Lessons
One lesson per exam domain: the essentials, the commands, and what to check.
The CKS exam, and how it differs from CKA and CKAD
15/15/10/20/20/20, 2 hours, 67 %, Kubernetes 1.35 — plus the six things that actually cost people the exam.
NetworkPolicy: default deny, then the one path you need
The single most repeated task in the exam — including the AND/OR selector trap and the 169.254.169.254 metadata rule.
Protecting node metadata and endpoints
The IMDS credential path, the kubelet read-only port, and why blocking one IP is often the whole task.
CIS benchmark with kube-bench: run it, then actually fix it
Read the FAIL list, map each one to an exact API server / kubelet / etcd flag, re-run until clean.
Ingress with TLS termination
Certificate, typed Secret, Ingress with spec.tls — the five-minute version, plus the annotations the exam likes.
Verifying platform binaries before you deploy them
SHA-256 against dl.k8s.io, GPG for packages, cosign for images — and how to spot a tampered file fast.
RBAC: give exactly the verbs asked for
Role, ClusterRole, bindings, can-i — plus the two shapes the exam uses: a namespaced Role for a user, and a ClusterRole bound by a RoleBinding.
Service accounts: stop mounting tokens nobody uses
automountServiceAccountToken in both places, projected tokens with audience and expiry, and removing the cluster-admin binding.
Restricting access to the API server
NodeRestriction, anonymous auth, insecure port, admission plugins — and repairing an API server you broke.
Upgrading Kubernetes without breaking it
Version skew, the exact kubeadm order, and the certificate question hidden inside an upgrade task.
Minimising the host: services, packages, ports
Disable what nobody needs, close what should not listen, and keep sysctls inside the namespaced set.
AppArmor: write the profile, load it, attach it
Profile authoring, apparmor_parser on the right node, and the field that replaced the annotation in 1.30.
seccomp: syscall filtering with profiles that actually load
RuntimeDefault vs Localhost vs Unconfined, a custom JSON profile, and where the kubelet expects to find it.
securityContext: the hardening ladder
runAsNonRoot, allowPrivilegeEscalation, capabilities, readOnlyRootFilesystem — and which image breaks when you add each.
Pod Security Admission: labels, levels, and the manifest that gets rejected
PSA replaced PSP. The three levels, the four labels, the exact restricted checklist, and how to read a rejection.
Secrets: types, consumption, and encryption at rest
Where Secrets actually live, the EncryptionConfiguration, and the etcdctl command that proves it worked.
OPA Gatekeeper: a policy that survives review
ConstraintTemplate in Rego, the Constraint that instantiates it, and the three policies the exam actually uses.
Sandboxed runtimes: gVisor, Kata, RuntimeClass
A second kernel between the container and the host — the RuntimeClass object, the containerd config, and how to prove the sandbox is real.
Pod-to-Pod encryption: Istio, Cilium, and no mesh at all
STRICT mTLS in three commands with Istio, WireGuard with Cilium, and what to answer when neither is installed.
Minimising the base image footprint
Distroless, multi-stage builds, layer count, and pinning by digest — the four changes a Dockerfile task asks for.
SBOM, signing, and registry allow-listing
Knowing what is in your image (SBOM), proving where it came from (cosign), and enforcing it at admission.
Static analysis: kubesec, kube-linter, hadolint
Read a manifest's risk score before it runs — and what each tool actually complains about.
Scanning images with Trivy and acting on it
Scan every running Pod, rank by severity, and fix or remove the ones the task names.
Audit logging: policy, static pod, proof
The most repeated task in every CKS corpus. Levels, first-match-wins, the hostPath mounts, and reading the log back.
Falco: rules, overrides, and output channels
Runtime detection from the syscall stream — rule anatomy, the .local.yaml override, and how to prove an alert fires.
Container immutability at runtime
Read-only root filesystem done properly, distroless images, and triage of the Pods that violate it.
Runtime forensics: what is that process doing?
strace, sysdig, /proc, and the attack phases the exam words its questions around.
The closing checklist: what to do in the last ten minutes
A one-page sweep over everything the marker looks at, and the habits that turn knowledge into marks.