Get ready for the CKS exam

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Back up before you edit

Copy every manifest before you change it, outside the manifests folder.

#cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/kube-apiserver.yaml.bak
#vim /etc/kubernetes/manifests/kube-apiserver.yaml
#watch crictl ps
#crictl logs $(crictl ps -a --name kube-apiserver -q | head -1) 2>&1 | tail

Let op

Never keep the backup inside /etc/kubernetes/manifests/ — the kubelet would start it as a second API server.

10.2

Review the domains

One line per domain to say out loud before the exam.

Domain	Must be able to
Cluster setup	Default-deny NetworkPolicy, kube-bench fixes, Ingress TLS, block metadata IP, verify binaries — lesson
Cluster hardening	Least-privilege RBAC, no token automount, restrict API access, upgrade — lesson
System hardening	AppArmor profile in a pod, seccomp RuntimeDefault, drop capabilities — lesson
Microservice vulnerabilities	Pod Security levels, Gatekeeper, secrets encryption, RuntimeClass — lessons
Supply chain	Trivy scan, SBOM, ImagePolicyWebhook, allowed registries, kubesec — lesson
Runtime security	Audit policy, Falco rules, immutable containers — lesson

10.3

Know the key file paths

Many tasks start with "the config is in …". Know these by heart.

File	Content
`/etc/kubernetes/manifests/kube-apiserver.yaml`	API server flags (admission, audit, encryption)
`/var/lib/kubelet/config.yaml`	Kubelet settings (authentication, readOnlyPort)
`/etc/kubernetes/pki/`	Cluster certificates
`/etc/apparmor.d/`	AppArmor profiles
`/var/lib/kubelet/seccomp/`	Seccomp profiles
`/etc/falco/`	Falco rules
`/var/log/kubernetes/audit/`	Audit log (as configured)

10.4

Practise with the simulator

killer.sh CKS (2 sessions with the exam) is harder than the real test. Do each session fully, then redo the tasks you missed until they are easy.

Onthoud

Speed comes from the CKA skills. Pass the CKA first (it is required), keep using kubectl daily, and the CKS becomes a security layer on top.

Alle commando's in dit hoofdstuk