Kubernetes CKS Course Notes

NetworkPolicy is a Kubernetes API policy object that describes allowed Layer 3/4 traffic for selected Pods; actual enforcement depends on a compatible network plugin. The CIS Kubernetes Benchmark provides hardening recommendations for Kubernetes components. CKS expects you to interpret findings and verify the real component configuration rather than memorize a single score. Ingress defines HTTP/HTTPS routing, but an Ingress resource does nothing without an Ingress controller. Nodes expose powerful management surfaces. Protecting kubelet and node metadata means strong authentication, authorization, encrypted transport, restricted network reachability, and least-privilege RBAC. Binary integrity is a supply-chain control at cluster setup time. Download from an expected source, obtain verification data from a trusted source, verify before execution, and choose a version compatible with the cluster.

• Use Network security policies to restrict cluster level access: Assuming deny policies override allow policies

• Use Network security policies to restrict cluster level access: Start by asking: which Pods are selected, for which direction, and is the peer expressed correctly?

RBAC is the primary Kubernetes authorization model for mapping identities to API permissions. CKS expects you to reason about the exact verbs, resources, namespaces, and binding scope that produce effective access. ServiceAccounts are workload identities. The secure design is one appropriately scoped identity per trust boundary, no unnecessary API credential mount, and short-lived bound tokens when API access is needed. Kubernetes API access is a chain: secure transport, authenticate the caller, authorize the action, and then apply admission controls to write requests. Protecting only one layer does not secure the API. Security maintenance includes running supported Kubernetes versions and applying security fixes without breaking version-skew rules.

• Use Role Based Access Controls to minimize exposure: Saying ClusterRole always grants cluster-wide access

• Use Role Based Access Controls to minimize exposure: Write the minimum rule, then test effective permissions.

Kubernetes inherits the security posture of its nodes. A minimal, patched, tightly administered host reduces the number of packages, services, credentials, and listening endpoints an attacker can abuse after reaching a node. Least privilege applies below and around Kubernetes as well as inside RBAC. Host accounts, cloud IAM roles, SSH keys, metadata credentials, and automation identities should receive only the capabilities needed for their function. Reduce the number of externally reachable paths into and out of the cluster. Use the narrowest Service type, firewall/security-group rules, private management endpoints, NetworkPolicy, and controlled egress that meet the application requirement. Kernel hardening limits what a compromised process can do even when it is running inside a container. Seccomp filters syscalls; AppArmor/SELinux apply mandatory access-control policy; Linux capabilities split root privileges into narrower units.

• Minimize host OS footprint: Keeping compilers and daemons for convenience

• Minimize host OS footprint: Inventory installed packages, services, ports, and privileged users.

Pod Security Standards define three cumulative policy profiles: Privileged, Baseline, and Restricted. Pod Security Admission (PSA) enforces or reports these standards through namespace labels. Kubernetes Secrets are sensitive API objects, not an automatic vault. Base64 encoding is not encryption; cluster operators must protect etcd/storage, API/RBAC access, workload delivery, logs, backups, and the credential lifecycle. Namespaces are organizational and authorization scopes, not complete tenant security boundaries. Strong multitenancy layers RBAC, Pod Security, NetworkPolicy, quotas, cluster-scoped resource restrictions, and sometimes node/runtime isolation. Pod-to-Pod encryption protects traffic on the network. The current CKS outline explicitly calls out technologies such as Istio and Cilium, but they solve the problem differently: service-mesh mTLS provides workload identity plus encryption, while Cilium can provide transparent node/workload traffic encryption with WireGuard or IPsec.

• Use appropriate pod security standards: Weakening enforce profile just to get a warning

• Use appropriate pod security standards: Know the namespace-label syntax from memory.

A minimal production image contains the application and required runtime dependencies, not the full build environment. Fewer packages and utilities mean fewer attack primitives and fewer components that can carry vulnerabilities. Understanding the supply chain means knowing how source becomes an artifact and which systems, identities, parameters, dependencies, and repositories can alter that result. A secure supply chain verifies exact content and its expected producer/policy before deployment. Registry authentication, signatures, attestations, digest pinning, vulnerability scanning, and admission policy are complementary controls. Static analysis examines source/configuration/artifacts without running the workload. For CKS, the key is not merely generating findings but enforcing organization policy on the effective manifest that will actually be deployed.

• Minimize base image footprint: Adding a scanner to the runtime image instead of removing build tools

• Minimize base image footprint: Build in one stage, run in another.

Behavioral analytics detects deviations from expected workload behavior using runtime telemetry such as processes, syscalls, files, network connections, privileges, and container identity. Threat detection in Kubernetes is multi-layered. A signed, Restricted, vulnerability-free image can still behave maliciously at runtime; strong detection correlates identity/API events with workload, host, network, and data behavior. CKS expects you to interpret Kubernetes/container evidence as an attack sequence, not merely list alerts. MITRE ATT&CK container tactics provide useful vocabulary for discovery, credential access, execution, persistence, lateral movement, collection, exfiltration, and impact. Runtime immutability means production containers should not depend on modifying their image-backed root filesystem or installing new software after start. Use immutable image references and read-only root filesystems, with narrowly scoped writable volumes for legitimate state. Kubernetes auditing records security-relevant API activity according to an audit policy and sends events to configured log/webhook backends. If no audit policy file is configured, no audit events are logged.

• Perform behavioral analytics to detect malicious activities: Treating normal CPU as proof of safety

• Perform behavioral analytics to detect malicious activities: Ask “what is normal for this workload?” before labeling the event.