Certified Kubernetes Security Specialist - CKS

Online curated resources that will help you prepare for taking the Kubernetes Certified Kubernetes Security Specialist CKS Certification exam.

• Please raise an issue, or make a pull request for fixes, new additions, or updates.

Ensure you have the right version of Kubernetes documentation selected (e.g. v1.26 as of January 2023) especially for API objects and annotations, however for third party tools, you might find that you can still find references for them in old releases and blogs e.g. Falco install.

• Icons/emoji legend

Exam Brief

Offical exam objectives you review and understand in order to pass the test.

• CNCF Exam Curriculum repository

• Duration : two (2) hours
• Number of questions: 15-20 hands-on performance based tasks
• Passing score: 67%
• Certification validity: two (2) years
• Prerequisite: valid CKA
• Cost: $375 USD, One (1) year exam eligibility, with a free retake within the year.

URLs to prepare for the exam:

This includes all available language translations of these pages (e.g. https://kubernetes.io/zh/docs) - Tools: - Trivy documentation - Falco documentation - App Armor documentation

Exam interface

• A remote desktop configured with the tools and software needed to complete the tasks
• Candidates can start the “Take Exam” Process 30 minutes prior to their scheduled date/time (currently 15mins on PSI ExamsLocal platform)
• Self check-in: no need to wait for a proctor in order to upload your ID and scan your environment
• The exam will now be taken using the PSI Secure Browser, which can be downloaded using the newest versions of Microsoft Edge, Safari, Chrome, or Firefox
• Multiple monitors will no longer be permitted
• Use of personal bookmarks will no longer be permitted (Personal browser bookmarks such as bookmarked links to YAML files will not be accessible within the PSI Secure Browser)

• A timer that displays the actual time remaining (in minutes) and provides an alert with 30, 15, or 5 minute remaining
• The content panel remains the same (presented on the Left Hand Side of the ExamUI)

CKS repo topics overview

- [X] Cluster Setup - 10% - [X] Cluster Hardening - 15% - [X] System Hardening - 15% - [X] Minimize Microservice Vulnerabilities - 20% - [X] Supply Chain Security - 20% - [X] Monitoring, Logging and Runtime Security - 20%

#### Extra helpful material

- [x] Slack - [x] Books - [x] Youtube Videos - [x] Webinars - [x] Containers and Kubernetes Security Training - [x] Extra Kubernetes security resources

Cluster Setup - 10%

• Use Network security policies to restrict cluster level access
• :triangularflagonpost: Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)

apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: deny-only-cloud-metadata-access
      spec:
        podSelector: {}
        policyTypes:
        - Egress
        egress:
        - to:
          - ipBlock:
            cidr: 0.0.0.0/0
            except:
            - 169.254.169.254/32

apiVersion: v1    kind: ServiceAccount    metadata:      name: build-robot    automountServiceAccountToken: false

apiVersion: v1    kind: Pod    metadata:      name: cks-pod    spec:      serviceAccountName: default      automountServiceAccountToken: false

apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: deny-external-egress
   spec:
     podSelector: {}
     policyTypes:
     - Egress
     egress:
       to:
       - namespaceSelector: {}