Mapping the CKS exam's six weighted domains and the links behind them

Six weighted domains make up the whole blueprint

walidshaari/Certified-Kubernetes-Security-Specialist is a link index, not software. Its stated purpose is to gather online resources for the CNCF/Linux Foundation CKS 2021 Kubernetes Certified Security Specialist exam, and it asks for corrections through issues and pull requests rather than handing you something to install.

What lifts it above a bookmark dump is the weighting. Cluster Setup carries 10 percent, Cluster Hardening 15 percent, System Hardening 15 percent, Minimize Microservice Vulnerabilities 20 percent, Supply Chain Security 20 percent, and Monitoring, Logging and Runtime Security 20 percent. Those figures decide where your lab hours go, and the three heaviest domains are microservice, supply chain and runtime work rather than anything about bringing a cluster up.

One rule runs through the whole file. Resources are cross referenced back to the allowed CKS sites that exam rules already permit, and anything outside that list gets a marker so you can see it at a glance. Videos and third party material sit alongside as optional extras, outside the exam itself.

The early start window is stated twice with different numbers

The exam brief is the densest part of this file. Duration is two hours. The exam holds 15 to 20 hands-on performance based tasks, passes at 67 percent, keeps a certification valid for two years, and demands a valid CKA first. Cost is $375 USD for one year of exam eligibility, with a free retake inside that year.

Read the exam interface notes closely and the repository contradicts itself. One line says candidates can start the Take Exam process 30 minutes prior to their scheduled date and time, then the same line reports currently 15 mins on PSI ExamsLocal platform. Two different windows sit in one sentence, so anyone planning around the larger figure can lose a quarter hour before the clock starts.

The rest of that section describes the environment: a remote desktop preloaded with the tools needed to finish the tasks, self check-in with no proctor to wait for, the PSI Secure Browser reachable through the newest versions of Microsoft Edge, Safari, Chrome or Firefox, a timer that alerts at 30, 15 and 5 minutes remaining, and the content panel held on the left hand side.

Cluster Setup flags the auditing tool it also recommends

Open the Cluster Setup section and the pattern breaks. Securing a Cluster, network policies for cluster level access, Ingress objects with TLS, and protecting node metadata all point at kubernetes.io pages, which the allowed-sites list covers. The next item, the CIS benchmark for etcd, kubelet, kubedns and kubeapi, carries the triangular flag icon, and the Kube-bench link beneath it carries the same flag.

The legend defines that icon as an external third-party resource that cannot be used during the exam. So a repository whose stated job is to cross reference the permitted CKS sites marks the auditing tool for its own first domain as off limits. You can study Kube-bench here, and the linked description says it checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark, but the exam environment will not serve it to you.

The topic list covers far more ground than the text shown: apparmor, kube-hunter, mitre-attack, open-policy-agent, pod-security-policy, seccomp, kernel-hardening and os-footprint all appear there, while the curriculum text itself ends partway into Cluster Setup.

Bookmarked YAML files do not survive the secure browser

Every YAML snippet here is study material, not exam-day tooling, and the repository explains why. Personal bookmarks are no longer permitted, and the text is specific that personal browser bookmarks such as bookmarked links to YAML files will not be accessible within the PSI Secure Browser. Multiple monitors are no longer permitted either.

That constraint changes how you read a page like this one. If you plan to click through a policy manifest halfway through a task, the click is gone. What remains is the shape of the object: which apiVersion, which kind, how far the selector reaches. No offline bundle, scratch cluster or manifest validation command comes with the repository, so nothing in it substitutes for hands-on time on a cluster of your own.

The remote desktop is the mitigation, described only as configured with the tools and software needed to complete the tasks. Which kube-bench or Trivy build sits on that image is not stated anywhere in the repository.

Working the cloud metadata network policy example

There is no install step here and the README gives none. You read the repository on GitHub and walk its curriculum sections in a browser. A good first pass is item 4 under Cluster Setup, Protect node metadata and endpoints, which opens by stating the example assumes AWS cloud, that the metadata IP address is 169.254.169.254, and that every other external address stays reachable. The manifest hidden in the collapsible block does one job:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-only-cloud-metadata-access
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
      cidr: 0.0.0.0/0
      except:
      - 169.254.169.254/32

An empty podSelector applies the policy to every pod in the namespace, policyTypes narrows it to Egress, and the lone egress rule admits the whole internet through ipBlock 0.0.0.0/0 while carving out one address, 169.254.169.254/32. Rebuild that object from memory and you have item 4; fail to and the page has told you exactly what to drill.

Version discipline matters for the same reason. Readers are told to select the matching Kubernetes documentation, for example v1.26 as of January 2023, especially for API objects and annotations.

AGS Script as a language tag with no script in the tree

Metadata and content disagree here in a small but telling way. The repository records its primary language as AGS Script, the scripting language Adobe After Effects uses, yet the top-level entries are a README, two directories and a logo image, with no script anywhere among them. Content is published under CC-BY-SA-4.0, a share-alike licence that asks downstream users to keep adaptations on the same terms.

Read as a contributor, that layout points at the real work. hands-on/ is where practice material belongs, and generic-kubernetes-containers-security/ holds the extra Kubernetes security links the curriculum reaches through a Kubernetes.md file. Neither directory is described in the published text, so a reader cannot tell from the README whether hands-on/ holds labs, notes or both.

The 20 repository topics supply the other half: cks and exam-objectives sit next to falco, trivy, apparmor and seccomp, which makes the list findable by the tool a candidate is studying.

Pencil marks the research this list has not finished

The icon legend is the repository's quality control, and one entry is an admission. The clipboard icon means expand to see more content, the confused face means verify, not best resource yet, the large blue circle means good overall reference and usable in the exam, the triangular flag marks third party material you cannot bring, and the pencil marks a to-do item needing further checking, described as a todo list for future research and commits.

So some entries in a curriculum section are placeholders for reading nobody has finished, and the confused marker admits that a link exists but has not been checked against the better alternative. A skimming reader sees a complete list; a careful one sees a graded list with unfinished edges. Treat the pencil marks as your own revision queue.

Uptake has a date attached. The last push to the main branch landed on 2026-03-14, which is the number to weigh before you plan a study schedule around any single domain weight.

The CNCF curriculum repository defines what this one mirrors

The README points at the CNCF Exam Curriculum repository for the official exam objectives, and that is the honest alternative to this one. Upstream, objectives are the definition: domains, weighting, what a candidate is expected to perform. Here, each domain is broken into individual links, each link carries an exam-usability icon, and a commentary layer tells you which Kubernetes documentation version to select.

The trade is day-of-exam specificity against staying current. Cross referencing the allowed CKS sites pays off precisely because you cannot browse elsewhere, but a list built around one exam environment goes stale in a way the upstream curriculum does not. The dates inside the file show that drift already: the description names CKS 2021, the platform change is described as of June 2022, the documentation version suggested is v1.26 as of January 2023, and a linked Kubernetes website issue points at Falco install references that newer docs no longer carry.

No review date is recorded for any individual link, and no command is given for running what sits inside hands-on/. Both gaps close cheaply: check the weights against the current curriculum, then apply that network policy object to a cluster you own.

Editorial conclusion

Use this repository as a navigation layer over the Kubernetes documentation rather than as the blueprint itself, because the CNCF curriculum repository is where the objectives are actually defined. Candidates who already hold a valid CKA get the most from the six weighted domains and the icon legend, and anyone else should read the 67 percent pass mark and the two hour limit before starting. Leave it aside if your clusters run something other than v1.26, and compare its weights against the current curriculum before you budget study time.

Frequently asked questions

Official sources

1. Issues
2. License: CC-BY-SA-4.0
3. README
4. walidshaari/Certified-Kubernetes-Security-Specialist on GitHub