63 lines
3.2 KiB
Markdown
63 lines
3.2 KiB
Markdown
# Certified Kubernetes Security Specialist (CKS) syllabus
|
|
|
|
Official sources: [CNCF curriculum repository](https://github.com/cncf/curriculum) (current published curriculum: Kubernetes v1.34) and the [Linux Foundation CKS exam page](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/) (current exam environment: Kubernetes v1.35).
|
|
|
|
## 1. Cluster Setup — 15%
|
|
|
|
- Use NetworkPolicies to restrict cluster-level access.
|
|
- Use the CIS Benchmark to review the security configuration of Kubernetes components: etcd, kubelet, CoreDNS, and kube-apiserver.
|
|
- Set up Ingress with TLS correctly.
|
|
- Protect node metadata and endpoints.
|
|
- Verify platform binaries before deployment.
|
|
|
|
## 2. Cluster Hardening — 15%
|
|
|
|
- Use RBAC to minimize exposure.
|
|
- Use ServiceAccounts carefully: disable defaults where appropriate and minimize new-account permissions.
|
|
- Restrict Kubernetes API access.
|
|
- Upgrade Kubernetes to avoid known vulnerabilities.
|
|
|
|
## 3. System Hardening — 10%
|
|
|
|
- Minimize the host operating-system footprint and attack surface.
|
|
- Apply least-privilege identity and access management.
|
|
- Minimize external network access.
|
|
- Use kernel hardening tools appropriately, including AppArmor and seccomp.
|
|
|
|
## 4. Minimize Microservice Vulnerabilities — 20%
|
|
|
|
- Apply appropriate Pod Security Standards.
|
|
- Manage Kubernetes Secrets securely.
|
|
- Understand and implement isolation techniques, including multi-tenancy and sandboxed containers.
|
|
- Implement Pod-to-Pod encryption using Cilium.
|
|
|
|
## 5. Supply Chain Security — 20%
|
|
|
|
- Minimize base-image footprint.
|
|
- Understand the supply chain, including SBOMs, CI/CD, and artifact repositories.
|
|
- Secure the supply chain through permitted registries, signing, and artifact validation.
|
|
- Perform static analysis of user workloads and container images, for example with Kubesec or KubeLinter.
|
|
|
|
## 6. Monitoring, Logging, and Runtime Security — 20%
|
|
|
|
- Perform behavioral analytics to detect malicious activity.
|
|
- Detect threats affecting infrastructure, applications, networks, data, users, and workloads.
|
|
- Investigate attack phases and identify malicious actors.
|
|
- Ensure runtime immutability of containers.
|
|
- Use Kubernetes audit logs to monitor access.
|
|
|
|
## Course coverage tracker
|
|
|
|
| Domain | Lessons completed or available | Still to drill |
|
|
| --- | --- | --- |
|
|
| Cluster Setup | 2, 8, 15, 16, 22, 28 | CIS, node metadata, binary verification |
|
|
| Cluster Hardening | 3, 7, 9 | API restriction, upgrades |
|
|
| System Hardening | 4, 6, 11 | host footprint, external access; AppArmor needs a compatible kernel |
|
|
| Microservice Vulnerabilities | 5, 6, 7, 8, 10 | multi-tenancy/sandboxes, Cilium encryption |
|
|
| Supply Chain Security | 13, 27, 30 | signing, registries, image scanning |
|
|
| Monitoring/Logging/Runtime | 12 | behavior analysis, runtime immutability, audit investigation |
|
|
|
|
## Supplemental: Istio service-mesh security
|
|
|
|
Istio is not a separately weighted CKS domain, but its mTLS and authorization controls reinforce the CKS objectives around workload isolation and encrypted service traffic. The supplemental path starts with Lesson 25: namespace-wide strict mTLS using `PeerAuthentication`, then will progress to workload-scoped mTLS and `AuthorizationPolicy`.
|