Certified Kubernetes Security Specialist (CKS) for 2023

Create a Kubernetes cluster across cloud or local infrastructure, install Docker and kubectl via an automated script, and configure networking with Calico or Flannel while troubleshooting common startup errors.

Learn how Kubernetes network policies control pod communication and restrict ingress and egress using plugins like Gallico, highlighting the default allow-all behavior before policies are applied.

Demonstrates creating a default deny network policy in Kubernetes to block pod communication, then uses label selectors to define allowed traffic and validate connectivity.

Apply default deny network policy, then create explicit egress and ingress rules to enable pod communication between parts, including DNS resolution and label-based port traffic.

Extend Kubernetes network security by creating a new network policy across namespaces, defining port three in production, configuring ingress and egress rules, and applying labels to enforce cross-namespace traffic control.

Install the Kubernetes dashboard using the official documentation, copy this, your ID, and run this command; it will take a couple of seconds to set up the dashboard.

Update the Kubernetes service and deployment, generate certificates, and remove the liveliness probe to enable secure dashboard access from outside via a NodePort.

The lecture shows configuring RBAC for the Kubernetes dashboard by granting a service account view permission and using a role binding, then a cluster role binding for access across namespaces.

Create an ingress to expose two services, deploy and expose them, then verify access via the public IP address as you prepare to secure the ingress in the next session.

Generate and deploy a TLS certificate, create a Kubernetes secret, and update the ingress to use that secret for TLS, replacing the fake certificate with your own.

Secure node metadata by understanding how cluster metadata is exposed, and learn commands to view hostname and ip addresses from containers, recognizing risks across cloud providers.

Create an outgoing network policy to protect node metadata by blocking traffic to a specific IP. Apply the policy and verify metadata access is blocked across environments.

Apply kube-bench to assess Kubernetes cluster hardening, run the binary in-cluster, review benchmark outputs, and remediate ownership, permissions, and policy warnings to improve security.

Download the Kubernetes release and install the linux amd64 binaries. Copy the download link and verify the release output to complete the process.

Verify that the apiserver binary is running in your cluster, confirm its version, and learn a simple docker cp workflow to copy a container filesystem for binary verification.

Learn how RBAC defines permissions with namespace roles and cluster roles, and how role bindings grant access to current and future resources across namespaces and globally.

Define a role and rolebinding to restrict a user to reading secrets in a chosen namespace, then verify access across two namespaces.

Learn to create cluster roles and cluster role bindings to control deployment deletion across namespaces, including a danger namespace, with practical tests to verify permissions and bindings.

Explore Kubernetes accounts and users, distinguishing machine service accounts from normal users, and learn how certificates, common names, and certificate authorities enable API authentication and permission control.

Create and manually approve a certificate signing request for a cluster user by generating a key with OpenSSL, producing a CSR, obtaining the certificate, and configuring kubectl credentials and context.

Explore how every namespace has a default service account name, with an accompanying secret and token that enable authentication to the Kubernetes API.

Create a custom service account and secret, obtain a token, and mount it into a pod to authenticate to the Kubernetes API.

Explore how to disable service account mounting in Kubernetes by adjusting configuration, and verify changes by inspecting volume and secret mounting and related descriptions.

Discover how to limit service account permissions with rbac by creating role bindings that restrict service accounts from editing resources and deleting secrets.