Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Vaardigheden in dit hoofdstuk
- CKS — maand 9–12
Know the goal of phase 5
A cluster where only signed, scanned images run, every change comes from Git, policies block unsafe settings, and attacks are detected.
| Item | Value |
|---|---|
| Exam | CKS — Certified Kubernetes Security Specialist |
| Format | Hands-on, 2 hours |
| Domains | Cluster setup 15 %, cluster hardening 15 %, system hardening 10 %, microservice vulnerabilities 20 %, supply chain security 20 %, monitoring, logging and runtime security 20 % |
| Price | about $445 |
Study with these sources
The CKS course, the official security checklist, and the docs of the main tools.
| Source | Use it for |
|---|---|
| ★ CKS curriculum | The checklist |
| ★ KodeKloud CKS course | Main course with labs and mock exams |
| ★ killer.sh CKS simulator | Included with the exam |
| ★ Kubernetes security checklist | The official hardening list |
| Trivy, Falco, OPA Gatekeeper, kube-bench | The tools to know (free docs) |
| ★ Argo CD and Flux — Getting Started | GitOps |
| CKS Study Guide — Benjamin Muschko | The book |
| My summaries | CKS, GitOps |
Build the phase project
The portfolio project of the whole year: one repository that shows the full DevSecOps flow.
- GitOps with Argo CD (or Flux): the cluster state comes only from Git.
- The CI pipeline builds the image, scans it with Trivy, makes an SBOM and signs it with cosign.
- An admission policy (Gatekeeper or Kyverno) allows only signed images from the own registry, no root containers, and limits for every pod.
- Pod Security "restricted" on the app namespaces; NetworkPolicies with default deny.
- Falco rules alert on a shell in a container; audit logging is on.
- kube-bench report before and after hardening, in the README.
Finish the phase
The phase is done when all of these are true.
- [ ] CKS passed.
- [ ] The portfolio project is complete, documented on GitHub and on this site.
- [ ] Interviews: I can explain every security control in the project and why it is there.