3.2 KiB
3.2 KiB
Certified Kubernetes Security Specialist (CKS) syllabus
Official sources: CNCF curriculum repository (current published curriculum: Kubernetes v1.34) and the Linux Foundation CKS exam page (current exam environment: Kubernetes v1.35).
1. Cluster Setup — 15%
- Use NetworkPolicies to restrict cluster-level access.
- Use the CIS Benchmark to review the security configuration of Kubernetes components: etcd, kubelet, CoreDNS, and kube-apiserver.
- Set up Ingress with TLS correctly.
- Protect node metadata and endpoints.
- Verify platform binaries before deployment.
2. Cluster Hardening — 15%
- Use RBAC to minimize exposure.
- Use ServiceAccounts carefully: disable defaults where appropriate and minimize new-account permissions.
- Restrict Kubernetes API access.
- Upgrade Kubernetes to avoid known vulnerabilities.
3. System Hardening — 10%
- Minimize the host operating-system footprint and attack surface.
- Apply least-privilege identity and access management.
- Minimize external network access.
- Use kernel hardening tools appropriately, including AppArmor and seccomp.
4. Minimize Microservice Vulnerabilities — 20%
- Apply appropriate Pod Security Standards.
- Manage Kubernetes Secrets securely.
- Understand and implement isolation techniques, including multi-tenancy and sandboxed containers.
- Implement Pod-to-Pod encryption using Cilium.
5. Supply Chain Security — 20%
- Minimize base-image footprint.
- Understand the supply chain, including SBOMs, CI/CD, and artifact repositories.
- Secure the supply chain through permitted registries, signing, and artifact validation.
- Perform static analysis of user workloads and container images, for example with Kubesec or KubeLinter.
6. Monitoring, Logging, and Runtime Security — 20%
- Perform behavioral analytics to detect malicious activity.
- Detect threats affecting infrastructure, applications, networks, data, users, and workloads.
- Investigate attack phases and identify malicious actors.
- Ensure runtime immutability of containers.
- Use Kubernetes audit logs to monitor access.
Course coverage tracker
| Domain | Lessons completed or available | Still to drill |
|---|---|---|
| Cluster Setup | 2, 8, 15, 16, 22, 28 | CIS, node metadata, binary verification |
| Cluster Hardening | 3, 7, 9 | API restriction, upgrades |
| System Hardening | 4, 6, 11 | host footprint, external access; AppArmor needs a compatible kernel |
| Microservice Vulnerabilities | 5, 6, 7, 8, 10 | multi-tenancy/sandboxes, Cilium encryption |
| Supply Chain Security | 13, 27 | images, SBOM, signing, registries, image scanning |
| Monitoring/Logging/Runtime | 12 | behavior analysis, runtime immutability, audit investigation |
Supplemental: Istio service-mesh security
Istio is not a separately weighted CKS domain, but its mTLS and authorization controls reinforce the CKS objectives around workload isolation and encrypted service traffic. The supplemental path starts with Lesson 25: namespace-wide strict mTLS using PeerAuthentication, then will progress to workload-scoped mTLS and AuthorizationPolicy.