CKS curriculum, mapped to a roadmap

Where this comes from. The domains, weights and competency wording are the Linux Foundation's published curriculum, mirrored in the CNCF curriculum repository and on the certification page. That is the public syllabus, not exam content — the NDA covers what appears in the exam, and nothing here restates a task or a question. Check the official source for the current version before relying on this; curricula change.

The percentage is a rough weighting, not a readiness score. A fully written competency counts 1, a partial counts 0.5, and the judgement of which is which is my reading of the wording rather than an official mapping. It tells you what is missing from this roadmap. It does not tell you whether you would pass.

Cluster Setup

15% of the exam 40% written here

written up
Use Network security policies to restrict cluster level access
Network policy that someone can debug read it →
not written yet
Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
Missing: kube-bench, reading a CIS report, and which findings actually matter on a managed cluster
claim this one →
partly covered
Properly set up Ingress with TLS
Gateway API and the mesh decision read it →
Missing: TLS termination on a Gateway listener, certificate issuance with cert-manager, and redirecting plaintext
not written yet
Protect node metadata and endpoints
Missing: blocking the cloud metadata endpoint from pods, and closing the kubelet read-only port
claim this one →
partly covered
Verify platform binaries before deploying
Supply chain and image provenance read it →
Missing: verifying Kubernetes release checksums and signatures specifically, as distinct from your own images

Cluster Hardening

15% of the exam 62% written here

written up
Use Role Based Access Controls to minimize exposure
RBAC and multi-tenancy read it →
written up
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
RBAC and multi-tenancy read it →
partly covered
Restrict access to Kubernetes API
RBAC and multi-tenancy read it →
Missing: anonymous auth, API server flags, and putting the control plane behind a network boundary
not written yet
Upgrade Kubernetes to avoid vulnerabilities
Missing: a real kubeadm upgrade, version skew rules, and draining nodes without breaking a PDB
claim this one →

System Hardening

10% of the exam 50% written here

not written yet
Minimize host OS footprint (reduce attack surface)
Missing: minimal node images, removing packages and services, and why a container-optimised OS changes the threat model
claim this one →
partly covered
Using least-privilege identity and access management
RBAC and multi-tenancy read it →
Missing: cloud IAM and workload identity, which is where this usually goes wrong - the in-cluster half is covered
written up
Minimize external access to the network
Network policy that someone can debug read it →
partly covered
Appropriately use kernel hardening tools such as AppArmor, seccomp
Admission control and policy as code read it →
Missing: writing and loading a seccomp profile, AppArmor profiles, and RuntimeDefault as a baseline

Minimize Microservice Vulnerabilities

20% of the exam 75% written here

written up
Use appropriate pod security standards
Admission control and policy as code read it →
written up
Manage Kubernetes secrets
Config, secrets and the twelve-factor edge cases read it →
partly covered
Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
RBAC and multi-tenancy read it →
Missing: sandboxed runtimes - gVisor and Kata - and when the kernel boundary is not enough
partly covered
Implement Pod-to-Pod encryption (Cilium, Istio)
Gateway API and the mesh decision read it →
Missing: actually turning on WireGuard or IPsec in Cilium, or mTLS in Istio, rather than arguing about whether to

Supply Chain Security

20% of the exam 75% written here

written up
Minimize base image footprint
Containers before Kubernetes read it →
written up
Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
Supply chain and image provenance read it →
written up
Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
Supply chain and image provenance read it →Admission control and policy as code read it →
not written yet
Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)
Missing: kubesec, kube-linter and Trivy in CI, and which findings are worth failing a build over
claim this one →

Monitoring, Logging and Runtime Security

20% of the exam 80% written here

written up
Perform behavioral analytics to detect malicious activities
Runtime detection and response read it →
written up
Detect threats within physical infrastructure, apps, networks, data, users and workloads
Runtime detection and response read it →
written up
Investigate and identify phases of attack and bad actors within the environment
Runtime detection and response read it →
not written yet
Ensure immutability of containers at runtime
Missing: readOnlyRootFilesystem, dropping write access to the image layer, and enforcing it at admission
claim this one →
written up
Use Kubernetes audit logs to monitor access
Runtime detection and response read it →

What to write next

The 6 outright gaps, ordered by how much of the exam their domain is worth. Each one is also the most useful pull request available right now.

Domain weight	Domain	Nothing covers this yet
20%	Supply Chain Security	Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)
20%	Monitoring, Logging and Runtime Security	Ensure immutability of containers at runtime
15%	Cluster Setup	Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
15%	Cluster Setup	Protect node metadata and endpoints
15%	Cluster Hardening	Upgrade Kubernetes to avoid vulnerabilities
10%	System Hardening	Minimize host OS footprint (reduce attack surface)