Certified Kubernetes Security Specialist (CKS) Reference Materials

Official Kubernetes security concepts - the primary reference for the CKS exam. Practice navigating it efficiently.

Baseline, Restricted, and Privileged policies enforced by Pod Security Admission. Heavily tested on the CKS exam.

Restrict traffic between pods and namespaces. Learn default-deny patterns and ingress/egress rules.

Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings for least-privilege access control.

Configure audit policies and audit backends to record requests to the API server.

Apply AppArmor profiles to restrict what workloads can do at the host OS level.

Use seccomp profiles (RuntimeDefault and Localhost) to limit container syscalls.

Quick reference for kubectl commands. Essential for exam efficiency - memorize key shortcuts.

Consensus security configuration guidance for Kubernetes. The basis for kube-bench checks.

Scan container images, filesystems, and Kubernetes manifests for vulnerabilities and misconfigurations.

Sign, verify, and attest container images with Cosign for supply chain integrity.

Runtime security monitoring and threat detection using kernel-level syscall rules.

Enforce custom admission policies with Open Policy Agent Gatekeeper constraint templates.

Run workloads in a sandboxed container runtime that adds an isolation boundary between pods and the host kernel.

Implement pod-to-pod mutual TLS, authentication, and authorization with a service mesh.

Official CNCF exam objectives and domain weights. Know exactly what's covered on the exam.

Exam policies, technical requirements, and testing environment details. Read before scheduling the exam.

Run CIS Kubernetes Benchmark checks against kubelet, etcd, kube-apiserver, and control plane configs.

Free interactive browser-based Kubernetes security labs specifically designed for CKS preparation.

Cloud native security whitepapers, guidance, and best practices from the CNCF Security Technical Advisory Group.