s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Certified Kubernetes Security Specialist (CKS)

Secure Kubernetes from the node to the supply chain: network policies, CIS benchmark, RBAC, AppArmor and seccomp, Pod Security, policy as code, secrets, image scanning and signing, audit logs and Falco. Phase 5 of my path.

Course by
CNCF
Course code
CKS
Version
Kubernetes 1.3x
Lessons
45

These summaries follow the public outline of the course. I wrote every lesson in my own words and tested the commands on RHEL 10. They are not Red Hat training material. Take the official course for the full content and the hands-on labs.

Next course: GitOps

Parts and chapters

Part 1

Cluster setup and hardening (30 %)

  1. 1Set up a cluster securelyCluster setup5 lessons
    Lessons
    1. 1.1 Restrict traffic with default-deny policies
    2. 1.2 Check the cluster with kube-bench
    3. 1.3 Protect the ingress with TLS
    4. 1.4 Block the cloud metadata service
    5. 1.5 Verify the platform binaries
  2. 2Harden access to the clusterCluster hardening5 lessons
    Lessons
    1. 2.1 Apply least-privilege RBAC
    2. 2.2 Limit service account tokens
    3. 2.3 Restrict access to the API server
    4. 2.4 Upgrade Kubernetes regularly
    5. 2.5 Review who did what

Part 2

System hardening (10 %)

  1. 3Harden the nodes with AppArmor and seccompSystem hardening4 lessons
    Lessons
    1. 3.1 Keep the host small
    2. 3.2 Use AppArmor profiles
    3. 3.3 Use seccomp profiles
    4. 3.4 Restrict capabilities and privilege

Part 3

Microservice vulnerabilities (20 %)

  1. 4Enforce Pod Security StandardsPod Security Admission and security contexts4 lessons
    Lessons
    1. 4.1 Know the three levels
    2. 4.2 Label a namespace
    3. 4.3 Write a restricted pod
    4. 4.4 Fix a rejected workload
  2. 5Write policies as code with OPA GatekeeperPolicy as code4 lessons
    Lessons
    1. 5.1 Know how Gatekeeper works
    2. 5.2 Write a template and a constraint
    3. 5.3 Audit existing objects
    4. 5.4 Compare with Kyverno and ValidatingAdmissionPolicy
  3. 6Protect Kubernetes secretsSecrets management5 lessons
    Lessons
    1. 6.1 See the problem
    2. 6.2 Turn on encryption at rest
    3. 6.3 Limit who can read secrets
    4. 6.4 Use secrets as files
    5. 6.5 Use an external secret store
  4. 7Isolate workloads with sandboxes and mTLSContainer runtime sandboxes and pod-to-pod encryption4 lessons
    Lessons
    1. 7.1 Use a sandboxed runtime with RuntimeClass
    2. 7.2 Know where sandboxes help
    3. 7.3 Encrypt pod-to-pod traffic with mTLS
    4. 7.4 Encrypt node-to-node traffic

Part 4

Supply chain security (20 %)

  1. 8Secure the supply chain of imagesSupply chain security6 lessons
    Lessons
    1. 8.1 Use minimal base images
    2. 8.2 Make and use an SBOM
    3. 8.3 Scan images
    4. 8.4 Sign and verify images
    5. 8.5 Allow only trusted registries
    6. 8.6 Analyse manifests statically

Part 5

Monitoring, logging and runtime security (20 %)

  1. 9Detect threats with audit logs and FalcoMonitoring, logging and runtime security4 lessons
    Lessons
    1. 9.1 Turn on audit logging
    2. 9.2 Detect behaviour with Falco
    3. 9.3 Make containers immutable
    4. 9.4 Investigate a suspicious pod
  2. 10Get ready for the CKS examExam preparation4 lessons
    Lessons
    1. 10.1 Back up before you edit
    2. 10.2 Review the domains
    3. 10.3 Know the key file paths
    4. 10.4 Practise with the simulator

What you learn

The main skills of the course and the chapter where you learn each one.

Cluster setup and hardening

System hardening

Minimize microservice vulnerabilities

Supply chain security

Monitoring