Prepare for the CKS

The exam

Performance-based on live clusters. Holding the CKA is a prerequisite for this exam.

What this path covers

Hands-on labs for every domain of the CKS curriculum (v1.34): network policies, CIS benchmarks with kube-bench, kubelet and API server hardening, audit logs, encryption at rest, seccomp, admission policies, image supply chain and runtime incidents, plus the theory around them. Labs on the nodes need the full lab clusters (run BrokenCluster on your own computer). Finish the CKA roadmap first.

14 hands-on labs and 14 questions

Finish every step to earn a BrokenCluster completion certificate you can add to LinkedIn.

1. 1.Cluster setup and hardening

   0/10
   • NetworkPolicy Defaultshard
   • Lock Down Database Trafficmedium
   • Role vs ClusterRolemedium
   • Build a Cluster-Wide Read-Only Rolehard
   • Disabling Token Automounteasy
   • Audit Policy Rule Ordermedium
   • Keep Pods Away From the Metadata Servicemedium
   • A ServiceAccount With Just Enough Accessmedium
   • A Short-Lived Token for One Audiencemedium
   • Who Can Read the Production Secrets?medium

2. 2.System hardening

   0/4
   • Grant Exactly One Command via sudomedium
   • Set Up SSH Key Authenticationmedium
   • Who Is Listening on That Port?medium
   • Reading rwxr-x---easy

3. 3.Minimise microservice vulnerabilities

   0/7
   • Pod Security Restricted Levelmedium
   • runAsNonRoot Failuresmedium
   • Enforce the Restricted Pod Security Standardhard
   • Encrypting Existing Secretshard
   • ConfigMaps vs Secretseasy
   • Make a Container Immutablemedium
   • Secrets as Files, Not Environment Variableseasy

4. 4.Supply chain security

   0/6
   • Running as Non-rootmedium
   • The Problem with :latesteasy
   • Pinning Images by Digesteasy
   • ValidatingAdmissionPolicy Bindinghard
   • Only Images From the Company Registryhard
   • Pass the Security Lintermedium

5. 5.Monitoring and runtime security

   0/1
   • Runtime Threat Detectionmedium

BrokenCluster is independent and is not affiliated with, endorsed by or sponsored by The Linux Foundation and CNCF. Certified Kubernetes Security Specialist is a trademark of its owner and is named here only to describe what this path helps you prepare for. Passing our path is not the official exam.