Security :: Tag :: Kubernetes training

CKS: Required Skills

Sat, 18 Jan 2025 14:15:26 +1000

The requirements are listed in the CKS Curriculum. Make sure to check the up-to-date version. Here is the content of version 1.34 of the Curriculum: CKS Program 10% - Cluster Setup Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi) Properly set up Ingress objects with security controls Protect node metadata and endpoints Minimize use of, and access to, GUI elements Verify platform binaries before deploying 15% - Cluster Hardening Restrict access to Kubernetes API Use Role Based Access Controls to minimize exposure Exercise caution in using service accounts, e.g. disable defaults, minimize permissions on newly created ones Update Kubernetes frequently 15% - System Hardening Minimize host OS footprint (reduce attack surface) Minimize IAM roles Minimize external access to the network Appropriately use kernel hardening tools such as AppArmor, seccomp 20% - Minimize Microservice Vulnerabilities Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts Manage Kubernetes secrets Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers) Implement pod to pod encryption by use of mTLS 20% - Supply Chain Security Minimize base image footprint Secure your supply chain: whitelist allowed registries, sign and validate images Use static analysis of user workloads (e.g. kubernetes resources, docker files) Scan images for known vulnerabilities 20% - Monitoring, Logging and Runtime Security Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities Detect threats within physical infrastructure, apps, networks, data, users and workloads Detect all phases of attack regardless of where it occurs and how it spreads Perform deep analytical investigation and identification of bad actors within environment Ensure immutability of containers at runtime Use Audit Logs to monitor access The training program is based on this curriculum.

RBAC monitoring

Thu, 06 Jun 2024 14:15:26 +1000

Exercice: find RBAC security issue Connect to Kubernetes: ktbx desk kubectx kind-kind Then use: https://github.com/alcideio/rbac-tool https://github.com/kubescape/kubescape https://github.com/corneliusweig/rakkess To find the RBAC security issue in the cluster.

NetworkPolicy

Thu, 06 Jun 2024 14:15:26 +1000

Prerequisites # Launch the toolbox ktbx desk # Check your use kind-kind context kubectx #Launch initialization script /home/k8s0/openshift-advanced/labs/3_policies/ex4-network.sh # go to correct namespace kubens network-k8s Check that 3 pods have been created. Solution kubectl get pods --show-labels NAME READY STATUS RESTARTS AGE LABELS external 1/1 Running 0 2m app=external pgsql-postgresql-0 1/1 Running 0 2m ...,tier=database webserver 1/1 Running 0 2m tier=webserver Play with network policy Look at the official documentation and at the examples

Seccomp Security Profiles

Thu, 06 Jun 2024 19:00:00 +1000

Objectives Learn how to use seccomp (secure computing mode) to restrict system calls in Kubernetes pods. Seccomp is a Linux kernel feature that limits which system calls a process can make, providing an additional security layer. Prerequisites Understanding Seccomp Seccomp is a security mechanism that filters system calls:

Audit Logs & API Server

Thu, 06 Jun 2024 15:00:00 +1000

Objectives Configure audit policies to trace modifications on critical resources and secure the API Server in a Kubernetes cluster. Prerequisites Define your cluster name: $CLUSTER_NAME="my-cluster" Q1: How to modify the API Server configuration? Answer The API Server in Kubernetes runs as a static pod managed by the kubelet. Static pods are defined by YAML manifests in the /etc/kubernetes/manifests/ directory. When you modify a static pod manifest:

Runtime Security with Falco

Thu, 06 Jun 2024 16:00:00 +1000

Objectives Use Falco to detect suspicious behaviors inside containers in real-time and learn to configure custom security rules for Kubernetes environments. Prerequisites Understanding Falco Falco is a cloud-native runtime security project that detects unexpected behavior, intrusions, and data theft in real-time. It works by monitoring system calls and Kubernetes events.

Hardening with CIS Benchmarks - Running kube-bench Jobs

Fri, 09 Jan 2026 10:00:00 +1000

Introduction to CIS Benchmarks The Center for Internet Security (CIS) provides best practices for securing Kubernetes. In this lab, we will use kube-bench, an open-source tool from Aqua Security, to check whether our cluster meets these security recommendations. Running kube-bench as a Job In a CKS exam or production environment, you often run kube-bench as a Kubernetes Job to scan nodes without SSH access.

AppArmor Security Profiles

Thu, 06 Jun 2024 16:00:00 +1000

Objectives Learn how to use AppArmor to implement mandatory access control in Kubernetes pods. AppArmor is a Linux kernel security module that confines programs to a limited set of resources through security profiles. Prerequisites Understanding AppArmor AppArmor is a security mechanism that provides path-based access control:

Hardening with CIS Benchmarks - Security Remediations

Fri, 09 Jan 2026 10:00:00 +1000

Practical CKS Exercise Workflow As a CKS candidate, you should practice the complete security hardening workflow manually. This section guides you through the key exercises step by step to remediate security issues found by kube-bench. Remove the --profiling argument for the scheduler Look for the check 1.4.1: Ensure that the –profiling argument is set to false.

Hardening with CIS Benchmarks - Automation and Continuous Compliance

Fri, 09 Jan 2026 10:00:00 +1000

Automation and Continuous Compliance Why is running kube-bench manually not enough for a production environment? Answers Configuration Drift: A manual change or update could revert security settings. New Benchmarks: CIS updates its recommendations regularly. Visibility: Security teams need centralized reporting, not just CLI logs. Suggested improvement Integrate kube-bench into a CronJob to run every week and send results to a security dashboard like Falco or a SIEM.

Helm on OpenShift: Migrating to Security Context Constraints

Mon, 08 Jun 2026 14:15:26 +1000

Objective A Helm chart that works perfectly on vanilla Kubernetes often fails on OpenShift. In this guided lab you’ll deploy a generic nginx Helm chart step by step — from its default values (which fail) to an OpenShift-compatible configuration (which succeeds) — diagnosing each failure along the way with oc/kubectl. You’ll learn: Why OpenShift’s Security Context Constraints (SCC) prevent containers from running as root How OpenShift assigns a non-root UID per namespace, and why that breaks images that assume root How to adapt a chart (here, the official nginx image) to run under restricted-v2 Complete this lab in 20-30 minutes.