The CKS exam, and how it differs from CKA and CKAD

What you are walking into

Two numbers matter for planning: 2 hours for 15–20 tasks is **6–8 minutes per
task**, and every task is scored by a script that reads the API or a file — not
by whether your solution "looks right".

Weights changed in 2025. Most blog posts and older repos still print Cluster Setup 10 % / System Hardening 15 %. That is the pre-v1.31 split. The Linux Foundation page and the current curriculum PDF both say 15 / 10. You can verify this yourself in cncf/curriculum by diffing the v1.29 and v1.31 PDFs.

What is allowed during the exam

Only what is inside the exam VM. In practice:

• kubernetes.io/docs (in-page search works, external search results do not), kubernetes.io/blog
• falco.org/docs — allow-listed on purpose
• docs.cilium.io, istio.io/latest/docs — also allow-listed, which tells you Pod-to-Pod encryption is a real task, not theory
• kubernetes-sigs.github.io/bom/cli-reference — SBOM
• etcd.io/docs, the ingress-nginx docs, the per-task "Quick Reference" box
• man pages, /usr/share/doc, whatever is installed locally

Each task names a host. You ssh <node> from base; **nested ssh does not
work**, so pick the right host the first time. base has none of the tools —
kubectl and k exist on the SSH hosts. Never reboot base.

The six things that actually cost marks

1. Time. People finish with two minutes left. Practise against a clock, and practise marking a question and moving on — a task you sank 12 minutes into is worth the same as the easy one you never reached.
2. The wrong node. A task asks you to harden a kubelet. That is a worker node, as root, editing /var/lib/kubelet/config.yaml. Doing it on controlplane scores zero. Read the "you are on host X" line every time.
3. Memorised YAML. A slightly different selector, a different audit level, a different port and your muscle memory is wrong. Learn the shape, then read the task.
4. Not verifying. Every task in this site has a check. Make it a habit: after each task, run the one command that proves it worked.
5. Not restarting what you broke. Audit logging, admission plugins and kubelet flags need the component restarted — and if you break the API server static pod manifest, you must fix it from the node, not through kubectl.
6. AppArmor and seccomp are node-level. You cannot load a profile through the API. You need a shell on the node, apparmor_parser, and a file that containerd can actually see.

The shape of a good answer

# 1. look first — never write a file you have not read
kubectl get netpol -n prod -o yaml | head -40
# 2. make the smallest change that satisfies the wording
kubectl apply -f /tmp/answer.yaml
# 3. prove it
kubectl get netpol -n prod -o custom-columns=NAME:.metadata.name,PODS:.spec.podSelector

Study plan that fits around a job

Two weeks at 90 minutes a day is enough if you already hold CKA:

• days 1–3: NetworkPolicy, Ingress+TLS, RBAC/service accounts (mostly revision)
• days 4–6: kube-bench remediation, AppArmor, seccomp, securityContext
• days 7–9: audit policy + static pod surgery, Falco rules, immutability
• days 10–12: image scanning, SBOM, signing, admission control, Gatekeeper
• days 13–14: two mock papers, timed, then redo every task you got wrong

Then sit killer.sh if you have it: 70–80 % there under time is the usual
readiness bar.