stackrox / Kubernetes_security_specialist_study_guide
Licence: mit
Stars: ✭ 302
Labels
Projects that are alternatives of or similar to Kubernetes security specialist study guide
Terraform Google Gke
Terraform code and scripts for deploying a Google Kubernetes Engine (GKE) cluster.
Stars: ✭ 257 (-14.9%)
Mutual labels: hcl
Vim Terraform Completion
A (Neo)Vim Autocompletion and linter for Terraform, a HashiCorp tool
Stars: ✭ 280 (-7.28%)
Mutual labels: hcl
Terraform Aws Gitlab Runner
Terraform module for AWS GitLab runners on ec2 (spot) instances
Stars: ✭ 292 (-3.31%)
Mutual labels: hcl
Sadcloud
A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure
Stars: ✭ 259 (-14.24%)
Mutual labels: hcl
Deploy Ibm Cloud Private
Instructions and Code required to install IBM Cloud Private
Stars: ✭ 264 (-12.58%)
Mutual labels: hcl
Cloudblock
Cloudblock automates deployment of secure ad-blocking for all of your devices - even when mobile. Step-by-step text and video guides included! Compatible clouds include AWS, Azure, Google Cloud, and Oracle Cloud. Cloudblock deploys Wireguard VPN, Pi-Hole DNS Ad-blocking, and DNS over HTTPS in a cloud provider - or locally - using Terraform and Ansible.
Stars: ✭ 257 (-14.9%)
Mutual labels: hcl
Terraform Kubestack
Terraform GitOps Framework — Everything you need to build reliable automation for AKS, EKS and GKE Kubernetes clusters in one free and open-source framework.
Stars: ✭ 300 (-0.66%)
Mutual labels: hcl
Provisioning
Kubernetes cluster provisioning using Terraform.
Stars: ✭ 277 (-8.28%)
Mutual labels: hcl
Terraform Ecs Fargate
A Terraform template used for provisioning web application stacks on AWS ECS Fargate
Stars: ✭ 293 (-2.98%)
Mutual labels: hcl
Pyhcl
HCL is a configuration language. pyhcl is a python parser for it.
Stars: ✭ 260 (-13.91%)
Mutual labels: hcl
Decker
Declarative penetration testing orchestration framework
Stars: ✭ 263 (-12.91%)
Mutual labels: hcl
Vault On Aws
A secure Vault for secrets, tokens, keys, passwords, and more. Automated deployment with Terraform on AWS. Configurable options for security and scalability. Usable with any applications and services hosted anywhere.
Stars: ✭ 287 (-4.97%)
Mutual labels: hcl
Citrix K8s Ingress Controller
Citrix ADC (NetScaler) Ingress Controller for Kubernetes:
Stars: ✭ 256 (-15.23%)
Mutual labels: hcl
Terraform Examples
Terraform samples for all the major clouds you can copy and paste. The future, co-created.
Stars: ✭ 256 (-15.23%)
Mutual labels: hcl
Iam Policy Json To Terraform
Small tool to convert an IAM Policy in JSON format into a Terraform aws_iam_policy_document
Stars: ✭ 282 (-6.62%)
Mutual labels: hcl
Elasticsearch Cloud Deploy
Deploy Elasticsearch on the cloud easily
Stars: ✭ 308 (+1.99%)
Mutual labels: hcl
Terraform ecs fargate example
Example used on my post about ECS Fargate
Stars: ✭ 300 (-0.66%)
Mutual labels: hcl
Terragrunt Infrastructure Live Example
A repo used to show examples file/folder structures you can use with Terragrunt and Terraform
Stars: ✭ 286 (-5.3%)
Mutual labels: hcl
Certified Kubernetes Security Specialist Study Guide
CKS Overview
The CKS is the third Kubernetes based certification backed by the Cloud Native Computing Foundation (CNCF). CKS will join the existing Certified Kubernetes Administrator (CKA) and Certified Kubernetes Application Developer (CKAD) programs. All three certifications are online, proctored, performance-based exams that will require solving multiple Kubernetes security tasks from the command line. With the massive investment into Kubernetes over the last five years, these certifications continue to be highly sought after by many seeking out technical knowledge about Kubernetes.
This repository contains resources to build a Kubernetes cluster, and example questions and answers based on the Certified Kubernetes Security Specialist (CKS) exam curriculum.
Repository Structure
study_guide/
└ cluster_setup/
└ Makefile
└ gcp -> Create a 1.19 cluster in GCP with RKE.
└ aws (coming soon)
└ azure (coming soon)
└ img/
└ all_images_used
└ walkthrough/
└ p0_intro/
└ p1_cluster_setup /
└ p2_cluster_hardening/
└ p3_system_hardening/
└ p4_minimizing_vulnerabilities/
└ p5_supply_chain_security/
└ p6_monitoring_logging_runtime_security/
└ LICENSE
└ README.md
Outline
The CKS test will be online, proctored and performance-based, and candidates have 2 hours to complete the exam tasks. This information is currently based on the Linux Foundations release of the CKS outline.
From the CKS Exam Curriculum repository, The exam will test domains and competencies including:
- Cluster Setup (10%): Best practice configuration to control the environment's access, rights and platform conformity.
- Cluster Hardening (15%): Protecting K8s API and utilize RBAC.
- System Hardening (15%): Improve the security of OS & Network; restrict access through IAM.
- Minimize Microservice Vulnerabilities (20%): Utilizing on K8s various mechanisms to isolate, protect and control workload.
- Supply Chain Security (20%): Container oriented security, trusted resources, optimized container images, CVE scanning.
- Monitoring, Logging, and Runtime Security (20%): Analyse and detect threads.
Exam News and Overview
KubeCon Announcement and Preparation Tips
-> KubeCon Announcement and Linux Foundation Update
Curriculum
Below is the CKS curriculum broken down by its six sections. Each section has its own folder in the repository, where you can walk through individual questions relating to their respective topic. Each section in the curriculum overview also contains external resources that you may find useful in your studying journey,
Cluster Setup - 10%
Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
Verify platform binaries before deploying
Protect node metadata and endpoints
Use Network security policies to restrict cluster level access
Properly set up Ingress objects with security control
Minimize use of, and access to, GUI elements
Cluster Hardening - 15%
Restrict access to Kubernetes API
Use Role Based Access Controls to minimize exposure
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
System Hardening - 15%
Minimize host OS footprint (reduce attack surface)
Minimize IAM roles
Minimize external access to the network
Appropriately use kernel hardening tools such as AppArmor, seccomp
Minimize Microservice Vulnerabilities - 20%
Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts
Manage Kubernetes secrets
Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
Implement pod to pod encryption by use of mTLS
Supply Chain Security - 20%
Minimize base image footprint
Secure your supply chain: whitelist allowed image registries, sign and validate images
Use static analysis of user workloads (e.g. kubernetes resources, docker files)
Scan images for known vulnerabilities
Monitoring, Logging and Runtime Security - 20%
Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
Detect threats within physical infrastructure, apps, networks, data, users and workloads
Detect all phases of attack regardless where it occurs and how it spreads
Perform deep analytical investigation and identification of bad actors within environment
Ensure immutability of containers at runtime
Use Audit Logs to monitor access
Extra Resources
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].