Pass the CKS — Kubernetes security on v1.35
Short, dense lessons and verifiable exercises across the six CKS domains: cluster setup, cluster hardening, system hardening, microservice vulnerabilities, supply chain, and runtime security. Written for somebody who already holds CKA and CKAD — the Kubernetes primitives are assumed, the security tooling is not.
- 2 hexam duration
- 67 %passing score
- 28lessons
- 26exercises
- 2mock exams
Lessons
The CKS exam, and how it differs from CKA and CKAD
15/15/10/20/20/20, 2 hours, 67 %, Kubernetes 1.35 — plus the six things that actually cost people the exam.
NetworkPolicy: default deny, then the one path you need
The single most repeated task in the exam — including the AND/OR selector trap and the 169.254.169.254 metadata rule.
Protecting node metadata and endpoints
The IMDS credential path, the kubelet read-only port, and why blocking one IP is often the whole task.
CIS benchmark with kube-bench: run it, then actually fix it
Read the FAIL list, map each one to an exact API server / kubelet / etcd flag, re-run until clean.
Ingress with TLS termination
Certificate, typed Secret, Ingress with spec.tls — the five-minute version, plus the annotations the exam likes.
Verifying platform binaries before you deploy them
SHA-256 against dl.k8s.io, GPG for packages, cosign for images — and how to spot a tampered file fast.
RBAC: give exactly the verbs asked for
Role, ClusterRole, bindings, can-i — plus the two shapes the exam uses: a namespaced Role for a user, and a ClusterRole bound by a RoleBinding.
Service accounts: stop mounting tokens nobody uses
automountServiceAccountToken in both places, projected tokens with audience and expiry, and removing the cluster-admin binding.
Restricting access to the API server
NodeRestriction, anonymous auth, insecure port, admission plugins — and repairing an API server you broke.
Upgrading Kubernetes without breaking it
Version skew, the exact kubeadm order, and the certificate question hidden inside an upgrade task.
Minimising the host: services, packages, ports
Disable what nobody needs, close what should not listen, and keep sysctls inside the namespaced set.
AppArmor: write the profile, load it, attach it
Profile authoring, apparmor_parser on the right node, and the field that replaced the annotation in 1.30.
seccomp: syscall filtering with profiles that actually load
RuntimeDefault vs Localhost vs Unconfined, a custom JSON profile, and where the kubelet expects to find it.
securityContext: the hardening ladder
runAsNonRoot, allowPrivilegeEscalation, capabilities, readOnlyRootFilesystem — and which image breaks when you add each.
Pod Security Admission: labels, levels, and the manifest that gets rejected
PSA replaced PSP. The three levels, the four labels, the exact restricted checklist, and how to read a rejection.
Secrets: types, consumption, and encryption at rest
Where Secrets actually live, the EncryptionConfiguration, and the etcdctl command that proves it worked.
OPA Gatekeeper: a policy that survives review
ConstraintTemplate in Rego, the Constraint that instantiates it, and the three policies the exam actually uses.
Sandboxed runtimes: gVisor, Kata, RuntimeClass
A second kernel between the container and the host — the RuntimeClass object, the containerd config, and how to prove the sandbox is real.
Pod-to-Pod encryption: Istio, Cilium, and no mesh at all
STRICT mTLS in three commands with Istio, WireGuard with Cilium, and what to answer when neither is installed.
Minimising the base image footprint
Distroless, multi-stage builds, layer count, and pinning by digest — the four changes a Dockerfile task asks for.
SBOM, signing, and registry allow-listing
Knowing what is in your image (SBOM), proving where it came from (cosign), and enforcing it at admission.
Static analysis: kubesec, kube-linter, hadolint
Read a manifest's risk score before it runs — and what each tool actually complains about.
Scanning images with Trivy and acting on it
Scan every running Pod, rank by severity, and fix or remove the ones the task names.
Audit logging: policy, static pod, proof
The most repeated task in every CKS corpus. Levels, first-match-wins, the hostPath mounts, and reading the log back.
Falco: rules, overrides, and output channels
Runtime detection from the syscall stream — rule anatomy, the .local.yaml override, and how to prove an alert fires.
Container immutability at runtime
Read-only root filesystem done properly, distroless images, and triage of the Pods that violate it.
Runtime forensics: what is that process doing?
strace, sysdig, /proc, and the attack phases the exam words its questions around.
The closing checklist: what to do in the last ten minutes
A one-page sweep over everything the marker looks at, and the habits that turn knowledge into marks.
Exercises
Exercise: deny everything, then open one port
Namespace `prod`, a default-deny policy, and exactly one allowed flow. 6 minutes.
Exercise: the AND/OR selector trap
Two policies that look identical and behave differently. 7 minutes.
Exercise: block the cloud metadata endpoint
Deny 169.254.169.254 for every Pod, keep DNS and everything else. 5 minutes.
Exercise: kube-bench, then fix two controls
Run the CIS benchmark on the control plane, fix anonymous auth and profiling, prove PASS. 10 minutes.
Exercise: Ingress with TLS in four commands
Self-signed certificate, typed secret, working HTTPS on a named host. 6 minutes.
Exercise: find the tampered binary
Three binaries, one checksum file each, one lies. 5 minutes.
Exercise: a user who can read logs and nothing else
Role, RoleBinding, and a can-i proof that the denial is real. 7 minutes.
Exercise: stop the token from being mounted
automountServiceAccountToken in both places, then prove there is no token file. 6 minutes.
Exercise: harden the API server and survive it
NodeRestriction, anonymous auth off, then read a failure out of crictl. 12 minutes.
Exercise: cordon, drain, upgrade a kubelet
The node-level half of an upgrade, without touching the control plane. 10 minutes.
Exercise: a profile that blocks writes to /tmp
Author, load on the right node, attach through the 1.30+ field, prove it. 12 minutes.
Exercise: block mkdir with a seccomp profile
Custom JSON in the kubelet seccomp root, attached at container level. 10 minutes.
Exercise: harden a running Deployment
Non-root, no escalation, all caps dropped, read-only root, seccomp — without a CrashLoop. 10 minutes.
Exercise: restricted PSA, and why one Pod is rejected
Label a namespace, predict the rejection, then make the Pod compliant. 9 minutes.
Exercise: encrypt Secrets at rest and prove it
EncryptionConfiguration, static pod mounts, re-save the secrets, read etcd. 15 minutes.
Exercise: a Gatekeeper policy that requires a label
ConstraintTemplate in Rego, Constraint, and a rejected Pod. 15 minutes.
Exercise: run a Pod in a sandboxed runtime
RuntimeClass + gVisor + a proof that the kernel is not the host's. 12 minutes.
Exercise: STRICT mTLS in the namespace
Istio if present; if not, say so and do certificate-based mTLS. 10 minutes.
Exercise: find and remove the vulnerable workload
Scan every running image, then delete the offender — the right object, not the Pod. 12 minutes.
Exercise: SBOM and a signature you can verify
Generate an SBOM, sign the image, verify it, and prove a tampered tag fails. 12 minutes.
Exercise: registry allow-list through ImagePolicyWebhook
The admission plugin almost nobody practises: config, kubeconfig, flags, denial. 20 minutes.
Exercise: fix the manifest the linter rejects
kube-linter and kubesec, then the five fields that make both happy. 8 minutes.
Exercise: audit logging, from policy to proof
The single most repeated CKS task. Policy, mounts, restart, query. 15 minutes.
Exercise: override a Falco rule and prove the alert
Copy the whole rule into the local file, change the output, trigger it. 10 minutes.
Exercise: make the workload immutable without killing it
readOnlyRootFilesystem plus exactly the writable mounts the app needs. 8 minutes.
Exercise: find what the compromised Pod is doing
Resolve the container PID on the node, trace the syscalls, name the behaviour. 12 minutes.
Mock exams
Seventeen tasks, 102 points, 68 to pass, two hours on the clock — the real exam's arithmetic. The questions are on the paper's page; the answers live on their own page, so you sit the paper first and only then turn it over.
Mock paper A — the six domains in order
17 tasks, 102 points, 68 to pass, two hours. The papers follow the curriculum order, so you can see which domain drains your time.
Mock paper B — mixed and timed
17 tasks, 102 points, 68 to pass, two hours. Node-level and API-level work interleaved, the way the real exam does it.