Autoplay
Autocomplete
Previous Lesson
Complete and Continue
Certified Kubernetes Security Specialist (CKS) Crash Course
Perform Cluster Version upgrade Using Kubeadm
Introduction
Perform a Version upgrade on Control Plane
Perform a Version upgrade on Worker Nodes
Cluster Security
Introduction
What is the CIS Benchmark?
Overview of CIS Benchmark
What is kube-bench?
Install kube-bench
Check CIS Benchmark using kube-bench
kube-bench Output Explained
🎯 Scenario 01: Check & Fix Anonymous Auth with kube-bench
🎯 Scenario 02: Check Kubelet Service File permission
🎯 Scenario 03: Fix etcd Authorization Issue
Enforcing Image Security using Image Policy Webhook
Introduction
Image Policy Webhook
Webhook Server
Webhook Server Creation
Deploying Image Policy Webhook Server
Kubernetes API Server Configuration
🎯Scenario 01: Deny Images from Non Authorized Registry
🎯Scenario 02: Troubleshoot Image Policy Webhook Configuration
Runtime Security
Introduction
What is Falco?
How Falco works?
Install Falco
Role of Flaco in Kubernetes
Falco Rules
Rule File Stucture
Create and Test a Custom Falco Rule
🎯Scenario 01: Delete the Pod That Triggered a Falco Alert
🎯Scenario 02: Identify and Remove the Container that Trigger Falco Alert
Security Context
Introduction
What is SecurityContext?
Why Should We Use SecurityContext?
How Kubernetes Handles User IDs from Container Images
How SecurityContext Works at Pod and Container Level
Important SecurityContext Option to Understand
🎯Scenario 01: Secure a Pod
🎯 Scenario 02: Pod and Container Level Security Context
Static Analysis
Introduction
What Is Static Analysis?
What Are the Things You Should Look For?
🎯Scenario 01: Static Analysis for Dockerfiles
🎯Scenario 02: Static Analysis for a Kubernetes Manifest File
Audit Logs
Introduction
Kubernetes Audit Logging Workflow
Configuring Audit Logs
🎯Scenario 01: Pod Creation Logging
🎯Scenario 02: Audit Policy with Multiple Logging Levels
🎯Scenario 03: Update Existing Audit Policy
Advanced Traffic Management using Cilium Network Policy
Introduction
Cilium Setup on Kubernetes
Basic Structure of the Cilium Network Policy
Layer 4 Network Policy
Entities
Mutual Authentication
🎯Scenario 01: Create a Cilium Layer 4 Network Policy
🎯Scenario 02: Allow Application Pod to Access Node Monitoring Agent
🎯Scenario 03: Enforce mTLS with Cilium Network Policy
Minimizes Microservice Vulnerabilites Using Pod Security Standards
Introduction
Enforcing Pod Security Standards
Pod Security Admission
🎯Scenario 01: Implementing Pod Security Admission in Cluster
🎯Scenario 02: Pending Deployment Due to Pod Security
Docker Daemon
Introduction
Docker Daemon Permission Management
Docker Daemon Remote Access
🎯Scenario 01: Removing Unused Permissions from the Docker Group
🎯Scenario 02: Docker Daemon Insecure Remote Access
Supply Chain Security
Introduction
What is SBOM?
What is bom?
Installation
Generate SBOM from a Container Image
🎯 Scenario 01: Generate SBOM in JSON Format
🎯 Scenario 02: Scale Down Deployment based on SBOM Report
Secrets
Introduction
Working With Secrets
Injecting Secrets into Pods
Secret Imperative Commands
🎯 Scenario 01: Create a Secret
🎯 Scenario 02: Configure a Secret Into a Pod
🎯 Scenario 03: Configuring Nginx with TLS Secret in Kubernetes
🎁 Bonus: Managing Secrets In Real World Setup
📚 Quiz Time
Base64 encoding
Secret Types
Ingress
Introduction
Ingress
🎁 Bonus: Ingress Controller: Internal Workflow
🎁 Ingress FAQs
Setup Ingress Controller
Create Ingress Objects
Ingress Demo Application Architecture
Deploy Demo Application
Ingress Object
Multiple Ingress Controllers
Ingress TLS
Create Ingress TLS
🎯 Scenario 01: Expose Web Application Via Ingress
🎯 Scenario 02: Troubleshoot Application Ingress
🎯 Scenario 03: Implement Path Based Routing
🎯 Scenario 04: Implement TLS For Ingress
📚 Quiz Time
Real World Example
Network Policy
Introduction
Kubernetes Network Policy
Network Policy Object
Deploy Demo Application
Implement Network Policies for Secure Communication Between Services
Deny all Ingress and Egress Traffic
🎯 Scenario 01: Secure Namespace Communication with Network Policies
🎯 Scenario 02: Implement Secure Egress with IP CIDR-Based Restrictions
🎯 Scenario 03: Secure Database Access with NetworkPolicy
Default Deny Network Policies
Common Pitfalls and Key Concepts
📚 Quiz Time
Minimizes the Service Accounts Permissions
Introduction
The Default Service Account
Creating Service Account
Service Account Hardening
Disable Service Account Tokens at Pod/Deployment Level
Projectd Volumes to Mount Service Account Tokens
🎯 Scenario: Use External Service Account
🎯Scenario: Disabling Service Account Tokens on Existing SA
🎯Scenario: Disabling Service Account Token on a Deployment
🎯Scenario: Using Projected Volume for the Service Account Token Mounting
📚 Quiz Time
🎯Scenario 02: Identify and Remove the Container that Trigger Falco Alert
Lesson content locked
If you're already enrolled,
you'll need to login
.
Enroll in Course to Unlock