Home

Awesome

Certified Kubernetes Security Specialist Study Guide

<p align="center"> <img width="360" src="img/kcss_logo.png"> </p>

CKS Overview

The CKS is the third Kubernetes based certification backed by the Cloud Native Computing Foundation (CNCF). CKS will join the existing Certified Kubernetes Administrator (CKA) and Certified Kubernetes Application Developer (CKAD) programs. All three certifications are online, proctored, performance-based exams that will require solving multiple Kubernetes security tasks from the command line. With the massive investment into Kubernetes over the last five years, these certifications continue to be highly sought after by many seeking out technical knowledge about Kubernetes.

This repository contains resources to build a Kubernetes cluster, and example questions and answers based on the Certified Kubernetes Security Specialist (CKS) exam curriculum.

Repository Structure

study_guide/
└ cluster_setup/
  └ Makefile
  └ gcp   -> Create a 1.19 cluster in GCP with RKE.
  └ aws   (coming soon)
  └ azure (coming soon)
└ img/
  └ all_images_used
└ walkthrough/
  └ p0_intro/
  └ p1_cluster_setup /
  └ p2_cluster_hardening/
  └ p3_system_hardening/
  └ p4_minimizing_vulnerabilities/
  └ p5_supply_chain_security/
  └ p6_monitoring_logging_runtime_security/
└ LICENSE
└ README.md

Outline

The CKS test will be online, proctored and performance-based, and candidates have 2 hours to complete the exam tasks. This information is currently based on the Linux Foundations release of the CKS outline.

From the CKS Exam Curriculum repository, The exam will test domains and competencies including:

Exam News and Overview

-> CNCF CKS Overview

KubeCon Announcement and Preparation Tips

-> KubeCon Announcement and Linux Foundation Update

Curriculum

Below is the CKS curriculum broken down by its six sections. Each section has its own folder in the repository, where you can walk through individual questions relating to their respective topic. Each section in the curriculum overview also contains external resources that you may find useful in your studying journey,

Cluster Setup - 10%

<details><summary>Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)</summary> </summary> </details> <details><summary>Verify platform binaries before deploying</summary> </details> <details><summary>Protect node metadata and endpoints</summary> </details> <details><summary>Use Network security policies to restrict cluster level access</summary> </details> <details><summary>Properly set up Ingress objects with security control</summary> </details> <details><summary>Minimize use of, and access to, GUI elements</summary> </details>

Cluster Hardening - 15%

<details><summary>Restrict access to Kubernetes API</summary> </details> <details><summary>Use Role Based Access Controls to minimize exposure</summary> </details> <details><summary>Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones</summary> </details>

System Hardening - 15%

<details><summary>Minimize host OS footprint (reduce attack surface)</summary> </details> <details><summary>Minimize IAM roles</summary> </details> <details><summary>Minimize external access to the network</summary> </details> <details><summary>Appropriately use kernel hardening tools such as AppArmor, seccomp</summary> </details>

Minimize Microservice Vulnerabilities - 20%

<details><summary>Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts</summary> </details> <details><summary>Manage Kubernetes secrets</summary> </details> <details><summary>Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)</summary> </details> <details><summary>Implement pod to pod encryption by use of mTLS</summary> </details>

Supply Chain Security - 20%

<details><summary>Minimize base image footprint</summary> </details> <details><summary>Secure your supply chain: whitelist allowed image registries, sign and validate images</summary> </details> <details><summary>Use static analysis of user workloads (e.g. kubernetes resources, docker files)</summary> </details> <details><summary>Scan images for known vulnerabilities</summary> </details>

Monitoring, Logging and Runtime Security - 20%

<details><summary>Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities</summary> </details> <details><summary>Detect threats within physical infrastructure, apps, networks, data, users and workloads</summary> </details> <details><summary>Detect all phases of attack regardless where it occurs and how it spreads</summary> </details> <details><summary>Perform deep analytical investigation and identification of bad actors within environment</summary> </details> <details><summary>Ensure immutability of containers at runtime</summary> </details> <details><summary>Use Audit Logs to monitor access</summary> </details>

Extra Resources