Kubernetes CKS (Security Specialist) Exam Survival Guide

Window: Global | Hands-on | 2 hrs | ~15–20 tasks

Must-do topics

• Cluster hardening: minimal base images, CIS controls, upgrade posture
• System hardening: RBAC least privilege, API server flags, admission control (PSA/OPA/Gatekeeper)
• Workload security: PSP legacy vs Pod Security Admission, seccomp/AppArmor, readOnlyRootFS, capabilities
• Supply chain: image signing/verification, private registries, scanning (Trivy/Anchore)
• Runtime: NetworkPolicies, secrets mgmt, audit logs, Falco-style detection
• Troubleshooting & incident response: forensics basics, node/pod compromise steps

Top traps (avoid)

• Forgetting namespace with -n; applying RBAC in wrong scope
• Leaving containers privileged or with broad capabilities
• Missing NetworkPolicies (default allow) → pod-to-pod wide open
• Confusing image pull secrets vs k8s Secrets mounted as files/env
• Neglecting audit policy and log locations

Time split

• ~6–8 min/task; save YAML; verify quickly; move on

Last-48h checklist

• Create RBAC Roles/Bindings from scratch; test access
• PodSecurity (baseline/restricted) labels and violations
• Sample NetworkPolicies: default deny, allow to DNS, allow namespace app
• Quick scripts for image scan, secret creation, and kubectl auth can-i

Quick facts

• Default network is permissive; NetworkPolicies restrict at L3/L4
• Use securityContext for user, capabilities, read-only FS
• Secrets are base64-encoded, not encrypted at rest unless KMS/enc enabled
• Admission controllers enforce org policy pre-create/update

Speed tactics

• Start each task: namespace + resource kind → create minimal YAML
• Use kubectl explain to recall fields; copy known templates
• Validate with auth can-i, get events, and a quick connectivity test pod

Day-of mini-plan

• Warm-up: 1 RBAC role, 1 NetPol, 1 restricted pod
• Keep aliases (k=kubectl), and a snippets file ready
• Don’t perfect—secure enough per task spec, then proceed