/Certified-Kubernetes-Security-Specialist

Curated resources help you prepare for the CNCF/Linux Foundation CKS 2021 "Kubernetes Certified Security Specialist" Certification exam. Please provide feedback or requests by raising issues, or making a pull request. All feedback for improvements are welcome. thank you.

Primary LanguageAGS ScriptCreative Commons Attribution Share Alike 4.0 InternationalCC-BY-SA-4.0

License: CC BY-SA 4.0 PRs Welcome

Certified Kubernetes Security Specialist - CKS

Online curated resources that will help you prepare for taking the Kubernetes Certified Kubernetes Security Specialist CKS Certification exam.

  • Please raise an issue, or make a pull request for fixes, new additions, or updates.

Resources are primarly cross referenced back to the allowed CKS sites during the exam as per CNCF/Linux Foundation exam allowed search rules. Videos and other third party resources e.g. blogs will be provided as an optional complimentary material and any 3rd party material not allowed in the exam will be designated with 🚩 in the curriculum sections below.

Ensure you have the right version of Kubernetes documentation selected (e.g. v1.21 as of 19 October 2021) especially for API objects and annotations, however for third party tools, you might find that you can still find references for them in old releases and blogs e.g. Falco install.

  • Icons/emoji legend
    • πŸ“‹ Expand to see more content
    • πŸ˜• Verify, not best resource yet
    • πŸ”΅ Good overall refence, can be used in the exam
    • 🚩 External third-party resource, can not be used during exam
    • πŸ“ To-do, item that needs further checking(todo list for future research/commits)

Exam Brief

Offical exam objectives you review and understand in order to pass the test.

  • Duration : two (2) hours

  • Number of questions: 15-20 hands-on performance based tasks

  • Passing score: 67%

  • Certification validity: two (2) years

  • Prerequisite: valid CKA

  • Cost: $375 USD, One (1) year exam eligibility, with a free retake within the year.

    Linux Foundation offer several discounts around the year e.g. CyberMonday, Kubecon attendees among other special holidays/events

URLs allowed in the extra single tab

This includes all available language translations of these pages (e.g. https://kubernetes.io/zh/docs)

CKS repo topics overview

Extra helpful material


Cluster Setup - 10%

πŸ”΅ Securing a Cluster

  1. Use Network security policies to restrict cluster level access

  2. 🚩 Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

    • 🚩 Kube-bench - Checks whether Kubernetes is deployed securely by running the checks documented ain the CIS Kubernetes Benchmark.
  3. Properly set up Ingress objects with security control

  4. Protect node metadata and endpoints

    Using Kubernetes network policy to restrict pods access to cloud metadata
    • This example assumes AWS cloud, and metadata IP address is 169.254.169.254 should be blocked while all other external addresses are not.
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: deny-only-cloud-metadata-access
    spec:
      podSelector: {}
      policyTypes:
      - Egress
      egress:
      - to:
        - ipBlock:
          cidr: 0.0.0.0/0
          except:
          - 169.254.169.254/32
  5. Minimize use of, and access to, GUI elements

  6. Verify platform binaries before deploying

    πŸ“‹ Kubernetes binaries can be verified by their digest **sha512 hash**
    • Checking the Kubernetes release page for the specific release
    • Checking the change log for the images and their digests

Cluster Hardening - 15%

  1. Restrict access to Kubernetes API
  1. Use Role-Based Access Controls to minimize exposure

  2. Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

    πŸ“‹ Opt out of automounting API credentials for a service account

    Opt out at service account scope

    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: build-robot
    automountServiceAccountToken: false

    Opt out at pod scope

    apiVersion: v1
    kind: Pod
    metadata:
      name: cks-pod
    spec:
      serviceAccountName: default
      automountServiceAccountToken: false
  3. Update Kubernetes frequently

System Hardening - 15%

  1. Minimize host OS footprint (reduce attack surface)

    πŸ“‹ πŸ˜• Reduce host attack surface
  2. Minimize IAM roles

  3. Minimize external access to the network

    πŸ“‹ πŸ˜• if it means deny external traffic to outside the cluster?!!
    • not tested, however, the thinking is that all pods can talk to all pods in all name spaces but not to the outside of the cluster!!!
    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: deny-external-egress
    spec:
      podSelector: {}
      policyTypes:
      - Egress
      egress:
        to:
        - namespaceSelector: {}
  4. Appropriately use kernel hardening tools such as AppArmor, seccomp

Minimize Microservice Vulnerabilities - 20%

  1. Setup appropriate OS-level security domains e.g. using PSP, OPA, security contexts
  2. Manage kubernetes secrets
  3. Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
  4. Implement pod to pod encryption by use of mTLS
  • πŸ“ check if service mesh is part of the CKS exam

Supply Chain Security - 20%

  1. Minimize base image footprint

    πŸ“‹ Minimize base Image
  2. Secure your supply chain: whitelist allowed image registries, sign and validate images

  1. Use static analysis of user workloads (e.g. kubernetes resources, docker files)
  2. Scan images for known vulnerabilities

Monitoring, Logging and Runtime Security - 20%

  1. Perform behavioural analytics of syscall process and file activities at the host and container level to detect malicious activities

  2. Detect threats within a physical infrastructure, apps, networks, data, users and workloads

  3. Detect all phases of attack regardless where it occurs and how it spreads

    πŸ“‹ Attack Phases
  4. Perform deep analytical investigation and identification of bad actors within the environment

  5. Ensure immutability of containers at runtime

  6. Use Audit Logs to monitor access


Extra helpful material

Slack

  1. Kubernetes Community - #cks-exam-prep
  2. Kubernauts Community - #cks
  3. Saiyam's Pathak OpenSource Discord #CKS channel

Twitch

  1. KubeNativeSecurity twitch stream Talk Shows & Podcasts

Books

  1. Aqua Security Liz Rice:Free Container Security Book
  2. Learn Kubernetes security: Securely orchestrate, scale, and manage your microservices in Kubernetes deployments
  3. Let's Learn CKS Scenarios

Youtube Videos

  1. Google/Ian Lewis: Kubernetes security best practices
  2. Code in Action for the book Learn Kubernetes Security playlist
  3. Kubernetes security concepts and demos

Containers and Kubernetes Security Training

  1. Killer.sh CKS practice exam - use code walidshaari for 20% discount.
  2. UDEMY Kim WΓΌstkamp's Kubernetes CKS 2021 Complete Course with killer.sh Simulator (discounted price)
  3. Linux Foundation Kubernetes Security essentials LFS 260
  4. Mumshad's KodeCloud "Certified Kubernetes Security Specialist" CKS and training and labs
  5. Linux Academy/ACloudGuru Kubernetes security
  6. Zeal Vora's Udemy Certified Kubernetes Security Specialist 2021 - Link includes a discount till 28th January 2021
  7. Cloud native security defending containers and kubernetes
  8. Tutorial: Getting Started With Cloud-Native Security - Liz Rice, Aqua Security & Michael Hausenblas
  9. K21 academy CKS step by step activity hands-on-lab activity guide
  10. Andrew Martin Control Plane Security training
  11. Free Exam simulators from killer.sh available with CKS certification from Linux Foundation

Other CKS related repos

  1. Stackrox CKS study guide - Brief and informative study guide from Stackrox @mfosterrox
  2. Kim's CKS Challenge series - also posted on medium @ https://wuestkamp.medium.com/
  3. Abdennour
  4. Ibrahim Jelliti
  5. Viktor Vedmich
  6. Kubernetes Security Checklist and Requirements