Certified Kubernetes Security Specialist - CKS

Online curated resources that will help you prepare for taking the Kubernetes Certified Kubernetes Security Specialist CKS Certification exam.

Please raise an issue, or make a pull request for fixes, new additions, or updates.

Resources are primarly cross referenced back to the allowed CKS sites during the exam as per CNCF/Linux Foundation exam allowed search rules. Videos and other third party resources e.g. blogs will be provided as an optional complimentary material and any 3rd party material not allowed in the exam will be designated with 🚩 in the curriculum sections below.

Ensure you have the right version of Kubernetes documentation selected (e.g. v1.21 as of 19 October 2021) especially for API objects and annotations, however for third party tools, you might find that you can still find references for them in old releases and blogs e.g. Falco install.

Icons/emoji legend
- 📋 Expand to see more content
- 😕 Verify, not best resource yet
- 🔵 Good overall refence, can be used in the exam
- 🚩 External third-party resource, can not be used during exam
- 📝 To-do, item that needs further checking(todo list for future research/commits)

Exam Brief

Offical exam objectives you review and understand in order to pass the test.

CNCF Exam Curriculum repository

Duration : two (2) hours
Number of questions: 15-20 hands-on performance based tasks
Passing score: 67%
Certification validity: two (2) years
Prerequisite: valid CKA
Cost: $375 USD, One (1) year exam eligibility, with a free retake within the year.

Linux Foundation offer several discounts around the year e.g. CyberMonday, Kubecon attendees among other special holidays/events

URLs allowed in the extra single tab

From Chrome or Chromium browser to open one additional tab in order to access Kubernetes Documentation:
- https://kubernetes.io/docs and their subdomains
- https://github.com/kubernetes and their subdomains
- https://kubernetes.io/blog and their subdomains

This includes all available language translations of these pages (e.g. https://kubernetes.io/zh/docs)

Tools:

CKS repo topics overview

Cluster Setup - 10%
Cluster Hardening - 15%
System Hardening - 15%
Minimize Microservice Vulnerabilities - 20%
Supply Chain Security - 20%
Monitoring, Logging and Runtime Security - 20%

Extra helpful material

Cluster Setup - 10%

🔵 Securing a Cluster

Use Network security policies to restrict cluster level access
🚩 Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
- 🚩 Kube-bench - Checks whether Kubernetes is deployed securely by running the checks documented ain the CIS Kubernetes Benchmark.
Properly set up Ingress objects with security control

Protect node metadata and endpoints

Using Kubernetes network policy to restrict pods access to cloud metadata

This example assumes AWS cloud, and metadata IP address is 169.254.169.254 should be blocked while all other external addresses are not.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-only-cloud-metadata-access
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
      cidr: 0.0.0.0/0
      except:
      - 169.254.169.254/32

Minimize use of, and access to, GUI elements
Verify platform binaries before deploying
📋 Kubernetes binaries can be verified by their digest **sha512 hash**
- Checking the Kubernetes release page for the specific release
- Checking the change log for the images and their digests

Cluster Hardening - 15%

Restrict access to Kubernetes API

Use Role-Based Access Controls to minimize exposure
- 🚩 Handy site collects together articles, tools and the official documentation all in one place
- 🚩 Simplify Kubernetes Resource Access Control using RBAC Impersonation

Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

📋 Opt out of automounting API credentials for a service account

Opt out at service account scope

apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-robot
automountServiceAccountToken: false

Opt out at pod scope

apiVersion: v1
kind: Pod
metadata:
  name: cks-pod
spec:
  serviceAccountName: default
  automountServiceAccountToken: false

Update Kubernetes frequently

System Hardening - 15%

Minimize host OS footprint (reduce attack surface)
📋 😕 Reduce host attack surface
- seccomp which stands for secure computing was originally intended as a means of safely running untrusted compute-bound programs
- AppArmor can be configured for any application to reduce its potential host attack surface and provide greater in-depth defense.
- PSP enforces
- Apply host updates
- Install minimal required OS fingerprint
- Protect access to data with permissions
  - Restirct allowed hostpaths
Minimize IAM roles
- 😕 Access authentication and authorization
Minimize external access to the network
📋 😕 if it means deny external traffic to outside the cluster?!!
- not tested, however, the thinking is that all pods can talk to all pods in all name spaces but not to the outside of the cluster!!!
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-external-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
    to:
    - namespaceSelector: {}
```
Appropriately use kernel hardening tools such as AppArmor, seccomp
- AppArmor
- Seccomp

Minimize Microservice Vulnerabilities - 20%

Setup appropriate OS-level security domains e.g. using PSP, OPA, security contexts
Manage kubernetes secrets
Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
Implement pod to pod encryption by use of mTLS

📝 check if service mesh is part of the CKS exam

Supply Chain Security - 20%

Minimize base image footprint
📋 Minimize base Image
- Use distroless, UBI minimal, Alpine, or relavent to your app nodejs, python but the minimal build.
- Do not include uncessary software not required for container during runtime e.g build tools and utilities, troubleshooting and debug binaries.
  - 🚩 Learnk8s: 3 simple tricks for smaller Docker images
  - 🚩 GKE 7 best practices for building containers
Secure your supply chain: whitelist allowed image registries, sign and validate images