s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Chapter 10Name in the course: Exam preparation

Get ready for the CKS exam

The CKS has 15 – 20 hands-on tasks in 2 hours. Many tasks change control-plane files (API server flags, kubelet config) — one typo stops the API server. Work carefully, keep backups, and verify every change.

  • 4 Lessons
  • 6 Commands

$ run as a normal user# run as root (or with sudo)

10.1

Back up before you edit

Copy every manifest before you change it, outside the manifests folder.

cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/kube-apiserver.yaml.bak
vim /etc/kubernetes/manifests/kube-apiserver.yaml
watch crictl ps
crictl logs $(crictl ps -a --name kube-apiserver -q | head -1) 2>&1 | tail

Watch out

Never keep the backup inside /etc/kubernetes/manifests/ — the kubelet would start it as a second API server.

10.2

Review the domains

One line per domain to say out loud before the exam.

DomainMust be able to
Cluster setupDefault-deny NetworkPolicy, kube-bench fixes, Ingress TLS, block metadata IP, verify binaries — lesson
Cluster hardeningLeast-privilege RBAC, no token automount, restrict API access, upgrade — lesson
System hardeningAppArmor profile in a pod, seccomp RuntimeDefault, drop capabilities — lesson
Microservice vulnerabilitiesPod Security levels, Gatekeeper, secrets encryption, RuntimeClass — lessons
Supply chainTrivy scan, SBOM, ImagePolicyWebhook, allowed registries, kubesec — lesson
Runtime securityAudit policy, Falco rules, immutable containers — lesson

10.3

Know the key file paths

Many tasks start with "the config is in …". Know these by heart.

FileContent
/etc/kubernetes/manifests/kube-apiserver.yamlAPI server flags (admission, audit, encryption)
/var/lib/kubelet/config.yamlKubelet settings (authentication, readOnlyPort)
/etc/kubernetes/pki/Cluster certificates
/etc/apparmor.d/AppArmor profiles
/var/lib/kubelet/seccomp/Seccomp profiles
/etc/falco/Falco rules
/var/log/kubernetes/audit/Audit log (as configured)

10.4

Practise with the simulator

killer.sh CKS (2 sessions with the exam) is harder than the real test. Do each session fully, then redo the tasks you missed until they are easy.

Remember

Speed comes from the CKA skills. Pass the CKA first (it is required), keep using kubectl daily, and the CKS becomes a security layer on top.

All commands in this chapter