Completed upto lesson 28

CKS-SYLLABUS.md

@@ -0,0 +1,62 @@
+# Certified Kubernetes Security Specialist (CKS) syllabus
+
+Official sources: [CNCF curriculum repository](https://github.com/cncf/curriculum) (current published curriculum: Kubernetes v1.34) and the [Linux Foundation CKS exam page](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/) (current exam environment: Kubernetes v1.35).
+
+## 1. Cluster Setup — 15%
+
+- Use NetworkPolicies to restrict cluster-level access.
+- Use the CIS Benchmark to review the security configuration of Kubernetes components: etcd, kubelet, CoreDNS, and kube-apiserver.
+- Set up Ingress with TLS correctly.
+- Protect node metadata and endpoints.
+- Verify platform binaries before deployment.
+
+## 2. Cluster Hardening — 15%
+
+- Use RBAC to minimize exposure.
+- Use ServiceAccounts carefully: disable defaults where appropriate and minimize new-account permissions.
+- Restrict Kubernetes API access.
+- Upgrade Kubernetes to avoid known vulnerabilities.
+
+## 3. System Hardening — 10%
+
+- Minimize the host operating-system footprint and attack surface.
+- Apply least-privilege identity and access management.
+- Minimize external network access.
+- Use kernel hardening tools appropriately, including AppArmor and seccomp.
+
+## 4. Minimize Microservice Vulnerabilities — 20%
+
+- Apply appropriate Pod Security Standards.
+- Manage Kubernetes Secrets securely.
+- Understand and implement isolation techniques, including multi-tenancy and sandboxed containers.
+- Implement Pod-to-Pod encryption using Cilium.
+
+## 5. Supply Chain Security — 20%
+
+- Minimize base-image footprint.
+- Understand the supply chain, including SBOMs, CI/CD, and artifact repositories.
+- Secure the supply chain through permitted registries, signing, and artifact validation.
+- Perform static analysis of user workloads and container images, for example with Kubesec or KubeLinter.
+
+## 6. Monitoring, Logging, and Runtime Security — 20%
+
+- Perform behavioral analytics to detect malicious activity.
+- Detect threats affecting infrastructure, applications, networks, data, users, and workloads.
+- Investigate attack phases and identify malicious actors.
+- Ensure runtime immutability of containers.
+- Use Kubernetes audit logs to monitor access.
+
+## Course coverage tracker
+
+| Domain | Lessons completed or available | Still to drill |
+| --- | --- | --- |
+| Cluster Setup | 2, 8, 15, 16, 22, 28 | CIS, node metadata, binary verification |
+| Cluster Hardening | 3, 7, 9 | API restriction, upgrades |
+| System Hardening | 4, 6, 11 | host footprint, external access; AppArmor needs a compatible kernel |
+| Microservice Vulnerabilities | 5, 6, 7, 8, 10 | multi-tenancy/sandboxes, Cilium encryption |
+| Supply Chain Security | 13, 27 | images, SBOM, signing, registries, image scanning |
+| Monitoring/Logging/Runtime | 12 | behavior analysis, runtime immutability, audit investigation |
+
+## Supplemental: Istio service-mesh security
+
+Istio is not a separately weighted CKS domain, but its mTLS and authorization controls reinforce the CKS objectives around workload isolation and encrypted service traffic. The supplemental path starts with Lesson 25: namespace-wide strict mTLS using `PeerAuthentication`, then will progress to workload-scoped mTLS and `AuthorizationPolicy`.