In this video, Randy Abernethy dives into the upcoming updates to the Certified Kubernetes Security Specialist (CKS) Exam, effective September 2024.
As CNCF members and authorized training partners, RX-M has been deeply involved in creating and updating Kubernetes certifications. This video highlights the critical changes in the CKS curriculum, ensuring you’re well-prepared for the new exam format. You’ll learn about the impact of key curriculum changes and important topics to focus on.
Stay ahead in your Kubernetes journey and ensure you’re ready for the new CKS exam. Don’t miss out on these essential insights and tips!
Video Transcript
Hello, today we’re going to talk about the CKS – the Certified Kubernetes Security Specialist exam – and the changes that are upcoming in September of 2024. At RX-M, we are authorized training partners and CNCF members from the start. We’ve been involved in creating these tests; we were involved in creating the CKA, the CKS, and the CKAD (among others) and so we offer extensive training in this area and keep very close tabs on the curriculum as it has changed over the years. Now, with each of these certifications, generally the curriculum is pretty stable for a couple of years, but every two years or so the CNCF updates the curriculum because: things change; Kubernetes evolves; and it’s important to keep current in order for, especially things like security, to be relevant.
Now, one of the great things about the tests are that they are very hands-on and pragmatic, and, when you’re a HR professional or a hiring manager or just in technology leadership and you see that somebody’s got a credential like the CKS, you know that they’ve passed a two-hour performance-based exam covering a pretty solid curriculum for that subject, and that’s pretty reassuring. And the CKS is unique in that you must also have a CKA before taking it, so there’s that much more credibility associated with it.
Okay, so why don’t we go ahead and look at the curriculum of the existing CKS and compare that to the new September version coming up? If you search the internet, the curriculum is pretty easy to find. You can just search for CNCF, Cloud Native Computing Foundation, and then CKS, and you should find it (so “CNCF CKS curriculum”).
And on the first page of the curriculum, you’ll see that there are three domains, three areas of study: Cluster Setup, Cluster Hardening, and System Hardening. So the document that has 10% Cluster Setup that you see here is the existing curriculum that you would be tested on all the way up through the end of August, and the document where you see 15% Cluster Setup is the new curriculum. And so right off the bat, you can see one very subtle change is that there’s been a slight rebalance between Cluster Setup and System Hardening. System hardening used to be 15% and Cluster Setup was 10%, and that’s how it is today, but in September that’s going to flip-flop, and it’ll be 15% Cluster Setup and 10% System Hardening. So a slight additional bump in points for the Cluster Setup topics. There are some other things here, very subtle changes really, probably not even worth mentioning, except that minimized use of and access to GUI elements, which was in the existing curriculum, has been removed and is no longer in the new curriculum. And I think this is a good thing because there are lots of GUIs you could choose from, and testing you on a particular one really isn’t fair to people who maybe use a different one, and you can certainly use Kubernetes just through the API and, and third-party platform components and things like that. So good, a good addition or removal really, in my opinion.
So here is the second page of the curriculum, and the second three domains. The domains here are also the same, and the percentages are the same from the existing curriculum to the new curriculum. The few key changes that I would call out are within Minimizing Microservice Vulnerabilities, we have the change in the last bullet (the last topic) from implement pod-to-pod encryption using TLS or mTLS to implementing pod-to-pod encryption using Cilium in the new curriculum. So I’m not a big fan of this. There are lots of CNIs. Not everybody uses Cilium. We love Cilium. Cilium is fantastic. There’s all sorts of neat features that Cilium offers. We have training on and we help people get ready for the Cilium, but at the end of the day, it’s just one possible solution. It’s just one possible way of encrypting traffic between pods, and so I’m not really a big fan of picking a winner here. This does mean that you probably should get comfortable with using Cilium and using it to encrypt traffic between pods if you’re going to take the test after September, however.
Most other things are fairly similar. In Supply Chain Security, the last two bullets, use static analysis and scan images, have sort of been combined to sort of package them up into the perform static analysis bullet, which is the last bullet in the new curriculum. The other thing I would say is that instead of just securing your supply chain, they now have understand your supply chain and secure your supply chain, which calls out SBOM. So another thing you’re going to want to add to your arsenal is an understanding of SBOM and how to create SBOM and, and verify SBOM, software building materials, and that sort of thing. And then the last thing is in the monitoring, logging, and runtime security, the perform deep analytical investigation and identification of bad actors within the environment in the existing curriculum has been removed, but essentially that’s about it.
There’s some wording changes and some other subtleties, but those are the big ones, and if you prepare yourself with those changes, you should be good to take the CKS even after September when the curriculum has updated. And so there you have it, everything you need to know about the CKS and the new updated CKS curriculum. The current version of the CKS test is on 1.30 of Kubernetes, and the new September version will be on the new release and have the changes that we described.
Now, if you’re interested in taking the CKS, you might be interested in RX-M’s upcoming guaranteed to run CKS boot camps. We have one running in San Francisco and one running in London coming up. There’s also a CKA if you’re interested in San Jose, and these are all happening in the months of June and July in 2024. And so you’ll see a little bubble with the dates and information about signing up if you’re interested, and a 25% discount code. Once again, thanks for joining us and look forward to seeing you on the next Cloud Native Short Take.