Certified Kubernetes Security Specialist: exam-style tasks on a real kubeadm cluster on your own Mac, built and graded by the GoldenKube CLI. Each card shows the domain, the cluster topology it needs, the recommended time and its points; the scenario page has the full task text. Scenarios run on Kubernetes 1.35, the version the CKS exam is based on (one minor version behind CKA and CKAD).
CKS is for "an accomplished Kubernetes practitioner (as evidenced by holding the CKA credential)": the Linux Foundation requires that you "must have taken and passed the Certified Kubernetes Administrator (CKA) exam prior to attempting the CKS exam", and the exam is based on Kubernetes v1.35, not the v1.37 of CKA and CKAD. The GoldenKube CKS scenarios therefore assume CKA skills and go to the places a security task touches: API server flags and static Pod manifests, the kubelet configuration on a worker, etcd encryption, AppArmor on the node, and audit logs.
They follow the six official domains: default-deny NetworkPolicies, blocking the metadata endpoint and kubelet CIS hardening (cluster setup); least-privilege RBAC, ServiceAccount tokens and API server authorization (cluster hardening); AppArmor and a node with a rogue service (system hardening); Pod Security Admission, Secrets encrypted at rest and as read-only volumes, and removing host namespaces (microservice vulnerabilities); permitted registries with a ValidatingAdmissionPolicy, static analysis, image digests and binary verification (supply chain); and audit policies, immutable containers and finding a crypto-miner (monitoring, logging and runtime security). Some of them need a second node, which the CLI provisions for that scenario.
| Questions | 15-20 performance-based tasks source |
|---|---|
| Duration (minutes) | 120 source |
| Passing score | 67% source |
| Price (USD) | 445 source |
| Validity (years) | 2 source |
| Delivery | Online, proctored, performance-based (command line) source |
| Prerequisites | Must have taken and passed the Certified Kubernetes Administrator (CKA) exam source |
| Retake policy | One retake per exam purchase if a passing score is not achieved source |
| Curriculum version | Based on Kubernetes v1.35 source |
Published scenarios per official CKS domain, next to the domain's exam weight (checked 2026-10-28 on the official page). 20 published scenarios today.
| Domain | Exam weight | Published scenarios |
|---|---|---|
| Cluster Setup | 15% | 3 |
| Cluster Hardening | 15% | 3 |
| System Hardening | 10% | 2 |
| Minimize Microservice Vulnerabilities | 20% | 4 |
| Supply Chain Security | 20% | 4 |
| Monitoring, Logging and Runtime Security | 20% | 4 |
goldenkube exam cks draws a curriculum-weighted set: 15 tasks in 120 minutes, pass at 67%. Solutions and hints are hidden in exam mode.
20 published scenarios
A CI ServiceAccount was given cluster-wide power; remove the bindings and grant a minimal namespaced Role instead.
Single node · ~8 min · 9 points
goldenkube start cks-hrd-001
Disable token automounting on the default and a dedicated ServiceAccount and move a running Deployment onto it.
Single node · ~7 min · 8 points
goldenkube start cks-hrd-002
The API server authorizes every request and lets kubelets edit any node; restore Node,RBAC authorization and the NodeRestriction admission plugin.
Single node · ~9 min · 8 points
goldenkube start cks-hrd-003
Enforce the restricted Pod Security Standard on a namespace and bring a non-compliant Deployment into line without recreating it.
Single node · ~9 min · 9 points
goldenkube start cks-mic-001
Write an EncryptionConfiguration, wire it into the API server static pod and rewrite an existing Secret so etcd holds it encrypted.
Single node · ~10 min · 8 points
goldenkube start cks-mic-002
Move a Secret from an environment variable to a read-only volume with restrictive file mode and make the Secret immutable.
Single node · ~8 min · 9 points
goldenkube start cks-mic-003
A tenant workload shares the node's network, PID and IPC namespaces, runs privileged and mounts the host; isolate it and enforce baseline.
Single node · ~8 min · 9 points
goldenkube start cks-mic-004
Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.
Single node · ~10 min · 9 points
goldenkube start cks-run-001
Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.
Single node · ~8 min · 7 points
goldenkube start cks-run-002
Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.
Single node · ~7 min · 8 points
goldenkube start cks-run-003
Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.
Single node · ~8 min · 8 points
goldenkube start cks-run-004
Lock a namespace down with a default-deny ingress and egress policy, keep cluster DNS working and open exactly one client-to-server path.
Single node · ~9 min · 10 points
goldenkube start cks-set-001
Protect node metadata by blocking pod egress to 169.254.169.254 while keeping in-cluster traffic and other egress open.
Single node · ~6 min · 7 points
goldenkube start cks-set-002
A worker's kubelet accepts anonymous, unauthorized requests and exposes the read-only port; harden its configuration in place.
Two nodes · ~8 min · 8 points
goldenkube start cks-set-003
Allow only images from one registry in labelled namespaces using a CEL ValidatingAdmissionPolicy and its binding.
Single node · ~9 min · 9 points
goldenkube start cks-sup-001
Review six Deployment manifests against four security rules, report the violators and deploy only the compliant ones.
Single node · ~8 min · 7 points
goldenkube start cks-sup-002
Replace a mutable image tag with the digest of the image the running pods already use.
Single node · ~6 min · 7 points
goldenkube start cks-sup-003
Check downloaded Kubernetes binaries against published SHA-512 checksums and discard the tampered ones.
Single node · ~6 min · 6 points
goldenkube start cks-sup-004
Load an AppArmor profile on a worker node in enforce mode and run a Pod confined by it through the securityContext field.
Two nodes · ~8 min · 8 points
goldenkube start cks-sys-001
Find and disable a service listening on a worker node and remove a local user's sudo membership without breaking the node.
Two nodes · ~7 min · 8 points
goldenkube start cks-sys-002
goldenkube doctor.goldenkube login (free account).goldenkube submit; the result appears on your dashboard.Grading happens on your machine and is practice feedback, not an official score. Tasks are public; hints, reference solutions and grader internals are not.
Not yet. The CKS scenarios are published and readable here, but the first signed build of the CLI is not on the Homebrew tap, so the catalog is a preview. Running a scenario needs that release and a free account.
Because the official CKS page states that the exam is based on Kubernetes v1.35, while CKA and CKAD are based on v1.37. GoldenKube sets up CKS scenarios on Kubernetes 1.35 clusters so that flags and defaults match the exam version.
Not to use the labs. The CKA requirement applies to booking the CKS exam: the Linux Foundation requires a passed CKA first. The CKS tasks assume CKA-level cluster skills, so the CKA catalog is the natural place to start.