Lesson 0001 · 15 minutes

Choose the security control before you touch YAML

A CKS task often feels large because several controls sound plausible. Your first win is narrowing the problem to the one mechanism that can enforce the stated outcome.

Mission connection: a security engineer must choose a control that is both effective and scoped correctly. This is how you become faster in the exam and more credible at work.

The control map

Who may call the Kubernetes API? RBAC: Role/ClusterRole plus binding.
Which pod configuration may be created? Pod Security Admission or another admission policy.
Which packets may flow? NetworkPolicy—provided the CNI enforces it.
What may the process do inside its container? securityContext, capabilities, seccomp, AppArmor/SELinux.
What happened through the API? Audit logging.

This map follows the official Kubernetes security overview. The practical exam is performance-based and currently runs for two hours; use the Linux Foundation page as the authority for changing logistics.

Practice: classify first, configure second

Requirement

“In namespace payments, only pods labelled app=api may reach TCP 5432 on pods labelled app=db. Everything else should remain denied.”

What is the primary control?

RBAC Role and RoleBinding Pod Security Admission labels NetworkPolicy with a selected ingress rule Kubernetes audit policy

Deliberate drill (10 minutes)

Without looking up syntax, write a NetworkPolicy that selects app=db, permits TCP 5432 only from app=api, and applies in payments.
Validate it: confirm the selectors, port, protocol, and namespace; then test an allowed and a disallowed source if your lab supports it.
Compare with the official NetworkPolicy documentation. Add the first thing you missed to your error log.

When you finish, paste your manifest or tell me what felt uncertain. I’ll review it as your teacher and choose the next just-right drill.