CKS case studies
CKS · Put your knowledge to work in context.
The Certified Kubernetes Security Specialist (CKS) is a vendor-neutral credential created by the Cloud Native Computing Foundation in collaboration with The Linux Foundation. It attests that a holder can apply security best practices to container-based applications and Kubernetes platforms across build, deployment and runtime - hardening clusters and nodes, tightening access, securing the supply chain, and detecting threats rather than merely operating workloads. The CKS case studies are 5 cases and about 4,093 words.
1Default-deny that also denies DNS (and a namespace selector that never matches)
The cluster runs Calico, so NetworkPolicy is enforced. Namespace payments holds six Deployments (14 pods) that must reach each other, reach api.internal.example.com:443 , and reach nothing else.
768 words, about 4 min2A CI service account with cluster-admin, and a kubelet that answers to anyone
A kubeadm v1.29 cluster, three control-plane and three worker nodes. The CI pipeline authenticates as ServiceAccount deployer in namespace ci , and a single ClusterRoleBinding grants that ServiceAccount cluster-admin ; the pipeline uses it to apply Deployments and ConfigMaps into four namespaces.
824 words, about 4 min3Flipping a namespace to restricted: who breaks, and what you refuse to do about it
Namespace legacy is labelled pod-security.kubernetes.io/enforce: baseline and pod-security.kubernetes.io/warn: restricted . As a hardening step someone runs kubectl label ns legacy pod-security.kubernetes.io/enforce=restricted --overwrite and also patches nginx-front with securityContext.runAsNonRoot: true .
780 words, about 4 min4A signature policy in Audit mode and a registry that lets tags be overwritten
Kyverno 1.12 is installed and enforces a ClusterPolicy named verify-images that calls verifyImages with a cosign public key stored in a ConfigMap. The policy sets validationFailureAction: Audit and mutateDigest: false .
810 words, about 4 min5Three days later: no audit backend, a Falco DaemonSet nobody ships, and a compromised pod
Five nodes, kube-apiserver running as a kubeadm static pod with no --audit- flags set. Falco runs as a DaemonSet with the modern eBPF driver and its default output to stdout; there is no log shipper on the cluster.
911 words, about 5 min