This advanced course teaches you to secure a Kubernetes cluster end to end, from building images to spotting suspicious behaviour in production. It covers all six domains of the Linux Foundation CKS exam, a hands-on test open only to CKA holders. The labs recreate the pace and constraints of the real exam. You leave with a repeatable hardening checklist you can apply to your own clusters the following week.
Lock down traffic with NetworkPolicies and check a cluster against the CIS benchmark
Harden API access, RBAC and service accounts
Shrink the node attack surface with AppArmor and seccomp
Isolate workloads and protect secrets
Secure the supply chain: images, SBOMs, signing and static analysis
Detect runtime threats and make use of audit logs
Manage the two-hour exam window with a clear triage strategy for tasks
Program
Cluster setup (15%)
Restrictive NetworkPolicies
CIS benchmark checks
Ingress with TLS
Protecting node metadata
Verifying platform binaries
Cluster hardening (15%)
Least-privilege RBAC
Service accounts
Restricting API access
Kubernetes upgrades
System hardening (10%)
Reducing host OS footprint
Least-privilege IAM access
Kernel hardening: AppArmor and seccomp
Minimizing microservice vulnerabilities (20%)
Pod Security Standards
Secrets management
Container isolation and sandboxing
Pod-to-pod encryption
Supply chain security (20%)
Minimal base images
SBOMs and artifact integrity
Securing CI/CD pipelines
Static analysis of manifests
Monitoring, logging and runtime security (20%)
Behavioural analytics and threat detection
Audit logs
Container immutability
Prerequisites
A passed CKA exam before taking CKS (official requirement)
Day-to-day use of kubectl and Linux administration
Target audience
CKA holders moving into security
DevSecOps and cloud security engineers
Kubernetes platform architects and leads
SOC and incident response staff who need to investigate container environments
The exam
CKS is a remotely proctored, hands-on exam: over 2 hours you carry out security tasks on live Kubernetes clusters and need 67% to pass. The environment tracks the latest Kubernetes minor release (currently v1.35). The purchase includes a second attempt, two Killer.sh simulator sessions and 12 months to schedule. Tasks are offered in English, Simplified Chinese and Japanese. The certification is valid for 2 years, and passing it also renews an active KCSA.
Preparation tips
Practise writing AppArmor and seccomp profiles from scratch
Know how to configure audit policies and API server admission plugins
Keep your CKA skills sharp: kubectl speed makes the difference
Frequently asked questions (FAQ)
Can I take CKS without CKA?
No. The Linux Foundation requires a passed CKA before you attempt CKS.
Is CKS harder than CKA?
Most candidates find it tougher. It combines cluster administration with a wide range of security tools, and the time pressure is real: many tasks require editing static pod manifests or node configuration, where one mistake can take the API server down.
Which tools should I know?
Native Kubernetes controls, AppArmor, seccomp, an image scanner, a runtime detection tool and audit policy. We practise all of them in the labs.
Does the CKS certification expire?
Yes. It is valid for 2 years and is renewed by passing the exam again.
Is the course available in French?
Yes, in French or English, live online, in Casablanca or on-site. The exam itself is not offered in French.
Securevalley training — online and in-person sessions. Contact us for pricing and registration terms.
Securevalley is not a training partner of the Linux Foundation or CNCF. Kubernetes and CKS are trademarks of The Linux Foundation.