CKS Self-Study Course
These self-study modules contain all of the topics outlined in the CNCF CKS Exam Curriculum. If you are not already familiar with the curriculum, take a moment to familiarize yourself as you will need to demonstrate knowledge of each topic in order to pass the CKS exam.
Module 1 - Cluster Setup
- Using Network Security Policies to restrict cluster level access
- Use CIS benchmark to review the security configuration of Kubernetes components
- Properly set up Ingress objects with security control
- Protect Node Metadata and endpoint
- Minimize the use of, and access to GUI elements
- Verifying platform binaries before deploying
- Practice Drill
Module 2 - Cluster Hardening
- Restrict access to Kubernetes API
- Use Role Based Access Controls to minimize exposure
- Exercise caution in using service accounts
- Update Kubernetes frequently
- Practice Drill
Module 3 - System Hardening
- Minimize Host OS Footprint
- Minimize IAM roles
- Minimize external access to the network
- Appropriately use kernel hardening tools such as AppArmor, seccomp
- Practice Drill
Module 4 - Minimize Microservice Vulnerabilities
- Setup appropriate OS-level security domains
- Managing Kubernetes Secrets
- Use Container Runtime Sandboxes in Multi-tenant environments
- Implement pod-to-pod encryption by use of mTLS
- Practice Drill
Module 5 - Supply Chain Security
- Minimize Base Image Footprint
- Secure Supply Chain: Allowing image registries, sign and validate images
- Use Static Analysis of User Workloads
- Scan Images for Known Vulnerabilities
- Practice Drill
Module 6 - Monitoring, Logging, and Runtime Security
- Perform behavior analytics of syscall process and file activities at the host and container level to detect malicious activities
- Detect threats within the physical infrastructure, apps, networks, data, users, and workloads
- Detect all phases of attack regardless of where it occurs and how it spreads
- Perform deep analytical investigation and identification of bad actors within an environment
- Ensure immutability of containers at runtime
- Use Audit Logs to monitor access
- Practice Drill