This repository is a collection of resources to prepare for the Certified Kubernetes Security Specialist (CKSS) exam.
The given references and links below are just assumptions and ideas around the CKSS curriculum.
The Kubernetes Security Specialist (CKS) certification ensure that the holder has the skills, knowledge, and competence on a broad range of best practices for securing container-based applications and Kubernetes platforms during build, deployment and runtime.
The certification is generally available to take from here as anounced during the KubeCon NA20
The CKS test will be online, proctored and performance-based with 15-20 hands-on performance based tasks, and candidates have 2 hours to complete the exam tasks.
From the CKS Exam Curriculum repository, The exam will test domains and competencies including:
- Cluster Setup (10%): Best practice configuration to control the environment's access, rights and platform conformity.
- Cluster Hardening (15%): Protecting K8s API and utilize RBAC.
- System Hardening (15%): Improve the security of OS & Network; restrict access through IAM
- Minimize Microservice Vulnerabilities (20%): Utilizing on K8s various mechanisms to isolate, protect and control workload.
- Supply Chain Security (20%): Container oriented security, trusted resources, optimized container images, CVE scanning.
- Monitoring, Logging, and Runtime Security (20%): Analyse and detect threads.
In order to take the CKS exam, you must have Valid CKA certification prior to attempting the CKS exam to demonstrate you possess sufficient Kubernetes expertise. A first good starting point for securing Kubernetes is the Task section Securing a Cluster of the official K8s documentation. The exam will be based on Kubernetes v1.19 documentation as of November general availability announcement.
According to the LF docs, during the CKS exam the candidates may:
-
review the Exam content instructions that are presented in the command line terminal.
-
review Documents installed by the distribution (i.e. /usr/share and its subdirectories)
-
use their Chrome or Chromium browser to open one additional tab in order to access
-
Kubernetes Documentation:
- https://kubernetes.io/docs/ and their subdomains
- https://github.com/kubernetes/ and their subdomains
- https://kubernetes.io/blog/ and their subdomains
This includes all available language translations of these pages (e.g. https://kubernetes.io/zh/docs/)
-
Tools:
- Trivy documentation https://github.com/aquasecurity/trivy
- Sysdig documentation https://docs.sysdig.com/
- Falco documentation https://falco.org/docs/
-
App Armor:
The allowed sites above may contain links that point to external sites. It is the responsibility of the candidate not to click any links to navigate to a domain that is not allowed
-
Use Network security policies to restrict cluster level access
Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
- CIS benchmark for Kubernetes
- The benchmark is not yet available for
Kubernetes 1.19, but it gives great understanding.
- The benchmark is not yet available for
- What is Center for Internet Security (CIS) Benchmarks
- Kube-bench: A tool for running Kubernetes CIS Benchmark tests
- GKE: CIS Benchmarks for etcd & kubelet
Properly set up Ingress objects with security control
Protect node metadata and endpoints
Minimize use of, and access to, GUI elements
Restrict access to Kubernetes API
Use Role Based Access Controls to minimize exposure
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
Minimize host OS footprint (reduce attack surface)
Minimize IAM roles
Minimize external access to the network
Appropriately use kernel hardening tools such as AppArmor, seccomp
Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts
Manage kubernetes secrets
Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
Implement pod to pod encryption by use of mTLS
Minimize base image footprint
Secure your supply chain: whitelist allowed image registries, sign and validate images
Use static analysis of user workloads (e.g. kubernetes resources, docker files)
Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
Detect threats within physical infrastructure, apps, networks, data, users and workloads
Detect all phases of attack regardless where it occurs and how it spreads
- Investigating Kubernetes attack scenarios in Threat Stack
- Anatomy of a Kubernetes attack – How untrusted Docker images fails us
- Investigating Kubernetes Attack Scenarios in Threat Stack (part 1)
- The seven phases of a cyber attack
- Threat matrix for Kubernetes
- MITRE ATT&CK framework for container runtime security with Falco
- Mitigating Kubernetes attacks
Perform deep analytical investigation and identification of bad actors within environment
Ensure immutability of containers at runtime
Use Audit Logs to monitor access
- Kubernetes Security Essentials (LFS260)
- Cloud Native Security Tutorial
- Killer Shell CKS Simulator
- Sysdig Kubernetes Security Guide
- Kubernetes Security Best Practices - Ian Lewis, Google
- Kubernetes security concepts and demos
- Tutorial: Getting Started With Cloud Native Security - Liz Rice, Aqua Security & Michael Hausenblas
- 11 Ways (Not) to Get Hacked
- Kubernetes Goat
- Kubernetes CTF on vagrant environment
- Udemy Kubernetes CKS 2020 Complete Course and killer.sh Simulator
- NSA/CISA Kubernetes Hardening Guidance 08/2021
- LIVING DOCUMENT - I WILL UPDATE IT FREQUENTLY WHEN I HAVE NEW INFORMATIONS
- PRs are always welcome so star, fork and contribute
- please make a pull request if you would like to add or update
Ibrahim Jelliti © 2020