Linux Foundation Certified Kubernetes Security Specialist

A fresh cluster ships with defaults that favor convenience. You audit it against the CIS benchmark, fix what fails, put TLS on Ingress, verify the binaries you install, and close off pod access to node and cloud metadata.

• Auditing a cluster with kube-bench
• Fixing findings on the API server, kubelet and etcd
• Default-deny network policies for every namespace
• TLS termination on Ingress
• Blocking pod access to cloud metadata endpoints
• Verifying Kubernetes binaries with checksums

You build An audit report from before and after hardening, with every failed check fixed or explained.

The API server is the front door to everything. You limit who can reach it, strip excess rights from roles and service accounts, switch off defaults that expose it, and keep the cluster patched against known flaws.

• Disabling anonymous access and unneeded API server flags
• Restricting who can reach the API server
• Tightening RBAC: wildcards, escalate and bind rights
• Service accounts without automounted tokens
• Kubelet authentication and authorization
• Upgrading to remove known vulnerabilities

You build A reviewed set of roles and API server settings with excess permissions removed and tested.

A node is a Linux machine, and a container escape lands on it. You shrink the host to what Kubernetes needs, apply least privilege to users and services, and confine processes with AppArmor and seccomp.

• Removing unneeded packages, services and kernel modules
• Least-privilege users and SSH settings
• Limiting host network access with a firewall
• AppArmor profiles for containers
• seccomp profiles and the syscalls a workload needs
• Checking open ports and running processes on a node

You build A hardened node, plus an AppArmor and a seccomp profile applied to a running workload.

Most container escapes begin with a pod that asked for too much. You enforce the Pod Security Standards per namespace, set SecurityContexts that remove privilege, and decide what a pod may mount, run as and reach on the host.

• Privileged, baseline and restricted profiles
• Enforcing, auditing and warning with namespace labels
• SecurityContext: non-root, capabilities, privilege escalation
• Host namespaces, hostPath and why they are dangerous
• Read-only root filesystems and writable volumes
• Admission policies that go beyond the built-in standards

You build Namespaces enforcing the restricted profile, with workloads fixed to run under it.

Secrets are only base64 by default, and anyone who can read etcd can read them. You limit access to Secrets, encrypt them at rest with an encryption configuration, and weigh external secret stores.

• What a Secret stores and who can read it
• Mounting secrets as files rather than environment variables
• Encrypting Secrets in etcd with an encryption configuration
• Rotating keys and re-encrypting existing data
• External secret managers and their trade-offs
• Finding secrets that leaked into images and manifests

You build A cluster that stores Secrets encrypted, with a demonstration that raw etcd data is unreadable.

Some workloads cannot be trusted with the shared kernel, and some traffic cannot cross the network in the clear. You run risky pods in sandboxes chosen by runtime class, and encrypt pod-to-pod traffic with Cilium or Istio.

• Why containers share a kernel and what that risks
• Sandboxes: gVisor and Kata Containers
• Selecting a sandbox with RuntimeClass
• Encrypting pod traffic with Cilium
• Mutual TLS between services with Istio
• Choosing between the two for a given cluster

You build An untrusted workload running in a sandbox, with all its traffic encrypted and verified in transit.

Every package in an image is attack surface, and every dependency is a trust decision. You build small images, pin and verify what you pull, produce a software bill of materials, and sign what you ship.

• Minimal base images and multi-stage builds
• Dockerfile practices that reduce risk
• Pinning images by digest
• Private registries and image pull policy
• Software bills of materials for an image
• Signing and verifying artifacts with Cosign
• Allowing only trusted registries through admission

You build A build that produces a minimal image with its SBOM and signature, and a policy rejecting unsigned images.

Catch problems before a workload runs. You scan images with Trivy, check manifests and Dockerfiles for risky settings, and decide which findings block a release and which can be accepted with a recorded reason.

• Scanning images for known vulnerabilities with Trivy
• Reading severity, fixed versions and false positives
• Linting manifests for risky settings
• Linting Dockerfiles
• Scanning in CI and in the cluster
• Deciding what blocks a release

You build A scan-and-lint gate in a build pipeline that fails on the findings you chose to forbid.

Prevention fails eventually. You watch system calls with Falco, write rules that describe malicious behavior, recognize the phases of an attack inside a container, and respond to what the alerts show.

• System calls as the signal for container behavior
• Installing Falco and reading its alerts
• Writing and tuning Falco rules
• Spotting a shell, a download or a miner in a pod
• The phases of an attack: foothold, escalation, movement
• Investigating a suspicious pod with strace and logs
• Responding: isolate, preserve, remove

You build A rule set that alerts on shell access, file tampering and unexpected network calls, tested with simulated attacks.

Containers should not change after they start, and every access to the API should leave a record. You enforce immutability with read-only filesystems and write audit policies that capture who did what without drowning in noise.

• Immutable containers and read-only root filesystems
• Detecting and blocking changes at runtime
• Audit policy levels and rules
• Configuring audit log files and webhooks on the API server
• Searching audit logs for a user or a resource
• Tuning policy to keep the signal

You build An audit policy that records secret access and exec into pods, with queries that answer who and when.

Take an insecure cluster through a full hardening pass, then attack it as an intruder would and see what your controls stop and what they miss. Finish by closing the gaps and writing the decisions down.

• Auditing a cluster and ordering the fixes
• Applying hardening across API, nodes, pods and images
• Attacking your own cluster from a compromised pod
• Detecting the attack in logs and runtime alerts
• Closing the gaps you found
• Writing a security review for the cluster owner

You build A hardened cluster with an attack log, its detections and a written security review.