s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

الفصل 7الاسم في الدورة: Security, GitOps and CKS

Phase 5 (months 9–12): Kubernetes security, GitOps and CKS

Phase 5 adds the Sec to DevOps: harden the cluster, scan and sign images, enforce policies as code, watch runtime behaviour, and deploy everything through GitOps. The exam is CKS (CKA must be passed first).

  • 4 الدروس
  • 0 الأوامر

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

  • CKS — الشهر 9–12

7.1

Know the goal of phase 5

A cluster where only signed, scanned images run, every change comes from Git, policies block unsafe settings, and attacks are detected.

ItemValue
ExamCKS — Certified Kubernetes Security Specialist
FormatHands-on, 2 hours
DomainsCluster setup 15 %, cluster hardening 15 %, system hardening 10 %, microservice vulnerabilities 20 %, supply chain security 20 %, monitoring, logging and runtime security 20 %
Priceabout $445

7.2

Study with these sources

The CKS course, the official security checklist, and the docs of the main tools.

SourceUse it for
★ CKS curriculumThe checklist
★ KodeKloud CKS courseMain course with labs and mock exams
★ killer.sh CKS simulatorIncluded with the exam
★ Kubernetes security checklistThe official hardening list
Trivy, Falco, OPA Gatekeeper, kube-benchThe tools to know (free docs)
★ Argo CD and Flux — Getting StartedGitOps
CKS Study Guide — Benjamin MuschkoThe book
My summariesCKS, GitOps

7.3

Build the phase project

The portfolio project of the whole year: one repository that shows the full DevSecOps flow.

  1. GitOps with Argo CD (or Flux): the cluster state comes only from Git.
  2. The CI pipeline builds the image, scans it with Trivy, makes an SBOM and signs it with cosign.
  3. An admission policy (Gatekeeper or Kyverno) allows only signed images from the own registry, no root containers, and limits for every pod.
  4. Pod Security "restricted" on the app namespaces; NetworkPolicies with default deny.
  5. Falco rules alert on a shell in a container; audit logging is on.
  6. kube-bench report before and after hardening, in the README.

7.4

Finish the phase

The phase is done when all of these are true.

  • [ ] CKS passed.
  • [ ] The portfolio project is complete, documented on GitHub and on this site.
  • [ ] Interviews: I can explain every security control in the project and why it is there.