Certified Kubernetes Security Specialist (CKS)

• https://github.com/cncf/curriculum/blob/master/CKS_Curriculum_%20v1.23.pdf

Cluster Setup 10%

• Use Network security policies (kind: NetworkPolicy) to restrict cluster level access
• Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
• Properly set up Ingress with TLS
• Protect node metadata and endpoints
• Verify platform binaries before deploying

Cluster Hardening 15%

• Use Role Based Access Controls to minimize exposure
• Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
• Restrict access to Kubernetes API
• Upgrade Kubernetes to avoid vulnerabilities

System Hardening 15%

• Minimize host OS footprint (reduce attack surface)
• Using least-privilege identity and access management
• Minimize external access to the network
• Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities 20%

• Use appropriate pod security standards
• Manage Kubernetes secrets
• Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
• Implement Pod-to-Pod encryption (Cilium, Istio)

Supply Chain Security 20%

• Minimize base image footprint
• Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
• Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
• Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

Monitoring, Logging and Runtime Security 20%

• Perform behavioral analytics to detect malicious activities
• Detect threats within physical infrastructure, apps, networks, data, users and workloads
• Investigate and identify phases of attack and bad actors within the environment
• Ensure immutability of containers at runtime
• Use Kubernetes audit logs to monitor access

Related

• AWS Certified Security - Specialty
• CKA
• Kubernetes Pod Security Admission
• K8s security

See also

• CKA: v1.33: API, Namespace, Pods, secrets, Services, deployments, nodes, Volumes, Ingress, CKS, Services & Networking
• Certified Kubernetes Security Specialist (CKS)
• Kubernetes security, OPA, EKS security, PSA, PSS, CKS, SecurityContext, containerSecurityContext, Trivy, KubeBench, Kubernetes Admission Controllers admissionregistration.k8s.io, Hardeneks, Gatekeeper (Kubernetes), kubernetes.io/enforce-mountable-secrets, Auditing, security context, readOnlyRootFilesystem, allowPrivilegeEscalation, kube-bench