Certified Kubernetes Security Specialist (CKS)

Explore cluster setup topics, including network policies to lock down access, CIA's benchmark via Q bench, attack surface: open ports and GI tools, TLS termination with ingress, and checksum verification.

Configure a default deny network policy to isolate ports and block unauthorized ingress and egress, then allow essential traffic like frontend to backend.

Demonstrate restricting default access in a Kubernetes namespace by creating a frontend and a client pod, then applying a default deny network policy to block ingress and egress.

Learn to enforce a default deny for ingress and egress with network policies, and selectively allow traffic with a target policy on engine x labeled pods.

Explore configuring limited access in Kubernetes with ingress and egress network policies, using namespace and pod label selectors, port 80, and default deny to control traffic.

Create a namespace assignment one, deploy an http app on port 8080 with a busybox pod, then block all incoming traffic in the namespace and enable one-way inter-pod traffic.

lock inter-pod communication in Kubernetes by creating a namespace, deploying a web server and busybox client, and applying a network policy to allow one-way traffic from busybox to port 80.

Explore the CIS benchmark for securing Kubernetes, and learn how kube-bench validates clusters against these guidelines to generate a security compliance report.

Run the CIS benchmark on a Kubernetes cluster with kube-bench to generate master and node reports, then interpret test outcomes, including passes, failures, warnings, and remediation guidance.

Fix security issues detected by the CIS benchmark on a Kubernetes cluster by applying targeted remediations to the master and worker nodes, re-running the benchmark, and comparing progress reports.

Implement TLS with ingress to provide transport layer security for external traffic in Kubernetes. Ingress offloads TLS termination, routes traffic by path-based rules to services, and forwards HTTP inside cluster.

Demonstrate tls termination with ingress by deploying a namespace, creating a tls secret with base64-encoded cert and key, and routing https traffic to the engine-x service.

Secure node endpoints in a Kubernetes cluster by reducing attack surface, closing open ports with network segmentation and firewalls, and exposing external traffic only through secure entry points.

Secure your GUI to prevent attackers from gaining control of your Kubernetes cluster, especially when using graphical interfaces like dashboards; ensure the tool remains secure to protect the whole cluster.

Learn how to verify Kubernetes platform binaries using official checksum files and cryptographic hashes to ensure authentic, untampered binaries such as kubectl, kubeadm, and kubelet.

Explore how service accounts provide pod process identities and how role-based access control uses roles, cluster roles, and bindings to grant minimal, secure access in Kubernetes.

Limit Kubernetes service account permissions by creating a namespace, service account, role, and role binding, and demonstrate the risks of broad access to deployments and pods.

Learn to restrict service account permissions by creating separate pod viewer and deployment viewer accounts, each bound to roles that allow only get and list on pods and deployments.

Restrict access to the Kubernetes API by assigning appropriate roles and limiting permissions, and harden the port 6443 with network segmentation and firewalls to defend against attackers.

Learn why keeping your Kubernetes cluster updated to the latest minor version and applying security patches reduces vulnerabilities, including understanding minor vs patch versions and backporting security fixes.

Master system hardening for Kubernetes by reducing host footprint and surface attack, limiting IAM rules, minimizing external cluster access, and employing kernel hardening tools like AppArmor and seccomp.

Minimize host operating system security concerns in a Kubernetes cluster by avoiding host namespaces. If needed, configure host ipc, host network, host pid, and privileged mode via security context.

Minimize IAM roles in Kubernetes by applying the principle of least privilege, using service accounts to authenticate containers, and blocking unnecessary IAM access in public clouds like GCP and Azure.

Explore network-level security in Kubernetes by limiting external access to the cluster network to minimize the attack surface and protect pods and services across the Calico virtual network.

Explore AppArmor, a kernel-level security module that provides granular access control on Linux. Learn to load profiles, use complaint mode, or enforce mode, and apply it to Kubernetes worker nodes.

Explore how AppArmor profiles protect the host OS from Kubernetes containers. Apply deny profiles on nodes, enable enforce mode or complain mode, and use pod annotations to enforce restrictions.

Minimize microservices vulnerabilities in Kubernetes by applying security contexts to ports and containers, enforcing security policies, managing secrets, and using runtime sandboxes and OPA Gatekeeper.

Learn how to manage container access with security contexts in Kubernetes, distinguishing port-level and container-level settings, and applying run as user, run as group, and fsGroup for secure access control.

Learn how cluster administrators use port security policies to govern port configurations and enforce security across containers, covering privilege escalation, host network, run as user, and allowed volumes.

Enable port security policies in Kubernetes by activating the admission plugin, define a cluster role and service account, and ensure every port or pod satisfies at least one policy.

Enforce customizable policies on Kubernetes objects at creation time with the OPA gatekeeper and rego-based constraints. Ensure images, resources, and labels meet rules, with all constraints evaluated (AND) for admission.

This demo shows installing the OPA Gatekeeper on a Kubernetes cluster and enabling the API objects. It enforces a constraint template that requires an owner label on deployments, denying workloads.

Learn how to store confidential data in Kubernetes with secrets, distinguish them from config maps, and retrieve them via environment variables or files in volumes, with yaml and pod configuration.

Create Kubernetes secrets both imperatively and declaratively, explore secret types such as opaque, service account token, and TLS, and encode data with base64 for YAML configuration.

Explore injecting Kubernetes secrets into pods via environment variables or volumes, using secret key ref and declarative secret creation with base64 values for username and password.

Explore how to create and use Kubernetes secrets in pods, including environment variables and secret volumes in the default namespace, with base64 encoding and YAML and imperative creation.

Secure untrusted workloads in Kubernetes by using the container runtime sandbox, which isolates processes from the host operating system kernel and adds security at the cost of performance.

Learn to install and configure the container runtime sandbox with divisor, deploy workloads using a runtime class, and compare sandboxed versus non-sandboxed pods for enhanced security in Kubernetes.

Explore how port-to-port communication is secured with mutual transport layer security (mTLS) using the Kubernetes API to obtain certificates from a central certificate authority.

Learn to request and sign certificates in Kubernetes using a certificate signing request. Approve or deny requests based on RBAC policies and enable TLS for port-to-port communication within the cluster.

Explore supply chain security topics for the CKS exam, including image security, whitelisting registries, image validation with signed images, and static analysis to minimize vulnerabilities in Kubernetes.

Minimize the base image attack surface in your Kubernetes cluster by using up-to-date software with security patches and removing unnecessary packages.

Whitelist image registries in Kubernetes using OPA Gatekeeper by creating a constraint template and constraints to allow only trusted registries like Docker Hub and gcr.io.

Validate signed container images by verifying signatures and digests to prevent tampering and reduce attack surface. Use busybox examples in Kubernetes to illustrate image signing, verification, and hash-based checks.

Learn how to perform static analysis on Dockerfiles to harden images by avoiding root as the final user, avoiding latest base images, and safeguarding secrets with Kubernetes config maps.

Perform static analysis of a dockerfile to enforce security: use a specified engine x version, avoid latest, run as engine x user, remove wget, and use K secrets.

Analyze Kubernetes yaml manifests and docker configurations to harden security through manual static analysis, avoiding host namespace, privileged mode, latest tags, and root users.

Learn to perform manual static analysis of Kubernetes yaml manifests and dockerfiles to harden deployments by avoiding host namespaces, running as non-root, avoiding privileged mode, and pinning image versions.

Enable image scanning at the admission controller with the image policy webhook to automatically approve or deny Kubernetes workloads based on vulnerabilities, using a third-party scanner.

Explore monitoring, logging, and runtime security in Kubernetes to detect suspicious activity with behavioral analytics, while learning about immutable containers and audit logging for security.

Explore how behavioral analytics monitor Kubernetes cluster activity to detect abnormal or malicious actions, using automation tools like Falco to monitor runtime calls and raise alerts.

Analyze container behavior on a Kubernetes cluster with Falco, applying behavioral analytics via background, web server, or CLI deployment, and define custom YAML rules to trigger alerts during executions.

Immutable containers never change during their lifetime; Kubernetes replaces them with new instances, and a security context with read only root file system and volumes enforces immutability for better security.

Explore how Kubernetes audit logs chronicle api actions and how to configure an audit policy to capture events, including who, what, when, and where, for real-time monitoring and postmortem analysis.

Enable audit logging in Kubernetes API server using an audit policy file and audit log path, then restart API server and configure max age and max backup to manage logs.