Skip to main content
Ace Skills Consulting
The Linux Foundation (CNCF) logoAdvanced

Certified Kubernetes Security Specialist (CKS)

Harden Kubernetes clusters, secure the software supply chain and detect threats at runtime.

  • 24 hours of live, trainer-led sessions
  • Hardening labs on your own multi-node cluster
  • Pod Security, network policies and audit logging
  • Image scanning, signing and admission control
  • Runtime threat detection with Falco
Aligned to The Linux Foundation (CNCF) exam CKS
Duration
3 Days | 24 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
CKS
Language
English

Why learn CKS with Ace Skills

  • Defence in depth

    Secure every layer — host, cluster, workload and supply chain — in one connected story.

  • Hands-on hardening

    Apply and verify each control in your own cluster rather than reading about it.

  • Detect and respond

    Write detection rules, read audit logs and investigate a simulated compromise.

  • Exam-paced practice

    Timed tasks build the speed needed for a two-hour, hands-on exam.

Course overview

Running Kubernetes in production means defending it: locking down the API server, isolating workloads, controlling what images can run and spotting suspicious behaviour quickly. The CKS exam tests these skills hands-on, and this three-day course is built around practical hardening tasks in your own cluster.

Day one covers cluster setup and hardening: network policies, CIS benchmark checks, securing Ingress with TLS, protecting node metadata and binaries, restricting API access, tightening RBAC and service accounts, and keeping Kubernetes up to date.

Day two moves to system hardening and microservice isolation. You will reduce the host attack surface, use AppArmor and seccomp profiles, apply Pod Security Standards, manage Secrets securely, introduce sandboxed runtimes and examine pod-to-pod encryption options.

Day three is about the supply chain and runtime security: minimal base images, static analysis of manifests, image scanning, signing and admission policies, followed by audit logging, behavioural detection with Falco and investigating an incident. The day closes with timed mock tasks.

This course is aligned to the CKS exam curriculum published by The Linux Foundation and CNCF. The exam is performance-based and online proctored, and candidates must hold an active CKA certification before attempting it.

Key features

  • Dedicated multi-node lab cluster per learner
  • CIS benchmark scanning and remediation
  • AppArmor, seccomp and Pod Security Standards labs
  • Image scanning, signing and admission policy
  • Audit logging and Falco detection rules
  • Mock tasks in the style of the exam
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • CKA holders responsible for production clusters
  • Platform and DevSecOps engineers
  • Cloud security engineers
  • Site reliability engineers

Prerequisites

  • An active CKA certification (required by the exam provider)
  • Confident with kubectl and Linux administration
  • Basic security concepts: TLS, least privilege

Curriculum

3 Days · 24 Hours · 9 Modules · 7 Labs

  1. Securing the cluster

    • Network policies for default deny
    • CIS benchmark with kube-bench
    • Ingress with TLS
    • Protecting node metadata
    • Verifying platform binaries
    • Lab: Run kube-bench and fix the findings · 50 min

    API and access control

    • Restricting API server access
    • RBAC least privilege
    • Service account hardening
    • Disabling automounted tokens
    • Lab: Lock down RBAC and service accounts · 40 min

    Upgrades

    • Keeping Kubernetes current
    • Upgrade practice
    • Deprecated APIs

  2. Host hardening

    • Minimising host OS footprint
    • Kernel hardening tools
    • IAM on the cloud provider
    • Reducing network exposure
    • Lab: Apply AppArmor and seccomp profiles · 45 min

    Workload isolation

    • Pod Security Standards and admission
    • Security contexts
    • OPA Gatekeeper policies
    • Sandboxed runtimes such as gVisor
    • Lab: Enforce restricted Pod Security on a namespace · 40 min

    Secrets and traffic

    • Secret encryption at rest
    • External secret stores overview
    • Pod-to-pod encryption and service mesh options
    • Lab: Encrypt Secrets at rest in etcd · 40 min

  3. Supply chain security

    • Minimal base images
    • Static analysis of manifests and Dockerfiles
    • Image scanning with Trivy
    • Image signing
    • Allow-listing registries with admission policy
    • Lab: Scan, sign and gate images at admission · 55 min

    Monitoring and runtime security

    • Audit logging policies
    • Behavioural detection with Falco
    • Immutable containers
    • Investigating an incident
    • Lab: Detect and investigate suspicious activity with Falco · 50 min

    Exam readiness

    • Exam rules and environment
    • Prioritising tasks
    • Mock tasks with review
Download full syllabus (PDF)

Skills you will gain

  • Kubernetes security
  • Network policies
  • CIS benchmarks
  • RBAC hardening
  • AppArmor
  • seccomp
  • Pod Security Standards
  • Secrets encryption
  • Supply chain security
  • Image scanning
  • Admission control
  • Audit logging
  • Falco

Tools & technologies

  • kubectl
  • kube-bench
  • Trivy
  • Falco
  • AppArmor
  • OPA Gatekeeper
  • gVisor
  • Cosign

Certification exam

Exam details
Exam nameCertified Kubernetes Security Specialist (CKS)
Exam codeCKS
Duration120 minutes
Voucher includedNo — book directly with the vendor
Question formatPerformance-based lab
DeliveryOnline proctored

Skill areas measured

  1. Cluster setup
  2. Cluster hardening
  3. System hardening
  4. Minimise microservice vulnerabilities
  5. Supply chain security
  6. Monitoring, logging and runtime security

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 24 hours of live, trainer-led sessions
  • 7 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 50 min

    Run kube-bench and fix the findings

  • Day 3 · 55 min

    Scan, sign and gate images at admission

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The The Linux Foundation (CNCF) certification itself is awarded by The Linux Foundation (CNCF) when you pass exam CKS.

Frequently asked questions

Do I need CKA before CKS?

Yes. The exam provider requires an active CKA certification before you can sit the CKS exam.

What is the exam format?

It is performance-based and online proctored: you complete security tasks on live clusters within the time limit.

Which tools are covered?

We use widely adopted open-source tools such as kube-bench, Trivy, Falco, AppArmor and OPA Gatekeeper; check the current curriculum for the tools named by the exam.

Is this useful on managed Kubernetes?

Yes. Most workload, supply-chain and runtime controls apply directly to EKS, AKS and GKE.

Related courses

Explore more

All DevOps & Containers courses The Linux Foundation (CNCF) certifications

Kubernetes, CKA, CKAD and CKS are trademarks of The Linux Foundation.

Train your team on CKS

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.