working YAML and kubectl commands while the clock runs. People who pass tend to have practiced every domain in a lab until the controls come automatically. Plan on several weeks of hands-on preparation on top of your CKA experience.
The boot camp is five days of live online, hands-on, lab-based training built around the CNCF exam curriculum, with labs across all six domains, post-class mentoring, and a free course retake within one year, for $2,895. The CKS exam itself is not included, so you purchase it separately from the Linux Foundation for $445 and schedule it when you're ready.
For anyone who already holds a CKA and works on production clusters, yes. It's hands-on proof of Kubernetes security skill in a live environment, the exam costs $445, and the two-year validity keeps it aligned with current Kubernetes versions. For people without a CKA, or whose security work happens mostly in a cloud console or a governance role, CCSP or a provider security specialty is a better use of the time.
If you're weighing the certification, planning the Kubernetes path from CKA to CKS, or arranging container security training for a team, tell us where you are and we'll help you map out the right next step.