CKS study guide
CKS · Work through your exam, one topic at a time.
The Certified Kubernetes Security Specialist (CKS) is a vendor-neutral credential created by the Cloud Native Computing Foundation in collaboration with The Linux Foundation. It attests that a holder can apply security best practices to container-based applications and Kubernetes platforms across build, deployment and runtime - hardening clusters and nodes, tightening access, securing the supply chain, and detecting threats rather than merely operating workloads. The CKS study guide has 6 sections and about 1,581 words.
01Cluster Setup
Cluster Setup in the CKS exam is about configuring the cluster's own defenses: network segmentation, ingress, API access, and baseline compliance. You must be comfortable writing NetworkPolicy objects from scratch, because the exam rarely hands you a template.
298 words, about 1 min02Cluster Hardening
Cluster hardening centers on least-privilege access to the API server and safe service account usage. Know RBAC deeply: Roles are namespaced while ClusterRoles are cluster-scoped; a RoleBinding can reference a ClusterRole but grants it only inside its own namespace, whereas a ClusterRoleBinding grants cluster-wide.
275 words, about 1 min03System Hardening
System hardening reduces both host and container attack surface. On the node, that means minimal installed packages, disabled unused services, SSH key-only access, and kernel hardening.
233 words, about 1 min04Minimize Microservice Vulnerabilities
Microservice security is largely about Pod Security Standards (PSS) and secure Pod specifications. PSS defines three levels: privileged (unrestricted), baseline (blocks known privilege escalations), and restricted (heavily hardened).
252 words, about 1 min05Supply Chain Security
Supply chain security covers the path from source to running container: image provenance, scanning, signing, and admission. ) is the strongest reference.
256 words, about 1 min06Monitoring, Logging and Runtime Security
Runtime security is about detecting and responding to what containers actually do. The two exam pillars are audit logging and runtime threat detection.
267 words, about 1 min