# Certified Kubernetes Security Specialist (CKS) syllabus

Official sources: [CNCF curriculum repository](https://github.com/cncf/curriculum) (current published curriculum: Kubernetes v1.34) and the [Linux Foundation CKS exam page](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/) (current exam environment: Kubernetes v1.35).

## 1. Cluster Setup — 15%

- Use NetworkPolicies to restrict cluster-level access.
- Use the CIS Benchmark to review the security configuration of Kubernetes components: etcd, kubelet, CoreDNS, and kube-apiserver.
- Set up Ingress with TLS correctly.
- Protect node metadata and endpoints.
- Verify platform binaries before deployment.

## 2. Cluster Hardening — 15%

- Use RBAC to minimize exposure.
- Use ServiceAccounts carefully: disable defaults where appropriate and minimize new-account permissions.
- Restrict Kubernetes API access.
- Upgrade Kubernetes to avoid known vulnerabilities.

## 3. System Hardening — 10%

- Minimize the host operating-system footprint and attack surface.
- Apply least-privilege identity and access management.
- Minimize external network access.
- Use kernel hardening tools appropriately, including AppArmor and seccomp.

## 4. Minimize Microservice Vulnerabilities — 20%

- Apply appropriate Pod Security Standards.
- Manage Kubernetes Secrets securely.
- Understand and implement isolation techniques, including multi-tenancy and sandboxed containers.
- Implement Pod-to-Pod encryption using Cilium.

## 5. Supply Chain Security — 20%

- Minimize base-image footprint.
- Understand the supply chain, including SBOMs, CI/CD, and artifact repositories.
- Secure the supply chain through permitted registries, signing, and artifact validation.
- Perform static analysis of user workloads and container images, for example with Kubesec or KubeLinter.

## 6. Monitoring, Logging, and Runtime Security — 20%

- Perform behavioral analytics to detect malicious activity.
- Detect threats affecting infrastructure, applications, networks, data, users, and workloads.
- Investigate attack phases and identify malicious actors.
- Ensure runtime immutability of containers.
- Use Kubernetes audit logs to monitor access.

## Course coverage tracker

| Domain | Lessons completed or available | Still to drill |
| --- | --- | --- |
| Cluster Setup | 2, 8, 15, 16, 22, 28 | CIS, node metadata, binary verification |
| Cluster Hardening | 3, 7, 9 | API restriction, upgrades |
| System Hardening | 4, 6, 11 | host footprint, external access; AppArmor needs a compatible kernel |
| Microservice Vulnerabilities | 5, 6, 7, 8, 10 | multi-tenancy/sandboxes, Cilium encryption |
| Supply Chain Security | 13, 27, 30 | signing, registries, image scanning |
| Monitoring/Logging/Runtime | 12 | behavior analysis, runtime immutability, audit investigation |

## Supplemental: Istio service-mesh security

Istio is not a separately weighted CKS domain, but its mTLS and authorization controls reinforce the CKS objectives around workload isolation and encrypted service traffic. The supplemental path starts with Lesson 25: namespace-wide strict mTLS using `PeerAuthentication`, then will progress to workload-scoped mTLS and `AuthorizationPolicy`.