CKS · ● Active · Professional · CNCF / Linux Foundation
Exam facts
| Field | Value |
|---|---|
| Cost | $445 USD (exam only; 12-month eligibility, 1 retake, 2 Killer.sh simulator attempts) |
| Duration | 120 minutes (2 hours) |
| Questions | 15–20 performance-based lab scenarios |
| Passing | 67% scaled score (exact score kept private by vendor) |
| Format | Hands-on labs (terminal / kubectl cluster management) |
| Delivery | Linux Foundation Online Exam Portal (Proctor.io) |
| Languages | English, Japanese, Mandarin |
| Valid | 2 years |
| Renewal | Retake CKS or earn a higher CNCF cert (CKA, CKAD) to refresh 2-year validity |
| Prerequisites | Active CKA (Certified Kubernetes Administrator) required — must be valid at time of CKS attempt |
| Released | 2020-11-19 |
| Retiring | N/A |
Vendor source — CNCF Training & Certification ↗
Official exam guide — CKS Curriculum (GitHub) ↗
Linux Foundation CKS page — LF Training & Certification ↗
Exam objectives & domains — CKS Exam Domains ↗
About
The CKS is a hands-on professional certification for Kubernetes security specialists, launched by CNCF in November 2020 and now aligned with Kubernetes v1.34 (as of 2026). It requires active CKA certification as a prerequisite and validates the ability to secure Kubernetes clusters across cluster setup, hardening, supply-chain security, runtime security, and monitoring. Passing typically requires 18–24 weeks of hands-on lab work and strong familiarity with Linux/container security fundamentals.
Domain context — Security
Container and Kubernetes cluster security: hardening ingress, etcd, RBAC, network policies, admission control, pod security standards, image scanning, secrets management, runtime monitoring, and supply-chain assurance for cloud-native workloads.
Read full deep dive — CNCF Ecosystem ↗
Topics covered
- Cluster Setup (15%) — Networking policies, ingress rules, secured API server configuration, etcd encryption.
- Cluster Hardening (15%) — RBAC design, service account management, admission controllers (PodSecurityPolicy, ValidatingWebhook), network segmentation.
- System Hardening (10%) — Linux kernel hardening, AppArmor / SELinux profiles, seccomp policies, user/privilege isolation, secure container runtimes.
- Minimize Microservice Vulnerabilities (20%) — Image scanning, container registry security, private registries, signed images, pod security standards, workload isolation.
- Supply Chain Security (20%) — Container image security, image signing & verification, artifact registry security, signed releases.
- Monitoring, Logging & Runtime Security (20%) — Audit logging, system call tracing (falco), runtime security scanning, log aggregation, threat detection.
Source: CNCF CKS Curriculum ↗
Common skills at Security · Professional
Shared content for the Security domain at Professional level — not specific to this cert.
- Design and implement role-based access control (RBAC) policies
- Harden and secure containerized workloads across orchestration platforms
- Evaluate and select appropriate authentication and authorization frameworks
- Implement network segmentation and micro-segmentation strategies
- Apply compliance frameworks (PCI-DSS, SOC 2, CIS Benchmarks) to cloud infrastructure
- Perform threat modeling and risk assessment for distributed systems
- Design audit trails and forensic logging for compliance and incident response
Recommended courses at Security · Professional
| Provider | Title | Cost | URL |
|---|---|---|---|
| Linux Foundation | LFS260: Kubernetes Security Essentials | $799 (includes exam voucher) | ↗ |
| KodeKloud | CKS Certification Course (Mumshad Mannambeth) | $99 | ↗ |
| A Cloud Guru | Certified Kubernetes Security Specialist | $49/month | ↗ |
| Killer.sh | CKS Simulator | $70 (2 full exams + solutions) | ↗ |
| Killercoda | Interactive Labs (CKS track) | Free | ↗ |
Course-selection rule: Each course is specifically built for CKS hands-on labs. Killer.sh and Killercoda are mandatory supplementary resources for exam prep.
Practice exams
| Provider | Title | Cost | URL |
|---|---|---|---|
| Killer.sh | CKS Simulator (2 full exams, time-limited, proctored-style) | $70 | ↗ |
| Linux Foundation | CKS Practice Exam (1 session, 120 min) | Included with LFS260 or $99 standalone | ↗ |
| KodeKloud | Mock Exams (included in course) | Included | ↗ |
Books
| Title | Author | Publisher | Year | ISBN | URL |
|---|---|---|---|---|---|
| Kubernetes Security and Observability | Brendan Creane, Amit Gupta | O'Reilly | 2023 | 978-1-098-12067-8 | ↗ |
Book note: "Kubernetes Security and Observability" (2023) is the primary professional reference for CKS; covers network policies, RBAC, pod security, secrets, audit logging, and runtime security. No dedicated CKS exam prep textbook exists (most use official curriculum PDF + labs).
Typical job titles at Security · Professional
Kubernetes Security Engineer · Cloud Security Engineer (Kubernetes/Container focus) · DevSecOps Engineer (K8s/container stack) · Platform Security Engineer · Container Security Specialist · Security Architect (Cloud-Native)
(Job titles drawn from current job-board postings and LinkedIn that list CKS as required or strongly preferred.)
Salary
| Region | Range | Source |
|---|---|---|
| USD | $120,000–$180,000 | Glassdoor: Kubernetes Security Engineer ↗ · Robert Half 2026 IT Salary Guide ↗ |
| ZAR | R1,050,000–R1,350,000 | SalaryExpert: Kubernetes Engineer ZA ↗ · PayScale ZA: Kubernetes ↗ |
| GBP | £80,000–£130,000 | IT Jobs Watch: Kubernetes roles ↗ · Hays UK IT Salary Guide ↗ |
| EUR | €90,000–€150,000 (DE/FR/NL) | PayScale EU ↗ |
Salary note: Kubernetes and container security is a premium skillset; roles with CKS command 25–35% premium over generic cloud engineer roles. Data reflects 2026 market rates for mid–senior IC roles (5+ yrs experience in cloud/Kubernetes). CKS certification typically correlates with $10,000–$20,000 salary bump at next job transition.
Skills validated
Cert-specific — what this exam actually tests.
- Secure Kubernetes cluster API server, etcd, and kubelet with strong TLS and encryption at rest
- Design and enforce RBAC (role bindings, cluster roles, service accounts)
- Implement Kubernetes network policies (CNI plugins: Calico, Cilium, Weave)
- Configure pod security standards (formerly PodSecurityPolicy)
- Apply admission controllers: ValidatingWebhooks, MutatingWebhooks, kube-apiserver flags
- Secure container images: scanning (Trivy, Clair), signing (Cosign), private registries
- Implement AppArmor and SELinux profiles for pods
- Configure seccomp policies and restrict Linux kernel capabilities
- Audit Kubernetes events and API calls (audit logs, kubectl commands)
- Runtime security: falco for system call tracing, container escape detection
- Supply-chain security: OCI image specs, signed artifacts, SBOM (Software Bill of Materials)
- Secrets management: encrypted etcd, external secret stores (Vault, AWS Secrets Manager)
Related certifications
- Prerequisite for: CKAD (Certified Kubernetes Application Developer) ↗ — CKS and CKAD stack well for full platform coverage (infrastructure + application layer)
- Stacks with: CKA (Certified Kubernetes Administrator) — CKS requires active CKA; the two certs form a "security + operations" pairing
- Related at this level: [AZ-500 (Azure Security Engineer) ↗]({not yet created}) · [AWS Certified Security – Specialty ↗]({not yet created})
- Vendor overview: CNCF Vendor Overview ↗
Sources
- CNCF Training & Certification: CKS ↗
- Linux Foundation: Certified Kubernetes Security Specialist ↗
- CNCF Curriculum Repository (GitHub) ↗
- Linux Foundation FAQ: CKA, CKAD, CKS ↗
- Killer.sh CKS Simulator ↗
- KodeKloud CKS Certification Course ↗
- A Cloud Guru: Certified Kubernetes Security Specialist ↗
- O'Reilly: Kubernetes Security and Observability ↗
- SalaryExpert: Kubernetes Engineer Salary (South Africa) ↗
- PayScale: Kubernetes Salary (South Africa) ↗
- Glassdoor: Kubernetes Security Engineer Salary ↗
- Robert Half IT Salary Guide ↗
Last verified: 2026-05-01
Parent ecosystem: CNCF Ecosystem
Parent domain: Security
Vendor overview: CNCF Vendor Overview