CKS training

Two-day training to prepare the Certified Kubernetes Security Specialist (CKS) exam.

Info

Holding the CKA certification is required to sit the CKS exam.

Slides

Labs by module

1. Cluster setup (15%)

Network policies, CIS benchmark, Ingress with TLS, node metadata protection, binary verification.

NetworkPolicy
Hardening with CIS Benchmarks - Running kube-bench Jobs
Hardening with CIS Benchmarks - Security Remediations
Hardening with CIS Benchmarks - Automation and Continuous Compliance
Ingress controller demo (D_01_Ingress slides): nginx-controller-example

2. Cluster hardening (15%)

RBAC, service accounts, API access restriction, Kubernetes upgrades.

Kubectl proxy and curl
RBAC
RBAC monitoring
Kubernetes Service Account Token Lab
RBAC exercise 2, ClusterRole on PersistentVolumes (E_02 slides): solution
Upgrade with kubeadm (E_01 slides): instructions

3. System hardening (10%)

Host OS footprint, least-privilege IAM, external network access, kernel hardening tools (AppArmor, seccomp).

4. Minimize microservice vulnerabilities (20%)

Pod Security Standards, secrets management, isolation techniques (multi-tenancy, sandboxed containers), pod-to-pod encryption (Cilium, Istio).

Security context (E_03 slides): script
Pod Security Admission (E_03 slides): script
RuntimeClass with gVisor: demo in CKS slides

5. Supply chain security (20%)

Base image footprint, SBOM and artifact repositories, permitted registries, artifact signing and validation, static analysis (Kubesec, KubeLinter).

Trivy: Container Vulnerability Scanning, including SBOM generation
Cosign: Container Image Signing & Verification

6. Monitoring, logging and runtime security (20%)

Behavioral analytics, threat detection and investigation, container immutability, Kubernetes audit logs.

Other labs of the training

Cluster internals

Computational resources and FinOps

Requests, limits, quotas and LimitRanges (E_04 slides): scripts
Horizontal Pod Autoscaling (HPA)
Vertical Pod Autoscaling (VPA)

Exam preparation