Free Online Course · Self-paced

CKS Tutorial: Certified Kubernetes Security Specialist Course

Free CKS tutorial aligned to the official Kubernetes security curriculum — CKA foundation, six weighted security domains, and hands-on hardening, supply-chain, and runtime lessons on any Kubernetes cluster.

  • 40 parts
  • ~529 min total
  • Advanced
  • Updated Jul 2026
Reviewed Deepak Prasad
Start the course View syllabus
CKS Tutorial: Certified Kubernetes Security Specialist Course
By Last updated

This syllabus tracks the official CKS curriculum. CKS is a security specialization, not a starting point — it assumes you hold an active CKA certification and can already install, operate, and troubleshoot a cluster. You start with a short foundation refresher, then work through the six weighted security domains, each linking to a hands-on tutorial you can repeat on your own VMs.

Open Before You Begin first if your lab is not ready. The walkthroughs use a multi-node kubeadm cluster with one control-plane node and two workers, and several lessons install extra tools — kube-bench, Trivy, Cosign, Falco, Cilium, Istio, and gVisor — that you tear down afterward. The chapters follow a learning path from cluster setup through supply chain to runtime security, not the accordion order on the Linux Foundation marketing page.

Foundation topics such as RBAC, ServiceAccounts, and Secrets are shared with the CKA and CKAD courses; on the CKS hub they carry the extra security angle the exam expects. For topics outside the CKS blueprint, browse the wider Kubernetes tutorial.

What the CKS exam expects

The competency bullets below come from the current CKS blueprint, grouped by exam weight. CKS is a two-hour, performance-based exam run on Kubernetes v1.35 — every task is hands-on work on a live cluster.

Cluster Setup (15%)

  • Use Network security policies to restrict cluster level access
  • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
  • Properly set up Ingress with TLS
  • Protect node metadata and endpoints
  • Verify platform binaries before deploying

Cluster Hardening (15%)

  • Use Role Based Access Controls to minimize exposure
  • Exercise caution in using service accounts (e.g. disable defaults, minimize permissions on newly created ones)
  • Restrict access to Kubernetes API
  • Upgrade Kubernetes to avoid vulnerabilities

System Hardening (10%)

  • Minimize host OS footprint (reduce attack surface)
  • Use least-privilege identity and access management
  • Minimize external access to the network
  • Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities (20%)

  • Use appropriate pod security standards
  • Manage Kubernetes secrets
  • Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
  • Implement Pod-to-Pod encryption (Cilium, Istio)

Supply Chain Security (20%)

  • Minimize base image footprint
  • Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
  • Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
  • Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

Monitoring, Logging and Runtime Security (20%)

  • Perform behavioral analytics to detect malicious activities
  • Detect threats within physical infrastructure, apps, networks, data, users and workloads
  • Investigate and identify phases of attack and bad actors within the environment
  • Ensure immutability of containers at runtime
  • Use Kubernetes audit logs to monitor access

The three heaviest domains — Minimize Microservice Vulnerabilities, Supply Chain Security, and Runtime Security — together account for 60% of the exam, so weight your practice toward Pod Security Standards, image scanning and signing, and Falco. Cluster Setup and System Hardening are smaller but reward knowing the exact command syntax cold.

Use Start the course to open Before You Begin, or jump straight to any competency in the syllabus.

What you'll learn

  • Restrict cluster access with NetworkPolicy, secure Ingress TLS, and CIS-benchmark reviews using kube-bench
  • Harden the API server, RBAC, ServiceAccounts, and control-plane certificates against privilege escalation
  • Reduce host attack surface and confine workloads with seccomp, AppArmor, and Linux capabilities
  • Enforce Pod Security Standards, isolate tenants, sandbox with gVisor, and encrypt Pod traffic with Cilium or Istio
  • Secure the supply chain — minimal images, Trivy scanning, SBOMs, Cosign signing, and admission control
  • Detect and investigate runtime threats with audit logging, Falco, immutable containers, and incident response

Prerequisites

  • An active CKA certification — CKS assumes you can already install, operate, and troubleshoot a cluster
  • Comfortable Linux command line, systemd, and host security basics (users, firewalls, file permissions)
  • A multi-node kubeadm lab (one control-plane + two workers) with containerd, plus room to install kube-bench, Trivy, Cosign, Falco, Cilium, Istio, and gVisor
  • Familiarity with YAML manifests and reading kubectl output under time pressure

Syllabus

7 chapters · 40 lessons · ~529 min of reading

  1. 1 Before You Begin — CKA Foundation and Security Lab 6 lessons
    1. Part 1 Install Kubernetes with kubeadm (multi-node cluster) 25 min read
    2. Part 2 Install kubectl and configure kubeconfig 14 min read
    3. Part 3 kubectl commands and YAML examples 14 min read
    4. Part 4 Kubernetes architecture and control plane components 14 min read
    5. Part 5 Authentication, authorization, and admission control 10 min read
    6. Part 6 Kubernetes security architecture and attack surface 13 min read
  2. 2 Cluster Setup — 15% 5 lessons
    1. Part 7 NetworkPolicy with examples 20 min read
    2. Part 8 Audit the CIS benchmark with kube-bench 13 min read
    3. Part 9 Ingress with host, path, and TLS examples 15 min read
    4. Part 10 Protect node metadata and kubelet endpoints 9 min read
    5. Part 11 Verify Kubernetes release binaries and images 8 min read
  3. 3 Cluster Hardening — 15% 5 lessons
    1. Part 12 Kubernetes RBAC with examples 9 min read
    2. Part 13 Kubernetes ServiceAccounts with examples 10 min read
    3. Part 14 Harden Kubernetes API server access 13 min read
    4. Part 15 PKI, CSR, and certificate renewal 16 min read
    5. Part 16 Upgrade a Kubernetes cluster with kubeadm 26 min read
  4. 4 System Hardening — 10% 5 lessons
    1. Part 17 Harden Linux nodes for Kubernetes 19 min read
    2. Part 18 Use seccomp profiles in Kubernetes 10 min read
    3. Part 19 Use AppArmor profiles in Kubernetes 10 min read
    4. Part 20 SecurityContext with practical examples 11 min read
    5. Part 21 Linux capabilities in Kubernetes 9 min read
  5. 5 Minimize Microservice Vulnerabilities — 20% 6 lessons
    1. Part 22 Pod Security Standards and admission 13 min read
    2. Part 23 Kubernetes Secrets with examples 10 min read
    3. Part 24 Multi-tenancy and workload isolation 13 min read
    4. Part 25 Sandboxed containers with RuntimeClass and gVisor 12 min read
    5. Part 26 Encrypt Pod traffic with Cilium WireGuard 16 min read
    6. Part 27 Enable Istio mutual TLS with PeerAuthentication 13 min read
  6. 6 Supply Chain Security — 20% 7 lessons
    1. Part 28 Build secure minimal container images 13 min read
    2. Part 29 Scan container images with Trivy 11 min read
    3. Part 30 Generate and scan container SBOMs with Trivy 11 min read
    4. Part 31 Sign and verify container images with Cosign 12 min read
    5. Part 32 Allow trusted images with ImagePolicyWebhook 14 min read
    6. Part 33 Scan Kubernetes YAML with Kubesec and KubeLinter 12 min read
    7. Part 34 Secure container image promotion in CI/CD 10 min read
  7. 7 Monitoring, Logging and Runtime Security — 20% 6 lessons
    1. Part 35 kubectl logs, Events, and describe 17 min read
    2. Part 36 Debug Pods with kubectl exec and kubectl debug 8 min read
    3. Part 37 Build immutable containers in Kubernetes 12 min read
    4. Part 38 Kubernetes audit logging 13 min read
    5. Part 39 Runtime security with Falco 15 min read
    6. Part 40 Incident response and forensics 16 min read
Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with more than 15 years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)