Goals

• Gain a strong foundation in Kubernetes Security,
• Pass the "Certified Kubernetes Security Specialist" certification

Program

Introduction

• Introduction to the Course
• Course Lecture Format
• Document - Link to Code Repository

Domain 1 - Cluster Setup

• Overview of CIS Benchmarks for Hardening
• Kubernetes CIS Benchmarks
• Our Lab Architecture
• Document Lecture
• ETCD Security Guidelines
• Configuring ETCD Binaries
• Understanding Asymmetric Key Encryption
• Revising SSL/TLS
• Overview of Certificate Authority
• In-Transit Encryption with HTTPS
• Overview of Certificate Based Authentication
• Client Authentication in ETCD
• API Server Security Guidelines
• Data Encryption at ETCD
• Overview of Encryption Providers
• Transpot Security for API Server
• Integration with systemd
• Access Control
• Downsides of Static Token Authentication
• Implementing X509 Client Authentication
• Downsides of X509 Client Authentication
• Overview of OIDC Authentication
• RBAC Authorization
• Implementing Auditing
• Setting up kubeadm cluster
• Revising Taints and Tolerations
• Kubelet Security
• Verifying Platform Binaries
• Notes - Cluster Setup

Domain 2 - Cluster Hardening

• Creating User for RBAC
• Role Based Access Controls (RBAC)
• ClusterRole and ClusterRoleBinding
• Revising Ingress
• Understanding Ingress Resource and Ingress Controllers
• Creating Ingress and Ingress Controller
• Ingress Security
• Overview of Service Accounts
• Service Account Security
• Upgrading kudeadm Clusters
• Notes - Cluster Hardening

Domain 3 - Minimize Microservice Vulnerabilities

• Admission Controllers
• Security Contexts
• Revising Privileged Container
• Running Privileged PODS in Kubernetes
• Hack Misconfigured Cluster
• Overview of POD Security Policies
• Understanding Pod Security Policy Workflow
• Implementing Restrictive Policy
• PSP Security Consideration - Volumes
• PSP Security Considerations - Host PID
• POD Security Policy and Controllers
• ImagePullPolicy in Kubernetes
• Admission Controller - AlwaysPullImages
• Admission Controller - ImagePolicyWebhook
• Custom WebHook Integration with Admission Controller
• Overview of Kubernetes Secrets
• Mounting Secrets in Pods
• Notes - Minimize Microservice Vulnerabilities

Domain 4 - System Hardening

• Overview of AppArmor
• Integration of AppArmor with Kubernetes
• OCI and Container Runtimes
• Configuring containerd and runc
• Container Runtime Interface
• Overview of Container Runtime Sandboxes
• Implementing RunTimeClass - gVisor
• Kubeadm and Calcio
• Understanding Network Policies - Part 01
• Understanding Network Policies - Part 02
• Notes - System Hardening

Domain 5 - Supply Chain Security

• Vulnerability, Exploit and Payload
• Container Security Scanning
• Scan images for known vulnerabilities
• Scanning K8s Clusters for Security Best Practices
• Overview of Static Analysis
• Notes - Supply Chain Security

Domain 6 - Monitoring, Logging and Runtime Security

• Overview of Falco
• Introduction to Sysdig
• Creating Custom Falco Rules
• Falco Rule Writing - Exam Perspective
• Audit Logging In-Detail
• Immutability at Container Runtime
• Notes - Monitoring, Logging and Runtime Security

Exam Preparation Section

• Overview of CKS Exams
• Important Pointers for Exams - Part 01
• Important Pointers for Exams - Part 02
• Notes - Exam Preparation Section
• Exam Preparation Practice Tests
• Practice Test Solution - Part 01
• Practice Test Solution - Part 02
• Practice Test Solution - Part 03
• Practice Test Solution - Part 04

Avis

Vatsal Balde The course was really great for explaining the intricate concepts of security aspects of kubernetes. I have become an admirer of zeal vora that if a course is available from him for a particular certification,I can go ahead with taking up the exam confidently

Travis Vela Everything was explained with such great detail. I learned a lot from this course and would highly recommend it to anyone looking to learn the skills necessary to pass the CKS.

Vidhya s One of the best course for CKS, learnt many new concepts in Kubernetes Security and this course has been prepared with an equal amount of importance given to learning these concepts and also preparing for the certification and exam preparation section helped me a lot in getting enough practice required for me to clear the certification, Thanks a lot Zeal for the amazing content!!