2 lines
3.8 KiB
HTML
2 lines
3.8 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 1: choose the control</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0001 · 15 minutes</p><h1>Choose the security control before you touch YAML</h1><p class="lede">A CKS task often feels large because several controls sound plausible. Your first win is narrowing the problem to the one mechanism that can enforce the stated outcome.</p><div class="callout"><strong>Mission connection:</strong> a security engineer must choose a control that is both effective and scoped correctly. This is how you become faster in the exam and more credible at work.</div><h2>The control map</h2><ul><li><strong>Who may call the Kubernetes API?</strong> RBAC: Role/ClusterRole plus binding.</li><li><strong>Which pod configuration may be created?</strong> Pod Security Admission or another admission policy.</li><li><strong>Which packets may flow?</strong> NetworkPolicy—provided the CNI enforces it.</li><li><strong>What may the process do inside its container?</strong> <code>securityContext</code>, capabilities, seccomp, AppArmor/SELinux.</li><li><strong>What happened through the API?</strong> Audit logging.</li></ul><p>This map follows the official <a href="https://kubernetes.io/docs/concepts/security/">Kubernetes security overview</a>. The practical exam is performance-based and currently runs for two hours; use the <a href="https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/">Linux Foundation page</a> as the authority for changing logistics.</p><h2>Practice: classify first, configure second</h2><div class="quiz"><h3>Requirement</h3><p>“In namespace <code>payments</code>, only pods labelled <code>app=api</code> may reach TCP 5432 on pods labelled <code>app=db</code>. Everything else should remain denied.”</p><p>What is the primary control?</p><label><input type="radio" name="q" value="rbac"> RBAC Role and RoleBinding</label><label><input type="radio" name="q" value="psa"> Pod Security Admission labels</label><label><input type="radio" name="q" value="network"> NetworkPolicy with a selected ingress rule</label><label><input type="radio" name="q" value="audit"> Kubernetes audit policy</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Deliberate drill (10 minutes)</h2><ol><li>Without looking up syntax, write a NetworkPolicy that selects <code>app=db</code>, permits TCP 5432 only from <code>app=api</code>, and applies in <code>payments</code>.</li><li>Validate it: confirm the selectors, port, protocol, and namespace; then test an allowed and a disallowed source if your lab supports it.</li><li>Compare with the official <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/">NetworkPolicy documentation</a>. Add the first thing you missed to your error log.</li></ol><p>When you finish, paste your manifest or tell me what felt uncertain. I’ll review it as your teacher and choose the next just-right drill.</p><footer>Next reference: <a href="../reference/cks-four-week-field-guide.html">CKS four-week field guide</a></footer></main><script>function check(){const chosen=document.querySelector('input[name=q]:checked');const f=document.getElementById('feedback');if(!chosen){f.textContent='Choose one control first.';f.className='feedback bad';return;}if(chosen.value==='network'){f.textContent='Correct. This is a traffic-flow requirement; NetworkPolicy expresses the allowed ingress precisely.';f.className='feedback good';}else{f.textContent='Not this time. The requirement controls pod-to-pod network traffic, so start with NetworkPolicy.';f.className='feedback bad';}}</script></body></html>
|