Ultimate Certified Kubernetes Security Specialist (CKS) Preparation Guide - V1.31 (2025)

Hit the Star! :star:

If you are planning to use this repo for reference, please hit the star. Thanks!

CKS Exam Overview

The Certified Kubernetes Security Specialist (CKS) exam has a duration of 2 hours. To pass the exam, candidates need to achieve a score of at least 66%. The exam will be on Kubernetes version 1.31. Once the certificate is earned, the CKS certification remains valid for 2 years. The cost to take the exam is $395 USD.

CKS Exam Coupon (30% Off Exclusive Discount)

CKA Price Update: The CKS exam price will increase to $435 in January 2025. Take advantage of the current discount and complete the exam within 12 months to maximize your savings.

To save on CKS exam registration, use the following coupon code.

Coupon: Use code DCUBE30 at kube.promo/cks

Table of Contents

1. Cluster Setup (15%)

   • Use Network security policies to restrict cluster level access
   • Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
   • Properly set up Ingress with TLS
   • Protect node metadata and endpoints
   • Verify platform binaries before deploying

2. Cluster Hardening (15%)

   • Use Role Based Access Controls to minimize exposure
   • Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
   • Restrict access to Kubernetes API
   • Upgrade Kubernetes to avoid vulnerabilities

3. System Hardening (10%)

   • Minimize host OS footprint (reduce attack surface)
   • Using least-privilege identity and access management
   • Minimize external access to the network
   • Appropriately use kernel hardening tools such as AppArmor, seccomp

4. Minimize Microservice Vulnerabilities (20%)

   • Use appropriate pod security standards
   • Manage Kubernetes secrets
   • Understand and implement isolation techniques (multi-tenancy, sandboxed containers, etc.)
   • Implement Pod-to-Pod encryption using Cilium

5. Supply Chain Security (20%)

   • Minimize base image footprint
   • Understand your supply chain (e.g. SBOM, CI/CD, artifact repositories)
   • Secure your supply chain (permitted registries, sign and validate artifacts, etc.)
   • Perform static analysis of user workloads and container images (e.g. Kubesec, KubeLinter)

6. Monitoring, Logging and Runtime Security (20%)

   • Perform behavioral analytics to detect malicious activities
   • Detect threats within physical infrastructure, apps, networks, data, users and workloads
   • Investigate and identify phases of attack and bad actors within the environment
   • Ensure immutability of containers at runtime
   • Use Kubernetes audit logs to monitor access

CKS Exam Detailed Study Guide & References

CKS Certification Exam has the following key domains:

1. Cluster Setup (15%)

Following are the subtopics under Cluster Setup

Restrict Pod to Pod communication using Network Policy

Network Policy : Understand the restriction of the Pod to Pod communication.

# Create a Deny all Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Protecting Metadata Server access to the cloud provider Kubernetes cluster using Network Policy

Network Policy : Understand the IP Block parameter in the Network Policy.

# Create a Network Policy with the IP Block
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: metadata-network-policy
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32

CIS Benchmark to analyze the cluster components

CIS Benchmark : Analyze the cluster components using CIS Benchmark tool Kube Bench.

# CIS Benchmark Best Practices
./kube-bench --config-dir /root/cfg --config /root/cfg/config.yaml

# Analyze the benchmark of specific check
./kube-bench --config-dir /root/cfg --config /root/cfg/config.yaml --check 1.4.1

Secure the Ingress with TLS

Ingress : Creating an Ingress object with the TLS termination.

# Create a TLS Certificate & Key
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt

# Create a TLS secret with Certificate & Key
kubectl -n tls create secret tls tls-secret --cert=tls.crt --key=tls.key

# Create Ingress object with TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
  namespace: tls
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
	tls:
  - hosts:
      - dev.techiescamp.com
    secretName: tls-secret
  rules:
  - host: dev.techiescamp.com
    http:
      paths:
      - path: /frontend
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 80
      - path: /backend
        pathType: Prefix
        backend:
          service:
            name: backend
            port:
              number: 80

Verify Kubernetes Platform Binaries before deploying

# Check the current version of the Kubernetes component
kubectl --version

# Check the current binary hash value
sha512sum $(which kubectl)

# Download the cluster component
wget https://dl.k8s.io/v1.31.0/kubernetes-server-linux-amd64.tar.gz

# Extract the package
tar -xvf kubernetes-server-linux-amd64.tar.gz

# Verify the Platform Binaries using Hash
sha512sum kubernetes/server/bin/kubelet

2. Cluster Hardening (15%)

RBAC, Certificate & Certificate Signing Request

Certificates and Certificate Signing Request : Create and issue a certificate for user

# Create private key
openssl genrsa -out myuser.key 2048
openssl req -new -key myuser.key -out myuser.csr -subj "/CN=myuser"

# Create Certificate Signing Request (CSR)
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: 
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400  # one day
  usages:
  - client auth

# Copy base64 encoded CSR file content
cat myuser.csr | base64 | tr -d "\n"

# Paste the content to `spec.request`
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: <base64 encoded csr content>
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400  # one day
  usages:
  - client auth

# Apply the CSR manifest
kubectl apply -f csr.yaml

# Get the list of CSR
kubectl get csr

# Approve the CSR
kubectl certificate approve myuser

# Export the certificate
kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.crt

# Create Role
kubectl create role developer --verb=create --verb=get --verb=list --verb=update --verb=delete --resource=pods

# Create Role Binding
kubectl create rolebinding developer-binding-myuser --role=developer --user=myuser

# Test the role to the user
kubectl auth can-i delete pods --as myuser
kubectl auth can-i delete deployments --as myuser

# Add new credentials
kubectl config set-credentials myuser --client-key=myuser.key --client-certificate=myuser.crt --embed-certs=true

# Add context
kubectl config set-context myuser --cluster=kubernetes --user=myuser

# List contexts
kubectl config get-context

# Change context
kubectl config use-context myuser

Role Based Access Control

Bind RBAC with Service Account : Understand the Role Based Access Control Authorization to Service Accounts

# Create SA
kubectl create sa app-sa

# Create Cluster Role
kubectl create clusterrole app-cr --verb list --resource pods

# Create Role Binding
kubectl create rolebinding app-rb --clusterrole app-cr --serviceaccount default:app-sa

# List Role Binding
kubectl get rolebinding

# Describe Role Binding
kubectl describe rolebinding app-rb

# Check the access
kubectl auth can-i list pods --as system:serviceaccount:default:app-sa

# Create a Pod with the Service Account
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: app-sa
  name: app-sa
spec:
  serviceAccountName: app-sa
  containers:
  - image: nginx
    name: app-sa
    ports:
    - containerPort: 80

Service Account Token Automount

Service Account : Disable the automounting of the Service Account Token.

# Disable Service Account Token Automounting
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: app-sa
  name: app-sa
spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: false
  containers:
  - image: nginx
    name: app-sa
    ports:
    - containerPort: 80

Disable the Service Account Token Automount at the Service Account level

# Create a new Service Account or edit an existing Service Account
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  name: default
  namespace: two

# To check the automouting after the Pod deployment
k exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

Upgrade Kubernetes clusters.

[Perform Cluster Version upgrade Using Kubeadm](https://techiescamp.com/courses/certified-kubernetes-administrator-course/lectures