CKS Tests Hardening a Live Cluster Under the Clock — Not Security Theory
CKS is a hands-on, two-hour lab of 15–20 tasks for CKA holders. The grader checks only final files, flags and objects, so make the smallest correct change, back up manifests and verify every result.
Check Your Readiness →Most candidates understand Certified Kubernetes Security Specialist (CKS) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Sixty percent of the score sits in workload, supply chain and runtime tasks. Each task names a host and namespace; work there exactly. Editing static Pod manifests in /etc/kubernetes/manifests is routine, and one YAML error takes the API server down.
An ingress rule denying the metadata IP
Metadata is reached outbound, so write an Egress policy selecting all Pods with ipBlock 0.0.0.0/0 and except 169.254.169.254/32. Remember any egress default-deny elsewhere also blocks DNS on port 53.
Set automountServiceAccountToken false on the default ServiceAccount
Set automountServiceAccountToken: false in web's Pod template spec, which overrides the account setting without affecting neighbours. Existing Pods keep their tokens until the rollout recreates them.
Scan the image tags listed in the manifest files on disk
Read images from the running Pods with kubectl get pods -o jsonpath, then run trivy image --severity CRITICAL on each. Delete only the failing Pods; removing compliant ones fails grading.
Enable the plugin and keep the default admission config
Set defaultAllow: false so the control fails closed, add ImagePolicyWebhook to --enable-admission-plugins, point --admission-control-config-file at the config, and mount that directory plus the backend kubeconfig into the API server Pod.
The first provider in EncryptionConfiguration encrypts writes, so aescbc must precede identity. Mount the file into the kube-apiserver static Pod, then rewrite old Secrets with kubectl get secrets -A -o json | kubectl replace -f - and confirm k8s:enc in etcdctl.
Restricted needs runAsNonRoot true, allowPrivilegeEscalation false, capabilities drop ALL and seccompProfile RuntimeDefault or Localhost. Rejections surface in ReplicaSet events, not kubectl apply output, and the Deployment template must carry the fix.
Map the container ID with crictl inspect, find the owning Deployment, and run kubectl scale --replicas=0. Deleting the Pod only lets its ReplicaSet start a replacement, and the grader sees the workload still running.
Audit rules are first-match. Put specific rules, such as Secrets at Metadata, above the default. Logging Secrets at Request or RequestResponse writes their values into the log. Add hostPath mounts for the policy file and log directory.
Localhost seccomp paths are relative to /var/lib/kubelet/seccomp, e.g. profiles/restrict.json. AppArmor Localhost uses the profile name declared inside the file, loaded with apparmor_parser on every node the Pod can land on.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
CKS is graded on final cluster state under time pressure. Find your slowest task type.