Preparation for the Certified Kubernetes Security Specialist (CKS) Exam

You'll analyze the security architecture of Kubernetes: The control plane (API server, etcd, scheduler, controller manager) and data plane (kubelet, kube-proxy, container runtime) are examined for typical vulnerabilities. You'll learn how TLS encryption for etcd, API server authentication, and kubelet hardening work, and understand the attack surface of each component. This is the foundation for all further hardening measures.

You'll audit Kubernetes components against CIS Benchmarks using the kube-bench tool. You'll learn API server hardening (disable anonymous authentication, enforce RBAC mode), etcd security with client certificates, and kubelet access restrictions (disable read-only port). Each hardening measure is validated against official CIS criteria to achieve production-grade security standards.

You'll implement least privilege access with RBAC: You'll create Roles and ClusterRoles with minimal permissions, bind them to service accounts with RoleBindings, and prevent privilege escalation (no escalate or bind verb on Roles). You'll learn to differentiate between service accounts and user accounts (OIDC-based users vs. token-based service accounts) and audit existing permissions with tools like rbac-lookup or kubectl auth can-i.

You'll harden Kubernetes nodes using kernel security modules: You'll create AppArmor profiles for containers, configure seccomp policies for syscall filtering, and disable insecure kernel features. You'll learn to protect node metadata (cloud provider metadata APIs) with network policies to prevent credential leaks from containers. Minimalist OS distributions like Flatcar Container Linux or Bottlerocket additionally reduce the attack surface.

You'll implement Pod Security Standards (PSS) in Kubernetes: You'll configure the PodSecurity admission controller with privileged, baseline, and restricted modes and enforce policies per namespace. You'll learn two container isolation technologies: gVisor uses a userspace kernel for syscall filtering and drastically reduces the attack surface. Kata Containers goes further by isolating each container in its own lightweight VM. You'll compare both approaches regarding performance overhead and security benefits.

You'll secure secrets on two levels: etcd encryption at rest (EncryptionConfiguration with AES-CBC or AES-GCM) protects secrets in cluster storage. You'll configure Pod Security Context for hardening: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, and drop capabilities (CAP_NET_RAW, CAP_SYS_ADMIN). You'll learn about external secrets management solutions (External Secrets Operator, Sealed Secrets) and understand when they're more appropriate than native Kubernetes Secrets.

You'll implement default deny network policies (all pods are isolated by default) and create whitelist-based ingress/egress rules. You'll learn micro-segmentation with cross-namespace policies and label selectors. You'll configure pod-to-pod encryption with Cilium (WireGuard or IPSec) and understand the difference between CNI-based policies (Calico, Cilium) and Kubernetes-native NetworkPolicy objects. Exam-relevant: egress filtering for external APIs and DNS policies.

You'll learn how to expose applications via TLS-secured routes: With Ingress Controllers (NGINX, Traefik) and the modern Gateway API. You'll configure automatic certificate management with cert-manager (Let's Encrypt integration) and enforce HTTPS-only policies. This keeps communication with your applications confidential and protected from man-in-the-middle attacks.

You'll secure the container supply chain with modern tools: You'll sign images with Cosign, verify signatures, and generate Software Bill of Materials (SBOM) with Syft. You'll configure the Kyverno admission controller to allow only signed images in the cluster. You'll learn keyless signing with Sigstore (OIDC-based, no manual key management) and understand how SLSA levels ensure build integrity. This is directly exam-relevant (Supply Chain Security: 20% exam weighting).

You'll scan container images for CVEs (Common Vulnerabilities and Exposures) with Trivy: You'll integrate Trivy into CI/CD pipelines, filter by severity levels (Critical, High), and block vulnerable images. You'll validate Kubernetes manifests with Kubesec (detects dangerous SecurityContext settings) and KubeLinter (best practice checks for production deployments). You'll learn to use SBOM data (Software Bill of Materials) from Trivy scans to track known dependencies.

At the API server, authentication, authorization, admission, and audit are separate stages; audit records but never makes decisions. With a prepared identity provider and webhook, you configure both paths, send accepted and rejected requests, then use responses and audit entries to identify the responsible stage. You test NodeRestriction separately with a kubelet identity whose attempt to modify another Node or its Pods is rejected.

You'll monitor runtime behavior with Falco: You'll create Falco rules for suspicious activities: file integrity monitoring (unexpected changes in system directories), syscall monitoring (unexpected shell processes in containers), and network activity (connections to unknown IPs). You'll configure alerting (Slack, PagerDuty) and automated response (automatically isolate pods on critical events). You'll learn eBPF-based runtime security with Tetragon and understand the difference from log-based monitoring.

If you want to explore Falco beyond the exam blueprint, Introduction to Falco covers installation, testable rules, exceptions, alert routing, and operational diagnostics.

You'll configure Kubernetes audit logs with audit policies: You'll define which events to log (RequestReceived, ResponseStarted, ResponseComplete) and filter for critical operations (secret access, RBAC changes, exec/attach on pods). You'll learn audit levels (None, Metadata, Request, RequestResponse) and understand trade-offs (verbosity vs. performance). You'll integrate audit logs into SIEM systems (Elastic Stack, Splunk) and create alerts for suspicious patterns (e.g., repeated Unauthorized errors).

You'll learn incident response playbooks for Kubernetes: When pods are suspicious, you'll perform isolation (set network policy to deny-all, change pod labels), extract forensic data (logs, volume snapshots, memory dumps), and analyze audit logs for initial access vectors. You'll practice live response: debugging running containers, analyzing processes, and checking network connections. You'll understand when pods should be terminated vs. isolated (forensics vs. containment).

You'll investigate compromised clusters forensically: You'll reconstruct attack chains from audit logs (Initial Access → Privilege Escalation → Lateral Movement → Data Exfiltration), analyze pod anomalies (unexpected processes, network connections, file modifications), and identify persistence mechanisms (CronJobs, DaemonSets with backdoors). You'll create forensic snapshots (etcd backups, PersistentVolume snapshots) without impacting the cluster. You'll learn post-incident analysis with timelines and Indicators of Compromise (IOCs).

Reinforce your newly acquired knowledge, receive practical time management tips for the exam environment, and learn how to avoid common pitfalls. You'll enter the CKS exam structured and well-prepared.

Wrap up any final questions, provide feedback, and discover the opportunities that await you once you've passed the exam. This course equips you to secure Kubernetes sustainably and professionally.