Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Certified Kubernetes Security Specialist Masterclass
Rating: 4.2 out of 5(58 ratings)
42,603 students

Certified Kubernetes Security Specialist Masterclass

Certified Kubernetes Security Specialist Ultimate Preparation Guide Masterclass | Theory | Hands-on | Labs | Complete
Created byDeepak Dubey
Last updated 2/2026
English

What you'll learn

  • Use Network security policies to restrict cluster level access
  • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
  • Properly set up Ingress objects with security control
  • Protect node metadata and endpoints
  • Minimize use of, and access to, GUI elements
  • Verify platform binaries before deploying
  • Restrict access to Kubernetes API
  • Use Role Based Access Controls to minimize exposure
  • Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
  • Update Kubernetes frequently
  • Minimize host OS footprint (reduce attack surface)
  • Minimize IAM roles
  • Minimize external access to the network
  • Appropriately use kernel hardening tools such as AppArmor, seccomp
  • Setup appropriate OS level security domains
  • Manage Kubernetes secrets
  • Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
  • Implement pod to pod encryption by use of mTLS
  • Minimize base image footprint
  • Secure your supply chain: whitelist allowed registries, sign and validate images
  • Use static analysis of user workloads (Kubernetes resources, Docker files)
  • Scan images for known vulnerabilities
  • Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
  • Detect threats within physical infrastructure, apps, networks, data, users and workloads
  • Detect all phases of attack regardless where it occurs and how it spreads
  • Perform deep analytical investigation and identification of bad actors within environment
  • Ensure immutability of containers at runtime
  • Use Audit Logs to monitor access

Course content

2 sections • 65 lectures • 13h 57m total length

  • CKS Exam Strategy, Tips & Tricks22:34

    Master the cks exam by practicing 16 clusters, kubectl context switching, ssh into master or worker nodes, and expect one question on falco, app armor, or trivy.

  • Trivy Introduction6:10

    Learn how to use Trivy for image scanning to detect high and critical vulnerabilities in containers, with exam-focused workflows for certified Kubernetes security specialist exam across Linux, macOS, and Windows.

  • Trivy - Scan Pods5:24
  • Extract Secrets & Save to a File4:47

    Extract secrets from a Kubernetes secret and save them to a file using kubectl, showing jsonpath, template, and yq options, with base64 decoding for username and password.

  • gVisor Demo6:06
  • CIS Benchmarks for Hardening a Kubernetes Cluster11:42

    Explore CIS benchmarks for hardening a Kubernetes cluster, learn to audit with kube-bench, identify fail steps, and implement remediation and configuration refinements to secure the control plane.

  • Fix Dockerfile and Deployment.yaml for any security vulnerabilities4:21
  • Enable Auditing10:07
  • Falco10:22
  • AppArmor13:08
  • Gatekeeper or Open Policy Agent12:32
  • PodSecurityPolicy8:29
  • Fix Incorrectly Specified ServiceAccount in a Pod, Create Role, Rolebinding etc.5:45

    Create a question one service account in question one namespace, grant backend role for pods, namespaces, and config maps, bind a role binding, attach pod, and ensure no secret access.

  • Fix Overly Permissive Permissions for Pod's SA & Create SA, Role, Rolebindings6:06
  • Scenario Based Question - Admission Controller - Image Scanner7:03
  • Scenario Based Question - Network Policies - 16:39
  • Scenario Based Question - Network Policies - 25:21
  • Scenario Based Question - Verify Platform Binaries6:11

    Verify platform binaries against sha512 checksums to ensure integrity of Kube API server, Kube controller manager, Kube proxy, and Kubelet, and delete corrupted binaries when checksums do not match.

  • Read Kubernetes Secrets from ETCD3:54
  • Create & Secure an Ingress12:28

Requirements

  • Must know the basics of Kubernetes
  • Must have some hands on experience of Kubernetes
  • Ideally CKA or CKAD certified as that is also a prerequisite to take the CKS Exam

Description

Cluster Setup

  1. Use Network security policies to restrict cluster level access

  2. Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

  3. Properly set up Ingress objects with security control

  4. Protect node metadata and endpoints

  5. Minimize use of, and access to, GUI elements

  6. Verify platform binaries before deploying


Cluster Hardening

  1. Restrict access to Kubernetes API

  2. Use Role Based Access Controls to minimize exposure

  3. Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

  4. Update Kubernetes frequently


System Hardening

  1. Minimize host OS footprint (reduce attack surface)

  2. Minimize IAM roles

  3. Minimize external access to the network

  4. Appropriately use kernel hardening tools such as AppArmor, seccomp


Minimize Microservice Vulnerabilities

  1. Setup appropriate OS level security domains

  2. Manage Kubernetes secrets

  3. Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)

  4. Implement pod to pod encryption by use of mTLS


Supply Chain Security

  1. Minimize base image footprint

  2. Secure your supply chain: whitelist allowed registries, sign and validate images

  3. Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)

  4. Scan images for known vulnerabilities


Monitoring, Logging and Runtime Security

  1. Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities

  2. Detect threats within physical infrastructure, apps, networks, data, users and workloads

  3. Detect all phases of attack regardless where it occurs and how it spreads

  4. Perform deep analytical investigation and identification of bad actors within environment

  5. Ensure immutability of containers at runtime

  6. Use Audit Logs to monitor access

Who this course is for:

  • Anyone wishing to learn about Kubernetes Security or want to pass the CKS Exam

Report abuse