Certified Kubernetes Security Specialist 2026

Explore CIS benchmarks for Kubernetes, covering control plane and worker node components like API server, etcd, controller manager, scheduler, kubelet, and kube proxy, with RBAC, pod security standards, and kube-bench.

Set up a secure lab from scratch for the CKS course, detailing control plane and worker nodes on Ubuntu 24 LTS with optional DigitalOcean or other clouds.

Set up a secure Kubernetes lab infrastructure on DigitalOcean by creating a droplet with Ubuntu 24.04 LTS, configuring SSH key-based authentication, and deploying firewall rules to whitelist your IP.

Explore Kubernetes architecture by detailing control plane and worker node components, including API server, etcd, scheduler, controller manager, kubelet, and kube proxy, with practical setup and troubleshooting insights.

Explore three key etcd security areas: plaintext data storage, tls encryption, and certificate-based authentication, and learn how insecure storage, unencrypted channels, and unauthenticated access threaten Kubernetes secrets.

Download the exact etcd binaries from the etcd page, place etcd and etcdctl in /usr/local/bin, then start etcd and verify data with etcdctl put/get in tmp/default etcd.

Explore how a certificate authority enables TLS secure communication among Kubernetes components and verifies identities by issuing signed server and client certificates.

Configure a certificate authority by generating a private key and a self-signed Kubernetes CA certificate, then prepare CA cert and key to issue TLS certificates for components.

Learn the end-to-end workflow for issuing signed certificates in Kubernetes, from generating a private key and CSR to signing with the certificate authority and deploying TLS or client authentication certificates.

Learn how to enable etcd to listen on https, generate its certificate and key, and run etcd with https endpoints to encrypt API server traffic.

Integrate etcd with systemd to manage startup, status, and logs, set a data directory at /var/lib/etcd, enable on boot, and monitor with journalctl.

API server security centers on authenticating to etcd with certificates, encrypting secrets with encryption providers, and auditing under CIS benchmarks for TLS and access controls.

Configure the api server, generate certificates for etcd and the service account, download Kubernetes binaries, and start the api server with essential flags, then verify with netstat and curl.

replace the api server's self-signed certificate with a trusted certificate from your organization’s certificate authority to enable tls encryption on the https endpoint.

Explore how Kubernetes processes authentication, authorization, and admission control before acting on objects, and review options like x509, tokens, OpenID Connect, and RBAC.

Authenticate to the api server using static token authentication with a token file and a bearer header, and validate access via a token csv.

Highlight the downsides of static token file authentication, including tokens stored in clear text on the API server, revocation only via restarting, and not recommended for production environments.

Authenticate to a Kubernetes cluster using x509 client certificates signed by a trusted CA. Create Alice's certificate, integrate the CA with the API server, and test access.

Explore the downsides of x509 client certificate based authentication in Kubernetes, including insecure private keys, long-lived certificates without revocation, and inflexible group changes requiring new certificates.

Compare Kubernetes authorization modes, including always deny and outback, and see how default always allow shapes permissions after authentication with certificate-based authentication and system masters group guiding access.

Learn to configure the encryption provider in Kubernetes, set up an encryption key, and apply encryption at rest to secrets using a CBC provider to prevent plaintext exposure.

Enable auditing on the Kubernetes API server to generate security-relevant, chronological records of who did what, when, from where, and with policy-driven levels.

Set up a secure Kubernetes cluster with kubeadm by provisioning a control plane and a worker node on Ubuntu 24.04 LTS, configuring containerd, kubeadm, and networking, and verifying the setup.

Master taints and tolerations in Kubernetes, and learn how taints repel pods while tolerations grant access with no schedule and no execute effects.

Kubelet security hinges on preventing anonymous access and avoiding always allow in favor of webhook authorization; the lecture demonstrates port 10250 exposure, misconfigurations, and secure client certificates.

Verify Kubernetes platform binaries by hashing downloaded archives with cryptographic hash functions (md5 or sha512) and matching against official hashes to ensure integrity.

Explore how Kubernetes ingress uses host-based routing rules to direct traffic to services via an ingress controller, replacing many load balancers with a single gateway.

Explore how ingress with tls secures user traffic via https for kubernetes ingress, and learn how tls certificates and secrets enable secure ingress configurations.

Set up ingress with TLS in Kubernetes using the Nginx ingress controller, create a TLS secret, and test secure connectivity with a self-signed certificate for demo.

Explains how the SSL redirect annotation in an ingress controls whether HTTP traffic is redirected to HTTPS, detailing the nginx ingress default behavior and how to disable redirection.

Learn how Kubernetes network policies control pod traffic with ingress and egress using pod, namespace, and ip block selectors, enforcing app to database connections.

Explore the structure of a Kubernetes network policy, including API version, kind, metadata, and specs, with focus on pod selector, policy types, ingress, egress, and from and to rules.

Explore practical network policies in Kubernetes, including ingress and egress rules, pod selectors (including empty and match labels), namespace scoping, ipBlock rules, and real-world testing with kubectl.

Explore how network policies use the accept field to define exceptions within ingress rules, and how port and protocol (tcp, udp, http) govern ingress and egress with examples.

Explore the kubeadm file structure, including the ATC Kubernetes directory with PKI certificates and kube config files, and learn how static pods and kubelet configure the control plane.

Learn practical kubeadm troubleshooting by inspecting kubelet logs with journalctl, exploring pod-specific logs in /var/log, and accessing etcd and container logs.

Explore Kubernetes authentication basics and methods, including static token files, client certificates, bootstrap tokens, service accounts, and OpenID Connect, plus how Kubernetes relies on external user management.

Explain how Kubernetes uses authentication followed by authorization to control access to resources, and compare always allow, always deny, and RBAC modes.

Explore the RBAC workflow in Kubernetes, linking roles to subjects (users, groups, service accounts) via role bindings to grant namespace-scoped permissions and cluster-wide access through cluster roles and bindings.

Create a service account and generate a token with a longer duration for RBAC testing, set it as an environment variable, and use curl to validate role binding with kubectl.

Explore practical role and role binding in Kubernetes, detailing manifest structure, api groups, resources, and verbs, and show how to bind roles to subjects using kubectl and role binding examples.

Learn to configure cluster roles and cluster role bindings in Kubernetes. Discover how permissions apply across namespaces and are bound to users, groups, or service accounts with kubectl and manifests.

Explore cluster roles and cluster role bindings, learn how cluster scope enables pod access across namespaces, and see how role bindings reference cluster roles to enforce a central policy.

Explore how service accounts authenticate pods to the Kubernetes cluster using tokens. Learn how a pod receives a token to perform actions with defined permissions.

Explore how Kubernetes creates a default service account per namespace, how pods inherit its permissions via tokens, and how to assign custom service accounts to pods.

Explore service account security by disabling automatic token mounting, configuring auto mount at service account or pod level, and understanding precedence to reduce RBAC risks in pods.

Understand how the version skew policy maintains cluster functionality by aligning the api server, kubelet, kube proxy, controller manager, scheduler, and kubectl within allowed version gaps, especially in high-availability setups.

Upgrade Kubernetes clusters with kubeadm by performing sequential minor upgrades, first the control plane, then the worker nodes, using upgrade plan and upgrade apply.

Configure a kubeadm based control plane and worker on two virtual machines, run automated scripts to initialize and join, then apply the upgrade plan from 1.31 to 1.32.

Upgrade the control plane from 1.31 to 1.32 with cube ADM, remove holds, update the 1.32 repository, run upgrade plan and apply, then upgrade kubelet manually.

Upgrade the worker node to version 1.32 with kubeadm upgrade node, after configuring the 1.32 repository and removing holds; drain, upgrade kubelet and kubectl, then uncordon and verify 1.32.2.

Discover how projected volumes consolidate secrets and config maps into a single pod mount. See a secret and a config map mounted together via an all-in-one volume.

Learn to mount a service account token into a pod with a projected volume, using default and custom service accounts and an auto mount false setting.

Explore how Linux capabilities allow non-root binaries to perform privileged operations without sudo, and how cap net raw enables normal users to run ping by granting selective privileges.

Demonstrates using Linux capabilities to let a non-privileged user bind to port 900 with cap_net_bind_service, after compiling a C program and setting the capability.

Learn how security context minimizes container risk by running pods as non-root users and configuring run as user, run as group, and fs group.

Discover how privileged pods bypass container-host boundaries to access host devices and kernel messages, compare them with non-privileged pods, and configure security context to grant only the necessary Linux capabilities.

learn to set capabilities for containers in a pod by using the security context to add or drop capabilities, compare default capabilities, and verify changes.

Explore admission controllers that intercept, validate, and optionally modify api requests before they are persisted in etcd, including mutating namespace auto provision and validating pod security standards.

Explore image pull policy in Kubernetes, including always, if not present, and never, and how kubelet and container runtime manage cached digests and registry pulls.

Explore how the always pull images admission controller enforces image pull policy to always, safeguarding private registry credentials by preventing unauthorized pods from reusing locally cached images.

Apply pod security profiles to namespaces and test pods to verify allowed configurations for privileged, baseline, and restricted policies.

Explore the pod security admission modes: enforce, audit, and warning, and how namespaces apply privileged and restricted profiles for pods.

Apply pod security standard and pod security admission with an explicit mode version. Explore how default namespace labels, dry run, and exemptions affect deployments and pods.

Explore how the image policy webhook admission controller delegates pod image validation to an external service, enabling allow or deny decisions with configuration for behavior when the validator is unavailable.

Implement the image policy webhook admission controller in Kubernetes using an external image validator, a Python Flask service, and configuration files to enforce allowed and denied images.

Explore how Kubernetes secrets centralize sensitive data and avoid hard coding by mounting credentials into pods. Understand base64 encoding, encryption options, and RBAC for secure access control.

Learn to create kubernetes secrets with kubectl, using literals or files, and view base64 encoded data. Mount secrets into pods via volumes or env vars to supply app credentials.

Explore how Cilium uses eBPF to cut overhead and boost performance. It offers layer 3–7 network policies, observability with Hubble, and transparent encryption with IPsec and WireGuard.

Install kubeadm on Ubuntu 24 LTS, use Cilium instead of Calico for Kubernetes networking, verify checksums, and bring the cluster node to ready for practical use.

Explore the structure of Cilium network policies, including endpoint selectors, ingress and egress rules, and match labels, to control layer three to seven traffic in Kubernetes.

Explore layer three rules in Cilium network policies, covering endpoint-based, service-based, entities-based, node-based, IP/CIDR, and DNS-based approaches to control pod connectivity.

Explore Cilium network policy entities based policies and predefined entities like cluster and world. See how these control internal and external connectivity through hands-on testing.

Learn how layer 4 rules in cilium network policies manage ports and protocols, with practical nginx and curl examples, port ranges, and cidr filtering.

Discover how to configure cilium network policies to preserve DNS resolution when restricting egress traffic, using port 53 and match name or match pattern rules.

Learn how cilium deny policies block traffic between pods, with deny taking precedence over allow, and apply ingress and egress deny to control inbound and outbound connections.

Learn how cilium transparent encryption secures pod-to-pod traffic across nodes with IPsec or WireGuard, without modifying applications, addressing Kubernetes' lack of native port-to-port encryption.

Explore how to implement cilium transparent encryption with ipsec in kubernetes, bootstrapping a two-node cluster with kind and validating encrypted traffic using tcpdump and esp over vxlan.

Enable transparent encryption with wireguard in a kind cluster using cilium, then verify with tcpdump on the cilium vg0 interface by curling from a curl pod to an nginx pod.

Learn how to enforce a read only root file system in containers via security context, and use an emptyDir mounted to /tmp to support temporary writes when needed.

Compare monolithic and microservices architectures, highlighting deployment and scaling trade-offs. See how independent services and API gateways enable targeted updates and flexible tech stacks.

Explore the key challenges of microservices architecture, including maintaining low latency connectivity, securing inter-service communication, enforcing network isolation, enabling dynamic service discovery, and monitoring health across many services.

Explore how a service mesh secures and observes microservice communication with sidecar proxies, a control plane, mtls, and zero-trust policies for traffic management.

Explore Istio, an open source service mesh for Kubernetes, using envoy sidecar proxies to manage and secure microservice traffic. Learn about traffic routing, mtls, observability, and dashboard insights.

Install Istio on a fresh Kubernetes cluster using the demo profile, export the istioctl path, and verify the istio-system pods are running; GitHub documentation covers steps.

Enable automatic Istio sidecar injection by labeling the namespace, or deploy manually with Istio CTL, so new pods include the Istio proxy by default.

Explore how mutual tls with Istio uses certificates issued by a trusted certificate authority to authenticate clients and servers and establish secure communication.

Master practical mutual TLS with Istio, acting as CA, managing sidecar injection, deploying pods, applying peer authentication, and validating certificate exchange with istioctl.

Learn how AppArmor confines processes under mandatory access control using predefined profiles, unlike discretionary access control. See enforce, complain, and unconfined modes in practice.

Create a simple root script, generate its AppArmor profile with aa-gen-profile, and test enforce mode to see restricted permissions like touch and denial for modified scripts.

Explore integrating AppArmor with Kubernetes by applying AppArmor profiles in a pod's security context, including localhost and other types, with a deny-right example.

Explore the open container initiative standards for images and runtimes, including image and runtime specifications, and how high-level runtimes like cri-o work with runC to run containers.

Configure containerd and runC on Ubuntu, install containerd, generate default config, pull nginx, and run containers to understand both high level and low level runtimes.

Learn how the container runtime interface lets kubelet run with containerd, cri-o, or docker without recompiling. Explore setting up kubeadm and verifying runtime integration.

Explore container sandboxing concepts, comparing gvisor's user space kernel with VM-based isolation like kata containers and firecracker to protect the host kernel from untrusted containers.

Gvisor provides container sandboxing with a sentry, an emulated linux kernel. It intercepts system calls and forwards safe calls to the host kernel, enabling Kubernetes runSC as a sandboxed runtime.

Test end-to-end gvisor setup on minikube by enabling the gvisor addon and creating a runtime class with runsc, then compare host and container kernels to verify sandboxing.

Explore how vulnerabilities, exploits, and payloads enable breach scenarios as the video demonstrates a vulnerable UnrealIRCD through a hands-on Metasploit demo.

Learn how container security scanning integrates vulnerability assessment and patch management for Docker images, guiding hardening, standardizing images, and using scanners like Anchor, Tenable, Trivy, and AWS ECR.

Trivy is an open source, simple vulnerability scanner for containers that analyzes container images for known vulnerabilities, supports installation across many OS and Docker, and surfaces severities and CVE IDs.

Demonstrates using kube bench to scan Kubernetes clusters against the benchmark, identify failing checks on master and worker nodes, and apply remediation steps for secure configuration.

Learn the basics of static analysis by evaluating kubernetes manifests and dockerfiles against security rules with tools that flag root access, privilege issues, and potential backdoor images.

Secure the Docker daemon by avoiding unnecessary Docker group users. Prevent insecure remote API exposure on TCP ports 2375 and 2376 by implementing TLS authentication.

Review Dockerfile security best practices by using updated base images, minimal images like Alpine, reducing layers, trimming unnecessary packages, and running as a non-root app user to minimize vulnerabilities.

Configure the docker daemon with /etc/docker/daemon.json to run in the background using required flags. The video shows the command line interface vs daemon.json and DNS in container resolv.conf (8.8.4.4).

Protect the Docker daemon socket by enforcing TLS and certificate-based authentication, using client certificates signed by a trusted CA to securely access Docker on port 2376.

Practice configuring the docker daemon socket with tls and https, generate a cert authority, server and client certificates, update daemon settings, and verify secure access with client certs.

Learn how software bill of materials (sbom) lists components and licenses, analyzes container dependencies, and compares spd and Cyclone Rd formats with tools like Trivy and Swift.

Practical generation of a software bill of materials (SBOM) for a container image using Bom and Trivy on Ubuntu 24 LTS, including viewing package data and vulnerabilities.

Discover Falco, an open source runtime security tool that defines rules to detect events and support prevention in host, container, and Kubernetes environments, generating alerts.

Install Falco on the host for a simple kubeadm-based setup, with ebpf or automatic mode. Verify it runs with systemctl status and prep for rule creation and events.

Explore how Falco loads rule files from Falco.yaml and default Falco_rules.yaml, uses Falco_rules.local.yaml for custom rules, and triggers host and container alerts, like sensitive file opened by root.

Learn to write custom Falco rules and macros for Kubernetes pods, detect curl executions inside containers, and produce outputs with container ID and container name for precise alerts.

Learn to monitor and alert on /dev/mem access in Kubernetes with Falco rules, distinguishing privileged and non-privileged pods and using open read/write macros.

Explore the falco.yaml configuration file and how it defines Falco's global settings, including syslog output. Learn to use config.d and rules.d for extra configs and troubleshooting.

Explore how Sysdig unifies troubleshooting and monitoring by using filters to capture specific system calls and container activity, and discover its command line options and Sysdig chisels for analysis.

Explain how Kubernetes audit logging captures security-relevant events. Define the four audit policy levels—none, metadata, requests, and request response—and how to apply rules.

Explore essential exam pointers for the Certified Kubernetes Security Specialist course, including studying the full course, practicals, and reviewing allowed Kubernetes, Falco, etcd, nginx ingress, cilium, and the CIS benchmark.