Kubernetes CKS (Addenda: Extras) Exam Survival Guide

Window: Global | Security deep dive

Must-do topics

• Image security: signing (cosign), scanning, registry policies
• Runtime monitoring: Falco, auditd, Sysdig rules, OPA Gatekeeper
• Secrets mgmt: KMS, sealed-secrets, external vault integration
• Advanced netpols: egress restrictions, namespace scoping, default deny all
• Incident response: forensic basics (cordon, isolate, copy logs, dump mem)

Top traps (avoid)

• Treating sealed-secrets as encrypted; they’re controller-managed
• Forgetting egress rules → pods talk out freely
• Audit policy mis-scoped → logs flood or miss critical events
• Not cleaning up compromised pod artifacts

Quick facts

• PodSecurity Admission replaces PodSecurityPolicies
• OPA Gatekeeper enforces custom constraints with CRDs
• Sealed-secrets allow storing encrypted secrets in Git safely

Speed tactics

• Always apply least privilege in RBAC + seccomp
• For Qs, map to hardening layer: build → deploy → runtime