CKS

CKS, CKA Updates, KCSA Security Essentials & Cyber Monday Savings

Kubernetes is one of the most widely used platforms for managing containerized applications. As Kubernetes evolves, so do its certifications, which are crucial for anyone looking to advance in the cloud-native and DevOps field. Whether you are preparing for the Certified Kubernetes Security Specialist (CKS) exam, the Certified Kubernetes Administrator (CKA) exam, or the Kubernetes and Cloud Native Security Associate (KCSA) certification, understanding the latest exam updates is essential for success.

In this blog, we’ll guide you through the latest updates for the CKS and CKA certifications, while providing you with the essential knowledge needed to tackle the KCSA exam, with a focus on the often-overlooked but crucial aspect of Kubernetes security in the cloud-native world.

Key Changes in the CKS Exam

The Certified Kubernetes Security Specialist (CKS) exam has undergone significant updates as of October 15, 2024. These changes reflect the latest advancements in Kubernetes security practices and cloud-native environments. Below are the most important updates to focus on while preparing for the CKS exam:

1. Cluster Setup

The Cluster Setup domain now makes up 15% of the exam (previously 10%). Key updates in this domain include:

Ingress Setup with TLS: This section now emphasizes configuring Ingress controllers with Transport Layer Security (TLS). This ensures encrypted communication between services and clients in your Kubernetes cluster, which is crucial for maintaining the security of data in transit.
Node Metadata Protection: Protecting node metadata has become a higher priority. The focus is now on verifying the security of platform binaries before deployment, ensuring they don’t contain vulnerabilities that could compromise your Kubernetes cluster.

This change highlights the importance of securing both your cluster’s network and node data.

2. System Hardening

The System Hardening domain has reduced its weight from 15% to 10%, but it still remains an essential part of the exam. Key updates in this domain include:

IAM Least Privilege: Emphasis is now placed on identity and access management (IAM), specifically applying the least privilege principle. This means giving users and services the minimum permissions needed to perform their tasks, which reduces the risk of unauthorized access.
Network Access Restrictions: This update focuses on limiting external access to your cluster’s network. By restricting access, you reduce the attack surface and protect your Kubernetes environment from potential external threats.

3. Minimizing Microservice Vulnerabilities

The Minimizing Microservice Vulnerabilities domain retains its 20% weight. The following updates have been introduced:

Pod Security Standards: There’s an increased focus on using Pod Security Standards to ensure that pods run with only the least privileges necessary. This helps minimize security risks by reducing the attack surface within your cluster.
Pod-to-Pod Encryption with Cilium: The exam now includes securing pod-to-pod communication using Cilium. Cilium provides encryption for pod communications, ensuring data privacy and security between containers running in the cluster.

4. Supply Chain Security

The Supply Chain Security domain remains at 20% of the exam and introduces a few important updates:

Software Bill of Materials (SBOM): The exam now includes a focus on SBOMs, which list all the components within a software product. This helps identify vulnerabilities in third-party dependencies, ensuring that your applications are free from known security risks.
Kubesec and KubeLinter: Tools like Kubesec and KubeLinter are now included in the exam. These tools help check Kubernetes configurations and YAML files for potential security risks before deployment.
CI/CD Pipeline Security: With the increasing use of CI/CD pipelines in Kubernetes environments, securing these pipelines has become more critical. The exam now includes securing the pipeline to ensure that vulnerabilities are not introduced during the build and deployment stages.

Some domains remain largely unchanged, with only minor rewording for clarity:

Cluster Hardening (15%)
Monitoring, Logging, and Runtime Security (20%)

These areas will continue to focus on securing your Kubernetes infrastructure and monitoring your cluster in real-time to detect and respond to security threats.

New Prerequisite Changes

Starting from October 2024, you no longer need an active CKA certification to take the CKS exam. If you have passed the CKA exam at any point in the past (even if the certification has expired), you are now eligible to take the CKS exam. This change makes the certification process simpler for many candidates.

For a more in-depth explanation of these changes, be sure to check out the detailed breakdown in our previous blog.

CKS Exam 2024 : Guide to K8s Security Certification

Following is the detailed breakdown of the changes in the CKS certification, as presented on KodeKloud's YouTube channel.

CKS Exam Updates

Check out the updated KodeKloud CKS Course.

CKA Exam Updates for 2025: What’s New and What’s Important

The Certified Kubernetes Administrator (CKA) exam is evolving, with several updates to the core domains for 2025. While the major topics—such as Storage, Troubleshooting, Workloads & Scheduling, Cluster Architecture, and Services & Networking—remain the same, the competencies and areas of focus have been refreshed to align with the latest Kubernetes advancements.

In this section, we’ll break down the key changes in the updated CKA syllabus and explain why these updates matter for aspiring Kubernetes administrators.

1. Storage: Fine-Tuning Volume Management

The Storage domain now includes a greater emphasis on dynamic volume provisioning and managing different volume types, access modes, and reclaim policies.

As Kubernetes environments grow more complex, administrators are expected to handle advanced storage configurations.

Dynamic provisioning is especially important for environments that require automated scaling, as it allows for more flexibility in resource management. Understanding how to fine-tune volume configurations will be crucial for handling storage needs in modern cloud-native environments.

2. Troubleshooting: Sharpening Network and Service Diagnostics

The Troubleshooting domain now extends to include network services, requiring a deeper understanding of both internal and external connectivity within a Kubernetes cluster.

Troubleshooting is not just about fixing problems; it’s about ensuring that your clusters are resilient and can handle issues quickly.

The expanded focus on diagnosing network and service connectivity issues means that CKAs will need to be well-versed in identifying and resolving problems at all levels of the stack—critical for maintaining high availability and performance in production environments.

3. Workloads & Scheduling: Mastering Pod Admission and Scaling

The updated syllabus introduces Pod admission and scheduling as new areas of focus, including node affinity, resource constraints, and scaling strategies.

Kubernetes automates the management of applications at scale.

As part of this, CKAs need to understand how to schedule workloads and autoscale applications efficiently.
The update emphasizes self-healing applications, which can automatically adjust their resource needs based on demand. This is essential knowledge for ensuring your Kubernetes clusters can handle high levels of traffic and scale automatically as needed.

4. Networking: Gateway API

One of the most significant changes is the introduction of the Gateway API. This API provides a more flexible and extensible approach to managing Ingress traffic, offering greater control over routing and load balancing.

The Gateway API represents a more modern, scalable way to handle traffic management in Kubernetes. As applications become more complex, using the Gateway API ensures that Kubernetes administrators can manage traffic routing more efficiently, especially in multi-cloud or hybrid cloud environments.
The updated syllabus also retains a strong focus on CoreDNS, Kubernetes' default DNS service. Proper understanding of CoreDNS configuration is essential for ensuring that services within the cluster can discover each other and communicate effectively, which helps prevent network issues.

5. Cluster Architecture: Managing Complex Deployments

The Cluster Architecture domain now includes tools like Helm and Kustomize, which are essential for managing complex Kubernetes deployments.
Additionally, administrators need to be familiar with Kubernetes extension interfaces such as CNI (for networking), CSI (for storage), and CRI (for runtime).
With the increasing complexity of Kubernetes environments, administrators must be proficient not just in setting up clusters but also in managing custom resources via CRDs (Custom Resource Definitions) and Operators.

These tools allow for more flexible and automated management of Kubernetes resources, making them key skills for any Kubernetes administrator.

The updated exam places less focus on managing etcd backups and restores and Kubernetes version upgrades. While these topics are still relevant, they are no longer as central to the exam. Instead, more attention is given to advanced concepts like Helm, Kustomize, and managing Kubernetes extensions, which are now integral to real-world Kubernetes environments.

Key Focus Areas for the Updated CKA Exam

To effectively prepare for the updated CKA exam, focus on the following key areas that have been highlighted in the new syllabus:

Mastering Helm and Kustomize: Gain a solid understanding of how to use Helm and Kustomize to manage complex Kubernetes configurations and streamline deployments.

Enhancing Network Troubleshooting Skills: Be prepared to diagnose and resolve issues related to pod connectivity, DNS configurations, and overall network services within your cluster.

Getting Comfortable with Gateway API: Learn how to configure and implement the Gateway API for better control over traffic management, routing, and load balancing in Kubernetes environments.

Hands-On with CRDs and Operators: Practice working with Custom Resource Definitions (CRDs) and Operators, both of which are becoming increasingly essential for managing and extending Kubernetes in production.

Dynamic Volume Management: Gain practical experience with dynamic storage provisioning, which is vital for efficient storage management and scaling in modern Kubernetes clusters.

The updated syllabus for the CKA exam will be in effect starting January 15, 2025. If you're planning to take the exam after this date, make sure your preparation aligns with the new requirements to stay ahead.

We will be covering this in more detail in an upcoming blog and YouTube video soon. Stay tuned with our YouTube channel and blog for the latest updates!

Check out the KodeKloud CKA course, complete with mock exams and labs.

Kubernetes Security Fundamentals: Why KCSA Certification Matters

As Kubernetes becomes increasingly central to cloud-native architectures, understanding Kubernetes security has never been more important. The Kubernetes and Cloud Native Security Associate (KCSA) certification offers a foundational understanding of Kubernetes security best practices, making it an essential certification for anyone looking to strengthen their cloud-native security expertise.

Here’s a breakdown of key areas you should focus on to successfully prepare for the KCSA certification:

1. Kubernetes Architecture: How Key Components Work Together

Before diving into security, it's essential to understand the core Kubernetes architecture. Kubernetes is made up of several key components that work together to run and manage containers:

API Server: The central control point that communicates with all other Kubernetes components and exposes the API.
Kube Scheduler: Decides which node will run a specific pod based on available resources.
Controller Manager: Ensures that the desired state of your Kubernetes cluster (such as pod replicas) is maintained.
ETCD: A distributed database that stores cluster data, including configurations and states.
Kubelet: An agent on each node that ensures containers run properly and stay healthy.

Knowing how these components interact will help you configure and secure your Kubernetes environment effectively. This foundational knowledge is covered in the KCNA certification. While it is not a prerequisite for the KCSA exam, it is highly recommended to either take the KCNA certification or master the key domains covered there before sitting for the KCSA exam. Doing so will ensure you have a solid understanding of Kubernetes fundamentals, making it easier to tackle the security topics in the KCSA exam.

Check out the KodeKloud KCNA course.

2. Authentication in Kubernetes

Authentication ensures that only authorized users and services can interact with your Kubernetes cluster. Kubernetes supports several authentication methods, including:

Token Authentication: Uses API tokens for secure user authentication.
X.509 Certificates: A method for securing communication between services in the Kubernetes cluster.
ServiceAccount: Authentication for pods within your cluster.
Other Methods: Kubernetes can integrate with OpenID Connect (OIDC) and other third-party systems.

These methods help ensure that only trusted users can access your cluster, creating a critical layer of security.

3. Authorization

Once users are authenticated, Kubernetes uses authorization to define what authenticated users can and cannot do. The most common authorization tools in Kubernetes include:

RBAC (Role-Based Access Control)
RBAC allows you to assign roles with specific permissions to users or services. You can control access to Kubernetes resources at both the cluster and namespace level. RBAC ensures that only authorized users can perform actions like creating or modifying pods, based on their assigned roles. This is the foundation for managing authorization in Kubernetes.
ABAC (Attribute-Based Access Control)
ABAC uses policies based on attributes (such as user role, namespace, or request type) to decide if access should be granted. Unlike RBAC, which focuses on roles, ABAC allows more flexibility with user attributes.
Node Authorization
Node authorization is used to control how nodes within the Kubernetes cluster interact with the API server. It focuses on determining what actions nodes can perform.
Webhook Authorization
Kubernetes can be configured to use an external webhook for more complex and dynamic authorization decisions. This allows for fine-grained control over access that goes beyond the built-in options.
AlwaysAllow / AlwaysDeny
These are special authorization policies that either explicitly allow or deny all requests from a user or service, often used for debugging or temporary restrictions.

4. RBAC: Role-Based Access Control

RBAC is a crucial component of Kubernetes' authorization strategy. It allows you to define Roles and ClusterRoles, which specify the permissions granted to users.

Roles: These are used to grant permissions within a specific namespace. A role defines the set of actions a user can perform on specific resources within the namespace.
ClusterRoles: These provide permissions across the entire cluster. ClusterRoles can be used across all namespaces or applied to cluster-wide resources such as nodes or persistent volumes.
RoleBindings: RoleBindings assign a role to a user within a specific namespace, ensuring that the user has the necessary permissions within that namespace.
ClusterRoleBindings: ClusterRoleBindings assign a ClusterRole to a user or group of users at the cluster level, granting access across all namespaces or to cluster-wide resources.

5. Admission Controllers

Admission Controllers are essential gatekeepers in Kubernetes, ensuring that only secure and compliant resources are created in your cluster by enforcing policies.

Pod Security Standards (PSS):
Pod Security Standards ensure pods comply with defined security policies before entering the cluster. There are three policy levels:
- Privileged: Unrestricted policy for infrastructure-level workloads, allowing privilege escalation.
- Baseline: Minimally restrictive, blocking privilege escalation, suitable for non-critical workloads.
- Restricted: Most restrictive, adhering to Pod hardening best practices for security-critical workloads.
Pod Security Admission:
This feature enforces Pod Security Standards by automatically rejecting pods that don't meet the defined security level. It replaced the older PodSecurityPolicy controller.
Mutating and Validating Admission Controllers:
These controllers ensure that resources meet security standards:
- Validating Admission Controllers check if resources comply before being accepted.
- Mutating Admission Controllers modify incoming resources to ensure they meet the necessary policies.

These controllers automate security policy enforcement, ensuring that only authorized and compliant resources are created in the cluster.

6. Secrets

Secrets are used to store sensitive information like passwords, API keys, and certificates. In Kubernetes, Secrets are encoded in base64, and while they are not encrypted by default, they can be configured to be encrypted at rest for better security.

When creating Secrets in Kubernetes, it's important to follow best practices to ensure sensitive data is handled securely. You can create Secrets directly using kubectl with the following command:

kubectl create secret generic <secret-name> --from-literal=<key>=<value>

kubectl create secret generic my-db-password --from literal=password=supersecretpassword

Managing Secrets properly is essential for keeping sensitive data safe and ensuring that only authorized users and services can access it.

7. Security Context

The Security Context in Kubernetes defines security settings for pods and containers. These settings include:

RunAsUser and RunAsGroup: Defines which user and group a container runs as.
Privilege Escalation: Controls whether containers can gain higher privileges.
SELinux context: Provides additional access controls for containers.
AppArmor: Uses profiles to restrict the capabilities of individual programs, providing granular security.
Seccomp: Filters system calls to restrict the set of allowed actions a container can take, reducing the potential attack vectors.
allowPrivilegeEscalation: Determines if a process can gain more privileges than its parent process. Disabled when no_new_privs flag is set, unless the container is privileged or has CAP_SYS_ADMIN.

Using Security Context ensures that your pods and containers run with the minimum privileges necessary, reducing security risks.

8. Networking and Network Policies

Network Policies in Kubernetes allow you to define rules that control how pods communicate with each other. These policies can specify which pods are allowed to communicate and how. In the KCSA certification, you need to know about Network Policies at a high level, including key components such as podSelectors, ingress, and egress rules, as shown in the following example.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-db-access
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 3306
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

apiVersion, kind, metadata: Standard fields to define the resource.
podSelector: Selects which pods the policy applies to (here, pods with the label role=db).
policyTypes: Specifies whether the policy applies to Ingress (incoming) and/or Egress (outgoing) traffic. In this example, both are defined.
ingress: Defines the allowed incoming traffic. Here, only pods with the label role=frontend can access the role=db pods on port 3306.
egress: Defines the allowed outgoing traffic. This policy allows traffic from role=db pods to any IP in the 10.0.0.0/24 range on port 5978.

By creating network segmentation within your cluster, you limit the potential attack surface and prevent unauthorized access between services.

9. Namespaces

Namespaces in Kubernetes allow you to divide cluster resources into logically grouped sections, which is especially useful for managing large environments. By using namespaces, you can:

Isolate Resources: Ensure that different teams or projects can work independently without interfering with each other.
Control Access: Apply RBAC rules to control which users or services can access resources within a specific namespace.
Organize Resources: Manage different applications and services more effectively by grouping them under separate namespaces.

Namespaces are applicable to namespaced objects like Deployments, Services, and ConfigMaps, where names must be unique within a namespace, but not across namespaces. However, this scoping does not apply to cluster-wide objects such as StorageClass, Nodes, and PersistentVolumes, which are not confined to namespaces.

Namespaces are especially important when working with multi-tenancy or large-scale Kubernetes deployments, as they provide a structured way to manage and control access to resources.

10. Audit Logs and Monitoring

Audit logs are vital for tracking activity in your Kubernetes cluster. They record every request to the Kubernetes API, providing answers to who, when, what, and where. Setting up audit policies ensures suspicious activities are logged and can be investigated.

Audit Stages:
- RequestReceived: Logged when the request is first received.
- ResponseStarted: Logged once the response headers are sent.
- ResponseComplete: Logged after the full response body is sent.
- Panic: Logged when a panic occurs.
Audit Policy:
- Defines rules to specify which events should be logged.
- Available audit levels:
  - None: No logging.
  - Metadata: Logs only metadata (user, timestamp, etc.).
  - Request: Logs metadata and request body.
  - RequestResponse: Logs full event details (request and response bodies).
Audit Backends:
- Log Backend: Writes events to the local filesystem.
- Webhook Backend: Sends events to an external HTTP API.
Configuring Audit Policies:
- Pass the policy file to the kube-apiserver using the --audit-policy-file flag.
- Without a policy file, no events are logged.

Monitoring with tools like Prometheus and Grafana helps detect potential security incidents in real-time, allowing you to respond quickly to threats.

So, the above-mentioned areas, including Kubernetes basics like KCNA knowledge, authentication, authorization, RBAC, Secrets, Security Context, and admission controllers, form the foundational knowledge needed for the KCSA exam. These topics account for 50% of the KCSA exam questions. Mastering these concepts is essential, not only for passing the exam but also for securing Kubernetes environments in real-world scenarios.

The remaining 50% of the exam focuses on additional security concepts, including:

Kubernetes Threat Model: Understand the trust boundaries within Kubernetes and how data flows between components. Trust boundaries separate areas of your cluster that have different security levels. Knowing these boundaries is essential to securing your Kubernetes environment.
Threat Modeling Frameworks: Learn about STRIDE and the MITRE ATT&CK frameworks. STRIDE helps assess security risks by focusing on Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges. MITRE ATT&CK for Kubernetes outlines common attack tactics and techniques, including Privilege Escalation, Execution, Persistence, and Initial Access.
Supply Chain Security: Secure your software supply chain, including protecting the build pipeline, scanning images for vulnerabilities, and ensuring that only trusted code is deployed to your cluster.
Image Repositories: Use image scanning tools like Trivy to check for vulnerabilities in container images before deploying them to your Kubernetes cluster.
Service Mesh: Tools like Istio provide enhanced security, monitoring, and control for your microservices, offering features like mutual TLS, traffic routing, and access policies.
PKI (Public Key Infrastructure): Understand how certificates are used to secure communication between Kubernetes components. Properly configured PKI ensures secure, encrypted connections across the cluster.
Automation and Tooling: Use tools like Falco, Aqua, Kubescape, and Sysdig to automate security checks and maintain a secure Kubernetes environment.
Observability: Prometheus and Grafana are widely used for monitoring Kubernetes clusters, providing metrics and alerts for detecting potential security incidents.

The KCSA certification is incredibly valuable, especially with the areas it covers. Mastering the domains mentioned above will not only help you pass the exam but also give you an in-depth understanding of often-overlooked security aspects of Kubernetes.

KodeKloud recently released its KCSA course. Since the KCSA certification is relatively new, there are limited resources available elsewhere, but KodeKloud covers everything you need to succeed. It offers comprehensive resources, including quizzes, mock exams, and hands-on labs.

Check it out and get ready for your certification journey today!

As we’ve covered, mastering Kubernetes security and staying updated with certifications like CKA, CKS, and KCSA is essential to advancing in the cloud-native and DevOps fields. These certifications not only validate your skills but also equip you with the expertise to manage and secure Kubernetes environments effectively. Whether you’re just starting or ready to take the exam, having the right resources will make all the difference in your success.

By the way, don't forget to check out our Kubeastronaut learning path — a comprehensive guide to becoming a Kubeastronaut!

Now, imagine you’ve gained the knowledge and are prepared for the exam—but you need that extra boost to take the next step in your career. That’s where Cyber Monday comes in, offering an exclusive opportunity to take your certification journey even further.

Cyber Monday Savings: Special Discounts on LF Certifications

Cyber Monday isn’t just about great deals; it’s about investing in your future. For a limited time, we’re offering exclusive discounts on Linux Foundation certifications. These certifications are key to proving your expertise and boosting your career in the fast-growing cloud-native and DevOps fields. With certifications like CKA, CKS, and KCSA, you’ll have the competitive edge needed to stand out.

This Cyber Monday, you can get access to top-notch training and certification programs at a fraction of the price. It’s the perfect time to invest in your career and secure the knowledge and credentials that will help you thrive in today’s cloud-native world.

Grab these exclusive offers now and save up to 60%!

🎉 Cyber Monday Offers:

60% Off IT Professional Programs
Use code: CYBER24BUNDLEKK
60% Off Power Bundles
Use code: CYBER24BUNDLEKK
60% Off Course + 1 Cert Bundles
Use code: CYBER24BUNDLEKK
60% Off Cert-Only Bundles
Use code: CYBER24BUNDLEKK
50% Off Individual Courses & Certifications
Use code: CYBER24CCKODE
50% Off Instructor-Led Courses
Use code: CYBER24CCKODE

📅 Act Fast: These deals won't last long! Take advantage of this limited-time sale to gain the skills and certifications you need to thrive in the cloud-native world.

Thanks for reading! Stay tuned for another exciting blog soon.

Nimesha Jinarajadasa

Dec 2, 2024 • 18 min read