CKS quick review

Memory hook: Selector finds endpoints; policy permits the path.

Must remember

Pods communicate using cluster networking supplied by the CNI. A Service gives stable discovery for a changing set of endpoints. Check labels/selectors, target ports and EndpointSlices when traffic reaches the Service but no application responds.

Ingress describes HTTP/S routing, but needs an Ingress controller. TLS certificates normally come from referenced Secrets; matching host/path and backend port matters. Gateway API separates infrastructure ownership (GatewayClass/controller), listeners (Gateway) and application routing (HTTPRoute). Inspect parent references, allowed routes, listener hostnames and cross-namespace ReferenceGrants where needed. Gateway resources also require an implementation.

CoreDNS resolves service names such as api.team.svc.cluster.local, with the actual cluster domain configurable. Test name resolution separately from network reachability. Check namespace search suffixes, CoreDNS Pods/Service, resolv.conf and DNS egress policy before blaming application code.

Gateway routing drill: inspect kubectl get gateway,httproute -n team -o yaml, then trace parentRefs to the listener and backendRefs to the Service. An HTTPRoute backend port is the Service port, not an arbitrary container port. Check host/path matching and the controller's status conditions before testing a request with the intended Host header. A route that exists but never attaches to its Gateway cannot deliver the requested traffic.

NetworkPolicy is enforced only by supporting networking implementations. Policies are additive allow lists. Once a Pod is isolated for ingress or egress, applicable allowed traffic must be specified; when both ends are isolated, both source egress and destination ingress must permit the connection. An empty selector selects all Pods in that namespace. Namespace and Pod selectors in the same peer entry are AND; separate entries are alternatives.

Practical drill: draw client → DNS → Service → endpoint → container. For each arrow, identify one read-only command and one possible configuration fault.

Choose under exam pressure

Traps

• Creating a LoadBalancer Service does not guarantee a load-balancer implementation exists.
• Default-deny egress can also block DNS.

Practise this topic

Memory hook: API decides; controllers reconcile; nodes execute.

Must remember

The API server validates requests and exposes cluster state; etcd persists it. The scheduler assigns unscheduled Pods to nodes; controllers reconcile desired state. Node kubelets supervise Pods through a CRI runtime; CNI provides networking and CSI storage integration.

Before kubeadm installation, verify hostnames, addresses, time, ports, container runtime/cgroups and the version-specific swap requirements. kubeadm init creates a control plane; join information adds nodes. A highly available control plane needs multiple control-plane instances, a stable API endpoint/load balancer and a quorum-safe etcd design. A load balancer alone does not replicate etcd.

Upgrade deliberately: inspect version compatibility and kubeadm's upgrade plan, upgrade control-plane nodes in the documented order, then workers. Drain a node before disruptive maintenance, accounting for PodDisruptionBudgets and local data, and uncordon afterward. Do not force a blocked drain without understanding which workload guarantee it protects. Back up etcd and practise version-appropriate recovery in a sandbox.

RBAC grants verbs on API resources. A Role is namespaced; a ClusterRole can describe broader permissions. A RoleBinding can reference a ClusterRole while granting its namespaced permissions only in the binding's namespace. A ClusterRoleBinding grants cluster-wide scope. Bind users, groups or service accounts; inspect with kubectl auth can-i using the required identity/context.

RBAC permissions are additive: there is no ordinary RBAC deny rule to cancel another grant. Core resources use apiGroups: [""]; Deployments use apps; Pod logs are the separate pods/log subresource. Test the precise verb, resource and namespace, for example kubectl auth can-i get pods --as=system:serviceaccount:team:reader -n team. Impersonation itself requires permission; testing as the administrator does not prove the workload identity can perform the operation.

Helm templates and packages charts into releases with values; inspect rendered manifests, release history and upgrades. Kustomize transforms base YAML with overlays and patches without template substitution; inspect kubectl kustomize PATH. A CRD adds an API kind; an operator includes a controller that acts on custom resources. Installing a CRD alone does not implement reconciliation.

Practical drill: explain the path from an authenticated Deployment request to running containers, naming which component handles each step.

Choose under exam pressure

Traps

• Namespaces do not by themselves enforce network isolation.
• Deleting or editing etcd data is not an ordinary application troubleshooting step.

Practise this topic

Memory hook: Close unnecessary paths before trusting the workload.

Must remember

Restrict API-server, kubelet and etcd access to intended clients. Authenticate and authorize control-plane operations; protect certificates, kubeconfigs and encryption keys. A public IP is not the only exposure: a compromised Pod may reach internal administrative endpoints or node metadata if paths are unrestricted.

Use the appropriate CIS benchmark and a tool such as kube-bench to review settings, then understand each finding before changing it. Benchmark versions and managed-provider responsibilities matter. A control marked manual or not applicable is not automatically a failure; document the rationale and verify the real risk.

Protect cloud instance metadata through provider-supported mechanisms and workload network controls. Prefer workload-scoped identity over inheriting broad node privileges. NetworkPolicy enforcement depends on the CNI, and host-network/metadata paths require explicit platform analysis. Test permitted and denied flows, including DNS and required control-plane access.

Ingress TLS needs a matching host/certificate, protected private key and a controller that actually terminates or passes through TLS as intended. TLS at the edge does not automatically encrypt every backend hop. Verify downloaded platform binaries using trusted checksums/signatures from authenticated distribution sources, not a checksum fetched from the same untrusted mirror.

Patch through supported upgrades with compatibility checks, backups and controlled disruption. Hardening that breaks quorum or locks out authorized recovery can reduce availability without delivering the intended security benefit.

Choose under exam pressure

Traps

• A passed benchmark is not proof against every attack.
• An edge HTTPS padlock says nothing about all internal hops.

Practise this topic

Memory hook: Remove privileges, reduce syscalls, constrain filesystem access.

Must remember

Minimize host packages, daemons, remote access and unnecessary network listeners. Patch the OS/runtime, protect SSH/admin access and audit changes. Containers share a host kernel in ordinary runtimes; container isolation is not automatically a VM boundary.

Linux capabilities divide some root privileges. Drop unneeded capabilities and add only a demonstrated requirement. allowPrivilegeEscalation: false limits gaining more privilege through supported mechanisms; privileged containers and host namespace/mount access greatly expand exposure. A read-only root filesystem reduces writable paths but applications still need explicitly provided writable locations.

seccomp filters system calls. AppArmor applies mandatory access-control profiles to supported processes/resources. They address different layers and require supported node configuration. Start from an appropriate runtime/default profile and refine with evidence; denying a required syscall can break a legitimate application.

For current APIs, locate securityContext.seccompProfile and securityContext.appArmorProfile. RuntimeDefault selects the relevant runtime profile; Localhost refers to a profile already available on the node. A seccomp localhost profile is a path relative to the kubelet's seccomp directory; an AppArmor localhost profile names a loaded profile. Confirm support on every eligible node: a valid YAML field does not install the required host profile.

Run as a suitable non-root UID/GID, constrain filesystem permissions and use runtime isolation such as a supported sandbox/RuntimeClass when the threat model warrants it. A RuntimeClass references an installed configured runtime handler; writing its name does not install a sandbox. Stronger multitenancy may require separate nodes or clusters in addition to namespace controls.

Verification drill: inspect the live Pod security context, selected runtime and node support; exercise normal application behavior, then confirm a prohibited action is denied in a disposable environment.

Choose under exam pressure

Traps

• Non-root is one control, not a complete security boundary.
• RuntimeClass does not install its runtime handler.

Practise this topic

Memory hook: Admission constrains configuration; identity constrains access.

Must remember

Pod Security Standards define privileged, baseline and restricted profiles. Pod Security Admission namespace labels select enforcement, audit and warning behavior with version choices. Audit/warn modes report issues without necessarily blocking admission; enforce mode rejects noncompliant creation/update as documented. Existing workloads require deliberate review and rollout. Removed PodSecurityPolicy is not the current native admission mechanism.

Memorize the label shape: pod-security.kubernetes.io/enforce=restricted and pod-security.kubernetes.io/enforce-version=v1.35 select a level and policy version; use the version required by the task. The same prefix supports warn and audit. Inspect with kubectl get namespace team --show-labels. Updating a namespace label does not evict its existing Pods; verify the resulting behavior with an appropriately scoped admission test and a controlled workload rollout.

Minimize Secret access, avoid writing secrets to logs/images and disable unused service-account token mounts. Encrypt supported API data at rest and protect encryption-provider keys/configuration. Changing encryption configuration does not automatically rewrite every existing stored object; follow the documented migration/rotation procedure and keep recovery keys available as needed.

Multi-tenant isolation combines RBAC, quotas, network policy, Pod security and suitable node/runtime boundaries. Namespace separation alone does not prevent all cross-tenant access. Test both allowed and denied paths with the actual workload identity.

Service-mesh mTLS can authenticate/encrypt workload traffic when correctly configured. Cilium encryption and Istio mTLS have different implementation scopes; verify which traffic is protected and how identities/keys are managed. Encryption does not decide whether a service is authorized to call another: apply the corresponding authorization policy. Strict-mode rollout must account for workloads that do not yet participate.

Choose under exam pressure

Traps

• Warning labels do not equal enforcement.
• mTLS does not automatically implement business authorization.

Practise this topic

Memory hook: Know the contents, verify the origin, enforce before execution.

Must remember

Use minimal maintained base images, multi-stage builds and pinned reviewed digests. Remove unused packages and secrets; a smaller image reduces attack surface but does not prove safety. Distroless images can improve runtime minimalism while requiring a separate debugging strategy.

An SBOM inventories software components and versions. Vulnerability scanning compares them and other evidence to known issues; prioritize by exploitability, exposure and business impact. A signature binds an artifact to an identity under a trust policy; provenance describes its build origin/process. None alone proves the application has no malicious logic or unknown flaws.

Protect source review, build runners, dependency sources, registry credentials and promotion. Avoid rebuilding a different artifact for each environment; promote an immutable tested digest. Restrict permitted registries and use signature/attestation verification through an appropriate admission policy/tooling. A registry allow list says where an image came from, not whether its publisher or contents are trustworthy.

Static manifest analysis such as Kubesec or KubeLinter can detect risky configuration before deployment. Image scanning finds a different class of issues. Integrate checks into delivery and define exception ownership/expiry. Re-evaluate deployed images when new vulnerability information appears.

Choose under exam pressure

Traps

• Signed does not mean vulnerability-free.
• A scan at build time cannot know every vulnerability discovered later.

Practise this topic

Memory hook: Observe the action, identify the actor, preserve the evidence.

Must remember

Kubernetes audit policy selects events, stages and detail levels. Metadata-level records capture request context without full bodies; request/response bodies can contain sensitive information and increase volume. Protect audit destinations, retention and access. An application log, node log and API audit event answer different questions.

Audit rules use the first matching rule. Levels are None, Metadata, Request and RequestResponse; place specific exceptions before broad rules. For a static API-server Pod, the audit-policy file and log destination must be reachable inside the container through correct mounts as well as flags. Inspect actual records for user, verb, object, namespace and response status: a configured file alone does not prove the event reached the intended destination.

Runtime tools such as Falco can detect suspicious behavior from supported event sources: unexpected shells, writes to sensitive paths, privilege changes or unusual network activity. A detection rule is a hypothesis requiring context, not automatic proof of compromise. Tune against legitimate workloads while preserving visibility into important deviations.

Correlate Pod, container, node, namespace, service account, image digest and deployment history. Capture volatile evidence where the response process requires it before restarting/removing the workload. Containment may involve isolating traffic, revoking credentials or stopping a compromised workload; follow authorized incident procedures and preserve a record of actions.

Immutable runtime design uses read-only filesystems, controlled writable volumes and replacement from trusted artifacts instead of manual patching inside a live container. A deleted malicious Pod can simply return if the controller template or source image remains compromised. Fix the source, rotate exposed secrets and verify trusted recovery.

Timed drill: explain how to distinguish a legitimate diagnostic shell from an unauthorized shell using audit identity, deployment context, runtime events and change records. Then identify which evidence a blind restart would lose.

Choose under exam pressure

Traps

• Audit logging does not capture events retrospectively if it was never enabled.
• Removing one Pod does not repair its desired-state controller.

Practise this topic