{"id":220,"date":"2025-11-29T01:13:00","date_gmt":"2025-11-29T01:13:00","guid":{"rendered":"https:\/\/blog.ngocha.biz\/?p=220"},"modified":"2025-11-29T01:13:00","modified_gmt":"2025-11-29T01:13:00","slug":"cks-exam-guide-tips","status":"publish","type":"post","link":"https:\/\/blog.ngocha.biz\/?p=220","title":{"rendered":"CKS Exam Study Guide: Tips to Pass Kubernetes Security Specialist Certification"},"content":{"rendered":"<p>In this Certified Kubernetes Security Specialist (CKS) Exam study guide, I have listed all the resources you can use to pass the CKS certification exam.<\/p>\n<h2 id=\"what-is-the-certified-kubernetes-security-specialist-exam\">What Is the Certified Kubernetes Security Specialist Exam?<\/h2>\n<p>CKS is one of the <a href=\"https:\/\/devopscube.com\/best-kubernetes-certifications\/\">best Kubernetes Certifications<\/a> that is focused on the security aspects of Kubernetes.<\/p>\n<p>The official CNCF certification page says,<\/p>\n<div class=\"kg-card kg-callout-card kg-callout-card-blue\">\n<div class=\"kg-callout-text\">The Certified Kubernetes Security Specialist (CKS) program provides assurance that a CKS has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment, and runtime.<\/div>\n<\/div>\n<p>The CKS exam curriculum is well structured, with topics related to Kubernetes security. In fact, you can use the curriculum as a checklist for your existing <a href=\"https:\/\/devopscube.com\/key-considerations-kubernetes-cluster-design-setup\/\" rel=\"noreferrer noopener\">Kubernetes implementations<\/a>.<\/p>\n<h2 id=\"register-for-cks-exam-save-50-today\">Register For CKS Exam [Save 50% Today]<\/h2>\n<p>Your first step towards CKS Certification is registering for the exam on the Linux Foundation portal. When you register you <strong>get free access to two sessions of killer.sh CKS practice exams<\/strong> that will help you clear the CKS exam.<\/p>\n<div class=\"kg-card kg-callout-card kg-callout-card-blue\">\n<div class=\"kg-callout-text\"><b><strong style=\"white-space: pre-wrap;\">Note: <\/strong><\/b>Save 50% today on CKA | CKAD | CKS certification using the Voucher code given below. This offer expires soon.<\/div>\n<\/div>\n<div class=\"kg-card kg-button-card kg-align-center\"><a href=\"https:\/\/devopscube.com\/recommends\/cks-exam\/\" class=\"kg-btn kg-btn-accent\">SAVE 50% ON CKS Exam Today<\/a><\/div>\n<p><!--kg-card-begin: html--><\/p>\n<div class=\"kg-card kg-button-card kg-align-center\">\n    <b>CKA Exam Voucher:<\/b>: Use Code <b style=\"margin-left: 5px; margin-right: 5px;\">MM26CCCT<\/b> at checkout\n<\/div>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"certified-kubernetes-security-specialist-cks-exam-preparation-guide\">Certified Kubernetes Security Specialist (CKS) Exam Preparation Guide<\/h2>\n<p>We will look at the detailed CKS resources list and links to the official documentation you could use during the CKS exam.<\/p>\n<h2 id=\"cks-exam-prerequisites\">CKS Exam Prerequisites<\/h2>\n<p>The only prerequisite is that you should have a <strong>valid CKA certification<\/strong> to sit for the CKS Exam.<\/p>\n<p>If you have not passed the CKA exam, refer to our <a href=\"https:\/\/devopscube.com\/cka-exam-study-guide\/\" rel=\"noreferrer noopener\">CKA exam guide<\/a> for all useful resources.<\/p>\n<p>Even if you do not have the CKA certification, you can purchase the <a href=\"https:\/\/devopscube.com\/recommends\/cka-exam\/\" rel=\"noreferrer noopener\">CKS exam as a bundle (CKA + CKS)<\/a>. You can save up to $428 using the bundle with a 45% discount. However, you need to first pass the CKA and then you can appear for the CKS exam.<\/p>\n<h2 id=\"cks-exam-details\">CKS Exam Details<\/h2>\n<p>Following is the important information about CKS Exam.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"has-fixed-layout\">\n<tbody>\n<tr>\n<td>Exam Duration<\/td>\n<td>2 hrs<\/td>\n<\/tr>\n<tr>\n<td>Pass Percentage<\/td>\n<td>67%<\/td>\n<\/tr>\n<tr>\n<td>Kubernetes Version <\/td>\n<td>v1.36<\/td>\n<\/tr>\n<tr>\n<td>CKS Validity<\/td>\n<td>2 Years<\/td>\n<\/tr>\n<tr>\n<td>CKS Certification Exam Cost<\/td>\n<td>$445<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<p>As CKS is an open-book exam, you can use the following Kubernetes and third-party tools documentation that is part of the CKS exam.<\/p>\n<h3 id=\"kubernetes-documentation\">Kubernetes Documentation<\/h3>\n<ol>\n<li><a href=\"https:\/\/kubernetes.io\/docs\/home\/?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/kubernetes.io\/docs\/home\/<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/kubernetes\/?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/github.com\/kubernetes\/<\/a><\/li>\n<li><a href=\"https:\/\/kubernetes.io\/blog\/?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/kubernetes.io\/blog\/<\/a><\/li>\n<\/ol>\n<h3 id=\"allowed-third-party-tools-documentation-for-cks-exam\">Allowed Third-Party Tools &amp; Documentation for CKS exam<\/h3>\n<div class=\"kg-card kg-callout-card kg-callout-card-grey\">\n<div class=\"kg-callout-text\"><b><strong style=\"white-space: pre-wrap;\">Important Note:<\/strong><\/b> The following domains are allowed in the exam. However, you are not allowed to visit any other domains that are mentioned in the documents.<\/div>\n<\/div>\n<ol>\n<li><a href=\"https:\/\/github.com\/aquasecurity\/trivy?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/github.com\/aquasecurity\/trivy<\/a><\/li>\n<li><a href=\"https:\/\/falco.org\/docs\/?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/falco.org\/docs\/<\/a><\/li>\n<li><a href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/-\/wikis\/Documentation?ref=devopscube.com\" rel=\"noreferrer noopener\">https:\/\/gitlab.com\/apparmor\/apparmor\/-\/wikis\/Documentation<\/a><\/li>\n<li><a href=\"https:\/\/istio.io\/latest\/docs\/?ref=devopscube.com\">https:\/\/istio.io\/latest\/docs\/<\/a><\/li>\n<li><a href=\"https:\/\/istio.io\/latest\/docs\/?ref=devopscube.com\">https:\/\/kubernetes-sigs.github.io\/bom\/cli-reference\/ <\/a><\/li>\n<li><a href=\"https:\/\/docs.cilium.io\/en\/stable?ref=devopscube.com\">https:\/\/docs.cilium.io\/en\/stable<\/a><\/li>\n<\/ol>\n<p>Please refer to the <a href=\"https:\/\/docs.linuxfoundation.org\/tc-docs\/certification\/faq-cka-ckad-cks?ref=devopscube.com#cks\" rel=\"noreferrer noopener\">official Kubernetes exam FAQ section<\/a> for more details<\/p>\n<h2 id=\"cks-exam-syllabus\">CKS Exam Syllabus<\/h2>\n<p>CKS Exam aims to test your skills in different security aspects.  The following table shows the different domains and their weightage for the CKS certification.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Topic<\/th>\n<th>Weightage<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Cluster Setup<\/td>\n<td>15%<\/td>\n<\/tr>\n<tr>\n<td>Cluster Hardening<\/td>\n<td>15%<\/td>\n<\/tr>\n<tr>\n<td>System Hardening<\/td>\n<td>10%<\/td>\n<\/tr>\n<tr>\n<td>Minimize Microservice Vulnerabilities<\/td>\n<td>20%<\/td>\n<\/tr>\n<tr>\n<td>Supply Chain Security<\/td>\n<td>20%<\/td>\n<\/tr>\n<tr>\n<td>Monitoring, Logging, and Runtime Security<\/td>\n<td>20%<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"setting-up-cks-practice-labs\">Setting up CKS Practice Labs<\/h2>\n<p>It would be best to have a practice cluster to learn and try out all the concepts involved in CKS certification. I have the following suggestion for CKS practice labs.<\/p>\n<ol>\n<li><a href=\"https:\/\/killercoda.com\/killer-shell-cks?ref=devopscube.com\" rel=\"noreferrer noopener\">Killercoda CKS Playground<\/a><\/li>\n<li><a href=\"https:\/\/kubernetes.io\/docs\/tutorials\/hello-minikube\/?ref=devopscube.com\" rel=\"noreferrer noopener\">Minikube<\/a><\/li>\n<li><a href=\"https:\/\/devopscube.com\/setup-kubernetes-cluster-kubeadm\/\" rel=\"noreferrer noopener\">Kubernetes Setup using Kubeadm<\/a> [Recommended LAB setup for CKS]<\/li>\n<li><a href=\"https:\/\/devopscube.com\/kubernetes-cluster-vagrant\/\" rel=\"noreferrer noopener\">Kubernetes Vagrant Setup using Kubeadm<\/a><\/li>\n<li><a href=\"https:\/\/devopscube.com\/setup-kubernetes-cluster-google-cloud\/\" rel=\"noreferrer noopener\">GKE Cluster<\/a> using free Google Cloud Credits<\/li>\n<li><a href=\"https:\/\/aws.amazon.com\/eks\/?ref=devopscube.com\" rel=\"noreferrer noopener\">EKS Service on AWS<\/a> using a Free tier program<\/li>\n<li><a href=\"https:\/\/azure.microsoft.com\/en-in\/services\/kubernetes-service\/?ref=devopscube.com\" rel=\"noreferrer noopener\">AKS service on Azure<\/a> using free cloud credits<\/li>\n<li>Kubernetes Cluster on Digital Ocean[ <a href=\"https:\/\/devopscube.com\/get-free-digital-ocean-credits\/\" rel=\"noreferrer noopener\">Get $100 Digital Ocean Free Credits<\/a>]<\/li>\n<\/ol>\n<div class=\"kg-card kg-callout-card kg-callout-card-grey\">\n<div class=\"kg-callout-text\"><b><strong style=\"white-space: pre-wrap;\">Note<\/strong><\/b>: To get notification on the above mentioned setup and other CKS tutorial articles, <a href=\"https:\/\/wondrous-crafter-2953.ck.page\/f934128a29?ref=devopscube.com\" rel=\"noreferrer noopener\">Signup to the CKS newsletter<\/a><\/div>\n<\/div>\n<h2 id=\"certified-kubernetes-security-specialist-certification-courses\">Certified Kubernetes Security Specialist Certification Courses<\/h2>\n<p>If you want to sign up for a course for your CKS preparation, the following are the courses you will ever need.<\/p>\n<p>There is free course available on youtube by the creater of Killercoda. This course helps you understand the CKS exam concepts. You can parallely practice the scenarios on Killercoda.<\/p>\n<figure class=\"kg-card kg-embed-card\"><iframe loading=\"lazy\" width=\"160\" height=\"90\" src=\"https:\/\/www.youtube.com\/embed\/d9xfB5qaOfg?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen=\"\"><\/iframe><\/figure>\n<p>You can solve CKS scenarios from <a href=\"https:\/\/killercoda.com\/killer-shell-cks?ref=devopscube.com\" rel=\"noreferrer noopener\">Killer coda CKS practice scenarios.<\/a><\/p>\n<p>If you are looking for course with multiple practicla labs, we recomend <a href=\"https:\/\/devopscube.com\/recommends\/kodekloud-cks\/\" rel=\"noreferrer noopener\">CKS Course from KodeKloud by Mumshad<\/a> With Practice Labs<\/p>\n<p>Both authors have done a great job creating the course content with good practice labs.<\/p>\n<p>Also, along with the certification registration, you will get access to two free CKS mock exams from <a href=\"https:\/\/killer.sh\/cks?ref=devopscube.com\" rel=\"noreferrer noopener\">killer.sh<\/a><\/p>\n<h2 id=\"cks-syllabus-wise-resources\">CKS Syllabus Wise Resources<\/h2>\n<p>Let&#8217;s have a look at the official syllabus-wise resources for the CKS exam. All the topics mentioned are as per the official Linux Foundation Certified Kubernetes Security Specialist Exam Syllabus.<\/p>\n<h2 id=\"cluster-setup-15\">Cluster Setup [15%]<\/h2>\n<p>Under cluster setup, the focus is more on the security aspects of the cluster components. This section <strong>carries 15% weightage<\/strong> in the CKS questions.<\/p>\n<p>Ensure you have a very good understanding of <a href=\"https:\/\/devopscube.com\/kubernetes-architecture-explained\/\">Kubernetes architecture<\/a> and components workflow before you start the hands-on learning.<\/p>\n<h3 id=\"kubernetes-network-policies\">Kubernetes Network Policies<\/h3>\n<p>By default, when you set up a Kubernetes cluster, pods in all the namespaces can talk to each other.<\/p>\n<p>This is not a secure setup because you might be running a different type of workload in a cluster that requires isolation in terms of networking.<\/p>\n<p>Kubernetes network policies help you to enable rules for pod network communication.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Use network security policies to restrict cluster-level access\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/network-policies\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Kubernetes Network Security Policy Documentation<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">Associated Task<\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/declare-network-policy\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Declaring Kubernetes Network Policy<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">Network Policy Editor<\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/editor.cilium.io\/?ref=devopscube.com\" target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          editor.cilium.io<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"kubernetes-cis-benchmark\">Kubernetes CIS benchmark<\/h3>\n<p>Center for Internet Security (CIS) with the Kubernetes community has created the benchmarks for Kubernetes security standards.<\/p>\n<p>Organizations can use the Kubernetes CIS benchmarks to achieve security and compliance requirements.<\/p>\n<p>If you want to know more about CIS, please read <a href=\"https:\/\/www.cisecurity.org\/cis-benchmarks\/cis-benchmarks-faq\/?ref=devopscube.com\" rel=\"noreferrer noopener\">CIS FAQs<\/a><\/p>\n<p>See <a href=\"https:\/\/www.cisecurity.org\/benchmark\/kubernetes\/?ref=devopscube.com\" rel=\"noreferrer noopener\">Kubernetes CIS benchmark<\/a> to download the latest CIS benchmarks for kubernetes.<\/p>\n<p><a href=\"https:\/\/github.com\/aquasecurity\/kube-bench?ref=devopscube.com\" rel=\"noreferrer noopener\">Kube-bench<\/a> is an open-source utility maintained by Aquasec to run all the CIS benchmark checks against a Kubernetes cluster.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Use CIS benchmark to review the security configuration of Kubernetes components<br \/>\n        (etcd, kubelet, kubedns, kubeapi)\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/devopscube.com\/kube-bench-guide\/\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          CIS Kubernetes benchmark using Kube-bench<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"ingress-security\">Ingress Security<\/h3>\n<p>From a security standpoint, for Ingress, the primary focus is on configuring ingress with TLS configurations<\/p>\n<p>Also, it would help if you looked at setting up the namespace scoped and cluster-wide ingress.<\/p>\n<p>You should also look at setting up multiple ingress\/ingress controllers using the Ingressclass<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Properly set up Ingress objects with security control\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/services-networking\/ingress\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Ingress documentation<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Understanding Ingress\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/devopscube.com\/kubernetes-ingress-tutorial\/\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          The complete ingress guide<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Understanding Ingress controller\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/devopscube.com\/setup-ingress-kubernetes-nginx-controller\/\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Nginx ingress controller setup guide<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"kubernetes-node-metadata-endpoints\">Kubernetes Node Metadata &amp; Endpoints<\/h3>\n<p>Metadata concealment is required for a cloud-based Kubernetes setup where the instances expose the instance metadata information, including credentials.<\/p>\n<p>This means the pods running on each instance would have access to the metadata server endpoint to retrieve information.<\/p>\n<p>Pod&#8217;s access to the Metadata server can be controlled via Network policies.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Protect node metadata and endpoints\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/securing-a-cluster\/?ref=devopscube.com#restricting-cloud-metadata-api-access\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Restricting cloud metadata API access<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Configuring Network Policies\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/cloud.google.com\/kubernetes-engine\/docs\/tutorials\/network-policy?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Guide to configuring network policies<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<div class=\"kg-card kg-callout-card kg-callout-card-grey\">\n<div class=\"kg-callout-text\"><b><strong style=\"white-space: pre-wrap;\">Note:<\/strong><\/b> When you use managed Kubernetes services on the cloud (GKE, EKS, AKS), it comes with options to disable metadata access for pods.<\/div>\n<\/div>\n<h3 id=\"verify-platform-binaries-before-deploying\">Verify platform binaries before deploying<\/h3>\n<p>Learn to verify the Kubernetes binaries using the checksum. The kubernetes Github release page has the version numbers and source code.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100% !important; max-width:100% !important; border-collapse:collapse; margin-top:12px; display:table; table-layout:fixed;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Kubernetes Binaries\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/github.com\/kubernetes\/kubernetes\/releases?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Github Kubernetes Releases<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<figure class=\"kg-card kg-image-card\"><img decoding=\"async\" src=\"https:\/\/storage.ghost.io\/c\/5f\/2f\/5f2f4d20-2abf-4534-8d40-7aa233aedd43\/content\/images\/2025\/08\/image-77.png\" class=\"kg-image\" alt=\"kubernetes version\" loading=\"lazy\" width=\"895\" height=\"468\" srcset=\"https:\/\/storage.ghost.io\/c\/5f\/2f\/5f2f4d20-2abf-4534-8d40-7aa233aedd43\/content\/images\/size\/w600\/2025\/08\/image-77.png 600w, https:\/\/storage.ghost.io\/c\/5f\/2f\/5f2f4d20-2abf-4534-8d40-7aa233aedd43\/content\/images\/2025\/08\/image-77.png 895w\" sizes=\"auto, (min-width: 720px) 720px\"><\/figure>\n<h2 id=\"cluster-hardening-15\">Cluster Hardening [15%]<\/h2>\n<p>Kubernetes Cluster Hardening <strong>carries 15% weightage<\/strong> in the CKS exam. Let&#8217;s have a look at the individual concepts under cluster hardening.<\/p>\n<h3 id=\"restrict-access-to-kubernetes-api\">Restrict access to Kubernetes API<\/h3>\n<p>Restricting API access is very important when it comes to Kubernetes Production Implementation. Third-party services and services running inside the cluster should access the Kubernetes API with only the required privileges.<\/p>\n<p>The primary topics under this section would be bootstrap tokens, RBAC, ABAC, service account, and admission webhooks.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" \n       style=\"width:100% !important; max-width:100% !important; \n              border-collapse:collapse; margin-top:12px; \n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Cluster API access methods\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/access-cluster-api\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Ways to access Kubernetes cluster API<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Kubernetes API Access Security\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/security\/controlling-access\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Controlling access to Kubernetes API<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Authentication\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/authentication\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Kubernetes Authentication Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Authorization\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/authorization\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Kubernetes Authorization Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Admission Controllers\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/admission-controllers\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Admission Controllers Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Admission Webhooks\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/extensible-admission-controllers\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Admission Webhooks Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Certificates\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/certificate-signing-requests\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Certificate Signing Requests Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Node Authorization\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/node\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Node Authorization Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/run-application\/access-api-from-pod\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Accessing Kubernetes API from a Pod<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"use-role-based-access-controls-to-minimize-exposure\">Use Role-Based Access Controls to minimize exposure<\/h3>\n<p>With Kubernetes RBAC, you can define fine-grained control on who can access the Kubernetes API to enforce the principle of least privilege. Allowing unnecessary cluster-wide access to everyone is a  common mistake done during Kubernetes implementations.<\/p>\n<p>Two main concepts in RBAC are,<\/p>\n<ol>\n<li><strong>Role<\/strong>: List of allowed API access<\/li>\n<li><strong>RoleBinding<\/strong> &#8211; Binding a role to a user, group, or service account.<\/li>\n<\/ol>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Roles, ClusterRoles, RoleBindings and ClusterRoleBindings\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          RBAC detailed documentation<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"exercise-caution-in-using-service-accounts-eg-disable-defaults-minimize-permissions-on-newly-created-ones\">Exercise caution in using service accounts e.g., disable defaults, minimize permissions on newly created ones.<\/h3>\n<p>Service accounts are the best way to provide access to applications\/pods which require Kubernetes API access.<\/p>\n<p>Every namespace has a default service account, and it gets attached to the pod if you don&#8217;t specify any service account explicitly. The default service account does not have any privileges. But if you bind a role to it, it will get all the access listed in the role, and it applies to all the pods in the namespace.<\/p>\n<p>Standard practice is to deploy different workloads with different service accounts to enforce the principle of least privilege.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Service Account\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/service-accounts-admin\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Service Account Management Guide<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/configure-service-account\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Configure service account for a Pod<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"update-kubernetes-frequently\">Update Kubernetes frequently<\/h3>\n<p>Whenever you upgrade a Kubernetes cluster, you should follow the recommended practices to make sure you have the application&#8217;s availability.<\/p>\n<p>Also, you should have mechanisms to validate the cluster components, security configurations, and application status post-upgrade.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Cluster Upgrade\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/kubeadm\/kubeadm-upgrade\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Upgrading Kubernetes cluster using Kubeadm<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/cluster-upgrade\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Upgrade a cluster<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"system-hardening-10\">System Hardening [10%]<\/h2>\n<p>System hardening aims at reducing vulnerabilities in applications and infrastructure components that reduce the attack surface.<\/p>\n<p>The common system hardening activities are<\/p>\n<ol>\n<li>Applying timely patches<\/li>\n<li>Removing all non-essential utilities<\/li>\n<li>Limiting access with firewall rules and utilities.<\/li>\n<li>Logging all system activities.<\/li>\n<\/ol>\n<p>When it comes to CKS, we have the following list of system hardening activities.<\/p>\n<h3 id=\"minimize-host-os-footprint-reduce-attack-surface\">Minimize host OS footprint (reduce attack surface)<\/h3>\n<ol>\n<li>Removing unwanted binaries and services that are not required for cluster operation.<\/li>\n<li>Adding correct firewall rules to restrict host access on opened ports<\/li>\n<li><a href=\"https:\/\/devopscube.com\/what-is-docker\/\" rel=\"noreferrer noopener\">Containers<\/a> should have fewer privileges on the host OS. Run container as a non-root user<\/li>\n<\/ol>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Restricting Kernel Modules\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/administer-cluster\/securing-a-cluster\/?ref=devopscube.com#preventing-containers-from-loading-unwanted-kernel-modules\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Preventing containers from loading unwanted kernel modules<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"minimize-iam-roles\">Minimize IAM roles<\/h3>\n<p>This is to achieve the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Principle_of_least_privilege?ref=devopscube.com\" rel=\"noreferrer noopener\">principle of least privilege.<\/a><\/p>\n<p>Refer to the topic related to <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/rbac\/?ref=devopscube.com\" rel=\"noreferrer noopener\">RBAC<\/a> for role-related concepts. It is also a topic that you have learned for the CKA exam as well.<\/p>\n<p>Normally IAM is applicable for cloud implementations that integrate with kubernetes RBAC.<\/p>\n<h3 id=\"minimize-external-access-to-the-network\">Minimize external access to the network<\/h3>\n<p>Loadbalancer is a common component that allowed external access to the Kubernetes cluster.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\" style=\"width:100%; border-collapse:collapse; margin-top:12px;\">\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Loadbalancer Access Restriction\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/v1-17.docs.kubernetes.io\/docs\/tasks\/access-application-cluster\/configure-cloud-provider-firewall\/?ref=devopscube.com#restrict-access-for-loadbalancer-service\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Restrict Loadbalancer access from external networks<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"appropriately-use-kernel-hardening-tools-such-as-apparmor-seccomp\">Appropriately use kernel hardening tools such as AppArmor, seccomp<\/h3>\n<div class=\"kg-card kg-callout-card kg-callout-card-grey\">\n<div class=\"kg-callout-text\"><b><strong style=\"white-space: pre-wrap;\">AppArmor<\/strong><\/b> (&#8220;Application Armor&#8221;) is a Linux kernel security module that allows the system administrator to restrict programs&#8217; capabilities with per-program profiles.<\/div>\n<\/div>\n<p>AppArmor is part of the official CKS allowed documentation.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        AppArmor\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tutorials\/clusters\/apparmor\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Restrict a Container&#8217;s Access to Resources with AppArmor<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Seccomp\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tutorials\/clusters\/seccomp\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Restrict a Container&#8217;s Syscalls with Seccomp<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task: AppArmor\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tutorials\/clusters\/apparmor\/?ref=devopscube.com#securing-a-pod\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Securing a Pod Using AppArmor<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task: Seccomp\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/security-context\/?ref=devopscube.com#set-the-seccomp-profile-for-a-container\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Set the Seccomp Profile for a Container<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"minimize-microservice-vulnerabilities-20\">Minimize Microservice Vulnerabilities [20%]<\/h2>\n<p>As the title suggests, this section is more about service-to-service communications. You need to learn all the core concepts and Kubernetes objects involved in securing communication between pods.<\/p>\n<h3 id=\"setup-appropriate-os-level-security-domains-eg-using-psp-opa-security-contexts\">Setup appropriate OS-level security domains e.g. using PSP, OPA, Security contexts<\/h3>\n<p>PSP is getting deprecated from <a href=\"https:\/\/devopscube.com\/kubernetes-v1-21-released\/\" rel=\"noreferrer noopener\">Kubernetes version V1.21<\/a>. But it is a good topic from a learning perspective.<\/p>\n<p>PSA (Pod Security Admission) is a built in controller that ensures that the workload follows the common security best practices.<\/p>\n<p>Open Policy Agent is a great utility for implementing fine-grained controls for microservices.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        PSP\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/policy\/pod-security-policy\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Pod Security Policy<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        OPA\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/blog\/2019\/08\/06\/opa-gatekeeper-policy-and-governance-for-kubernetes\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          OPA Gatekeeper: Policy and Governance for Kubernetes<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Security Context Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/configure-pod-container\/security-context\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Configure a Security Context for a Pod or Container<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        PSA\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/security\/pod-security-admission\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Pod Security Admission<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"manage-kubernetes-secrets\">Manage Kubernetes secrets<\/h3>\n<p>Kubernetes secret is one of the ways to save sensitive information inside the pod. But, it is not encrypted. It is saved in a base64 encoded format. However, you can encrypt the data at rest.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Kubernetes Secret\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/configuration\/secret\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Kubernetes Secret Overview<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/inject-data-application\/distribute-credentials-secure\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Distribute Credentials Securely Using Secrets<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"use-container-runtime-sandboxes-in-multi-tenant-environments-eg-gvisor-kata-containers\">Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)<\/h3>\n<p><a href=\"https:\/\/katacontainers.io\/?ref=devopscube.com\" rel=\"noreferrer noopener\">Kata Containers<\/a> and <a href=\"https:\/\/github.com\/google\/gvisor?ref=devopscube.com\" rel=\"noreferrer noopener\">gVisor<\/a> helps in workload isolation. It can be implemented using the Kubernetes <code>RuntimeClass<\/code> where you can specify the required runtime for the workload.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Pod Security Standards\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/security\/pod-security-standards\/?ref=devopscube.com#what-about-sandboxed-pods\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Sandboxed Pods<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Workload Isolation\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/blog\/2018\/10\/10\/kubernetes-v1.12-introducing-runtimeclass\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Workload Isolation using gVisor and kata containers<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Task\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/containers\/runtime-class\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Create a RuntimeClass<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"implement-pod-to-pod-encryption\">Implement pod-to-pod encryption<\/h3>\n<p>You can use Cilium and Istio to implement pod-to-pod encryption by creating mTLS and configuring it for encryption.<\/p>\n<p>Istio is a service mesh that provides encryption at the application level, which is layer 7.<\/p>\n<p>Cilium is a CNI that provides encryption at the network level, which is layer 3. Also, Cilium works on layer 4, which is the transport level for Network policy.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Cilium\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/docs.cilium.io\/en\/stable?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Cilium documentation<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Istio\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/istio.io\/latest\/docs\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Istio documentation<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Generating TLS Certificate\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/tls\/managing-tls-in-a-cluster\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Manage TLS Certificates in a Cluster<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"supply-chain-security-20\">Supply Chain Security [20%]<\/h2>\n<h3 id=\"minimize-base-image-footprint\">Minimize base image footprint<\/h3>\n<p>There is no specific documentation on base image optimization on kubernetes.io. However, you can use the following blog for learning purposes.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Base Image Optimisation\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/sysdig.com\/blog\/dockerfile-best-practices\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Top 20 Dockerfile best practices<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"secure-your-supply-chain-whitelist-allowed-registries-sign-and-validate-images\">Secure your supply chain: whitelist allowed registries, sign and validate images<\/h3>\n<p>It&#8217;s important to verify the pulled base images are from valid sources. This can be achieved using <code>ImagePolicyWebhook<\/code> admission controller.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        ImagePolicyWebhook\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/reference\/access-authn-authz\/admission-controllers\/?ref=devopscube.com#imagepolicywebhook\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Using ImagePolicyWebhook Admission Controller<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"use-static-analysis-of-user-workloads-egkubernetes-resources-docker-files\">Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)<\/h3>\n<p>One of the key skills is to identify and fix security vulnerabilities and misconfigurations on the Dockerfile as well as the YAML manifests before the code is deployed to the cluster.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Static analysis of user workloads\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/blog\/2018\/07\/18\/11-ways-not-to-get-hacked\/?ref=devopscube.com#7-statically-analyse-yaml\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Statically Analyse YAML<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"scan-images-for-known-vulnerabilities\">Scan images for known vulnerabilities<\/h3>\n<p><a href=\"https:\/\/github.com\/kubernetes-sigs\/bom?ref=devopscube.com\">Bom<\/a> is the tool that is mentioned as part of the exam topics. Have knowledge about it by scanning images for vulnerabilities and creating an SBOM report from images.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        BOM\n      <\/td>\n<td style=\"border:1px solid#ddd; padding:8px;\">\n        <a href=\"https:\/\/github.com\/kubernetes-sigs\/bom?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Learn to use bom for vulnerability scanning<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"monitoring-logging-and-runtime-security-20\">Monitoring, Logging, and Runtime Security [20%]<\/h2>\n<h3 id=\"perform-behavioral-analytics-of-syscall-process-and-file-activities-at-the-host-and-container-level-to-detect-malicious-activities\">Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities<\/h3>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Syscalls with Seccomp\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tutorials\/clusters\/seccomp\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Restrict a Container&#8217;s Syscalls with Seccomp<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"detect-threats-within-a-physical-infrastructure-apps-networks-data-users-and-workloads\">Detect threats within a physical infrastructure, apps, networks, data, users, and workloads<\/h3>\n<p>Falco is the Kubernetes threat detection engine. It can alert find unexpected application behavior and alert threats on time.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Threat detection\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/falco.org\/docs\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Using Falco for threat detection<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"perform-deep-analytical-investigation-and-identification-of-bad-actors-within-the-environment\">Perform deep analytical investigation and identification of bad actors within the environment<\/h3>\n<p>Audit logging helps investigate issues in Kubernetes.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Investigation\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/debug-application-cluster\/audit\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Implementing Kubernetes Auditing<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"ensure-immutability-of-containers-at-runtime\">Ensure immutability of containers at runtime<\/h3>\n<p>You can make the pods immutable by making everything the pod uses ReadOnly. For example, read-only filesystem, configmaps, and secrets.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Immutable file system\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/concepts\/policy\/pod-security-policy\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          PSP <strong>readOnlyRootFilesystem<\/strong><br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h3 id=\"use-audit-logs-to-monitor-access\">Use Audit Logs to monitor access<\/h3>\n<p>Audit logs capture all the events associated with Kubernetes objects. The audit logs can be used by the monitoring systems to create alerts for unexpected actions.<\/p>\n<p><!--kg-card-begin: html--><\/p>\n<table class=\"auto-wrap\"\n       style=\"width:100% !important; max-width:100% !important;\n              border-collapse:collapse; margin-top:12px;\n              display:table; table-layout:fixed;\"><\/p>\n<tbody>\n<tr>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        Kubernetes Auditing\n      <\/td>\n<td style=\"border:1px solid #ddd; padding:8px;\">\n        <a href=\"https:\/\/kubernetes.io\/docs\/tasks\/debug-application-cluster\/audit\/?ref=devopscube.com\"\n           target=\"_blank\" rel=\"noreferrer noopener\"><br \/>\n          Enabling Kubernetes Auditing<br \/>\n        <\/a>\n      <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><!--kg-card-end: html--><\/p>\n<h2 id=\"kubernetes-security-books\">Kubernetes Security Books<\/h2>\n<p>Following are the Kubernetes books related to security you can use for CKS preparation.<\/p>\n<ol>\n<li><a href=\"https:\/\/devopscube.com\/recommends\/container-security\/\" rel=\"noreferrer noopener\">Container Security<\/a> by Liz Rice<\/li>\n<li><a href=\"https:\/\/devopscube.com\/recommends\/kubernetes-security\/\" rel=\"noreferrer noopener\">Kubernetes Security<\/a> by Liz Rice<\/li>\n<\/ol>\n<h2 id=\"cka-exam-faqs\">CKA Exam FAQ&#8217;s<\/h2>\n<h3 id=\"is-there-a-coupon-code-for-cks-exam-registration-in-2026\">Is there a coupon code for CKS exam registration in 2026?<\/h3>\n<p>Yes! you can use code DCUBE30 to instantly get 30% discount on CKS exam registration.<\/p>\n<h3 id=\"how-hard-is-cks-exam\">How hard is CKS exam?<\/h3>\n<p>Out of all Kubernetes certifications, CKS exam is the hardest. However, if you practice well, you can crack the exam easily. Without proper preparation and practice, you are highly likely to fail in the exam. <\/p>\n<h2 id=\"conclusion\">Conclusion<\/h2>\n<p>CKS is one of the sought-after certifications for <a href=\"https:\/\/devopscube.com\/become-devops-engineer\/\" rel=\"noreferrer noopener\">aspiring DevOps engineers.<\/a><\/p>\n<p>This is the ultimate guide to the Certified Kubernetes Security Specialist exam (CKS). I have covered the most important resources required to ace the CKS exam<\/p>\n<p>If you plan to do the CKS certification, you should not aim to pass the certification with practice exams and exam dumps.<\/p>\n<p>It would really help if you focused on learning all the core Kubernetes Security-related concepts, industry use cases, and best practices.<\/p>\n<p>I will constantly be updating this <strong>CKS exam guide<\/strong> with useful resources and tips to pass the CKS exam. Also, most of the CKS topics are covered in the <a href=\"https:\/\/devopscube.com\/learn-kubernetes-complete-roadmap\/\">Kubernetes learning<\/a> roadmap.<\/p>\n<p>Also, If you are interested in DevOps certifications, check out our comprehensive guide on the best <a href=\"https:\/\/devopscube.com\/devops-certifications\/\" rel=\"noreferrer\">devops certifications<\/a>.<\/p>\n<hr>\n<p><strong>Ngu\u1ed3n:<\/strong> <a href=\"https:\/\/devopscube.com\/cks-exam-guide-tips\/\" target=\"_blank\" rel=\"noopener noreferrer\">CKS Exam Study Guide: Tips to Pass Kubernetes Security Specialist Certification \u2014 DevOpsCube<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Source: https:\/\/devopscube.com\/cks-exam-guide-tips\/<\/p>\n","protected":false},"author":1,"featured_media":221,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=220"}],"version-history":[{"count":0,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts\/220\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/media\/221"}],"wp:attachment":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}