Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Certified Kubernetes Security Specialist Masterclass
Rating: 4.2 out of 5(58 ratings)
42,604 students

Certified Kubernetes Security Specialist Masterclass

Certified Kubernetes Security Specialist Ultimate Preparation Guide Masterclass | Theory | Hands-on | Labs | Complete
Created byDeepak Dubey
Last updated 7/2026
English
English [Auto],

What you'll learn

  • Use Network security policies to restrict cluster level access
  • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
  • Properly set up Ingress objects with security control
  • Protect node metadata and endpoints
  • Minimize use of, and access to, GUI elements
  • Verify platform binaries before deploying
  • Restrict access to Kubernetes API
  • Use Role Based Access Controls to minimize exposure
  • Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
  • Update Kubernetes frequently
  • Minimize host OS footprint (reduce attack surface)
  • Minimize IAM roles
  • Minimize external access to the network
  • Appropriately use kernel hardening tools such as AppArmor, seccomp
  • Setup appropriate OS level security domains
  • Manage Kubernetes secrets
  • Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
  • Implement pod to pod encryption by use of mTLS
  • Minimize base image footprint
  • Secure your supply chain: whitelist allowed registries, sign and validate images
  • Use static analysis of user workloads (Kubernetes resources, Docker files)
  • Scan images for known vulnerabilities
  • Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
  • Detect threats within physical infrastructure, apps, networks, data, users and workloads
  • Detect all phases of attack regardless where it occurs and how it spreads
  • Perform deep analytical investigation and identification of bad actors within environment
  • Ensure immutability of containers at runtime
  • Use Audit Logs to monitor access

Course content

3 sections • 68 lectures • 16h 22m total length

  • CKS Exam Strategy, Tips & Tricks22:34

    Master the cks exam by practicing 16 clusters, kubectl context switching, ssh into master or worker nodes, and expect one question on falco, app armor, or trivy.

  • Trivy Introduction6:10

    Learn how to use Trivy for image scanning to detect high and critical vulnerabilities in containers, with exam-focused workflows for certified Kubernetes security specialist exam across Linux, macOS, and Windows.

  • Trivy - Scan Pods5:24

    Demonstrates using Treeview to scan images inside pods for high and critical vulnerabilities with Trivy, creating a dedicated namespace and deleting risky pods.

  • Extract Secrets & Save to a File4:47

    Extract secrets from a Kubernetes secret and save them to a file using kubectl, showing jsonpath, template, and yq options, with base64 decoding for username and password.

  • gVisor Demo6:06

    Set up gVisor as an isolation layer between your app and host kernel, intercepting system calls to protect pods, then create and apply a runtime class to pods and deployments.

  • CIS Benchmarks for Hardening a Kubernetes Cluster11:42

    Explore CIS benchmarks for hardening a Kubernetes cluster, learn to audit with kube-bench, identify fail steps, and implement remediation and configuration refinements to secure the control plane.

  • Fix Dockerfile and Deployment.yaml for any security vulnerabilities4:21

    Fix security vulnerabilities in Dockerfile and deployment.yaml by replacing latest image tags, running as a non-root user, removing hardcoded passwords, and enforcing read-only root filesystem and strict security contexts.

  • Enable Auditing10:07

    Learn how to enable Kubernetes auditing, configure audit policies and levels, and verify audit logs for secret and namespace changes through practical command line interface tests.

  • Falco10:22

    Falco intercepts system calls, logs events, and enables action. Learn to install Falco on Ubuntu, use dash help and list, and create rules to detect sensitive file access in pods.

  • AppArmor13:08

    Explore AppArmor, a kernel security module that prevents restricted system calls in containers by using profiles, loading them with AppArmor tools, and enforcing restrictions on a worker node.

  • Gatekeeper or Open Policy Agent12:32

    Learn how Gatekeeper and Open Policy Agent enforce yaml-based policies in Kubernetes, using constraint templates and rego rules to validate labels, replica counts, and docker.io images.

  • PodSecurityPolicy8:29

    Explore how pod security policies enforce cluster-wide rules for pods, including run as user and privileged settings, and how to apply them via cluster roles, service accounts, and namespace bindings.

  • Fix Incorrectly Specified ServiceAccount in a Pod, Create Role, Rolebinding etc.5:45

    Create a question one service account in question one namespace, grant backend role for pods, namespaces, and config maps, bind a role binding, attach pod, and ensure no secret access.

  • Fix Overly Permissive Permissions for Pod's SA & Create SA, Role, Rolebindings6:06

    Shows how to reduce a pod service account's permissions by editing a role to allow get on pods and creating a stateful sets update role bound to same service account.

  • Scenario Based Question - Admission Controller - Image Scanner7:03

    Configure the admission controller to point to the image scanner endpoint, enable implicit deny via image policy, and test by deploying a vulnerable pod that is denied.

  • Scenario Based Question - Network Policies - 16:39

    Learn to apply Kubernetes network policies in a scenario based question by enforcing default deny ingress and enabling server ingress from the client pod on port 80 in demo namespace.

  • Scenario Based Question - Network Policies - 25:21

    Implement a default deny ingress policy in the backend namespace and a second policy to allow frontend and administration-labeled pods to reach backend server pods for maintenance.

  • Scenario Based Question - Verify Platform Binaries6:11

    Verify platform binaries against sha512 checksums to ensure integrity of Kube API server, Kube controller manager, Kube proxy, and Kubelet, and delete corrupted binaries when checksums do not match.

  • Read Kubernetes Secrets from ETCD3:54

    Learn how to read Kubernetes secrets directly from etcd using the etcd client, exploring secrets in the default namespace and a separate namespace, with setup steps.

  • Create & Secure an Ingress12:28

    Create and secure an ingress by deploying an nginx ingress controller, exposing a demo deployment, and configuring tls with a self-signed certificate to enable https traffic and test with curl.

Requirements

  • Must know the basics of Kubernetes
  • Must have some hands on experience of Kubernetes
  • Ideally CKA or CKAD certified as that is also a prerequisite to take the CKS Exam

Description

Cluster Setup

  1. Use Network security policies to restrict cluster level access

  2. Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

  3. Properly set up Ingress objects with security control

  4. Protect node metadata and endpoints

  5. Minimize use of, and access to, GUI elements

  6. Verify platform binaries before deploying


Cluster Hardening

  1. Restrict access to Kubernetes API

  2. Use Role Based Access Controls to minimize exposure

  3. Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

  4. Update Kubernetes frequently


System Hardening

  1. Minimize host OS footprint (reduce attack surface)

  2. Minimize IAM roles

  3. Minimize external access to the network

  4. Appropriately use kernel hardening tools such as AppArmor, seccomp


Minimize Microservice Vulnerabilities

  1. Setup appropriate OS level security domains

  2. Manage Kubernetes secrets

  3. Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)

  4. Implement pod to pod encryption by use of mTLS


Supply Chain Security

  1. Minimize base image footprint

  2. Secure your supply chain: whitelist allowed registries, sign and validate images

  3. Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)

  4. Scan images for known vulnerabilities


Monitoring, Logging and Runtime Security

  1. Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities

  2. Detect threats within physical infrastructure, apps, networks, data, users and workloads

  3. Detect all phases of attack regardless where it occurs and how it spreads

  4. Perform deep analytical investigation and identification of bad actors within environment

  5. Ensure immutability of containers at runtime

  6. Use Audit Logs to monitor access

Who this course is for:

  • Anyone wishing to learn about Kubernetes Security or want to pass the CKS Exam

Report abuse