CKS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

kube-bench

Tool that runs the CIS Kubernetes Benchmark checks against control plane binaries, configuration files and node settings, reporting pass, fail and warn per check.

Default-deny NetworkPolicy

A policy with an empty podSelector and an empty rule list for a direction selects every pod in the namespace and blocks all traffic not explicitly allowed.

EncryptionConfiguration

YAML referenced by kube-apiserver --encryption-provider-config listing providers such as aescbc, secretbox and identity, used to encrypt Secret data stored in etcd.

Anonymous authentication

When enabled, unauthenticated API or kubelet requests map to system:anonymous; setting --anonymous-auth=false forces every request to present credentials.

Ingress TLS secret

Secret of type kubernetes.io/tls containing tls.crt and tls.key, referenced from spec.tls[].secretName so the ingress controller terminates TLS for the host.

kubeadm upgrade order

Run kubeadm upgrade apply on the first control plane node, then drain and run kubeadm upgrade node elsewhere, and finally upgrade the kubelet and kubectl packages.

NodeRestriction admission plugin

Admission plugin that limits a kubelet to reading and modifying only its own Node object and the Pods already bound to that node.

Node,RBAC authorization mode

Setting --authorization-mode=Node,RBAC lets the Node authorizer handle kubelet requests while RBAC decides every other API request.

automountServiceAccountToken: false

Set on a Pod or ServiceAccount to stop the projected API token from being mounted, removing an in-cluster credential an attacker could otherwise use.

kubeadm certs renew

Subcommand that reissues control plane certificates; by default CA certificates are valid for 10 years while other kubeadm-managed certificates expire after one year.

cluster-admin binding risk

A ClusterRoleBinding to cluster-admin gives full control of every resource cluster-wide; namespaced Roles and narrow ClusterRoles limit the blast radius.

Kubelet read-only port

Port 10255 served pod and node information without authentication when enabled; --read-only-port=0 disables it and should be set on every node.

Seccomp RuntimeDefault profile

securityContext.seccompProfile.type=RuntimeDefault applies the container runtime's default syscall filter, blocking rarely used syscalls that container escapes rely on.

AppArmor container profile

Selected with the container.apparmor.security.beta.kubernetes.io/<container> annotation, or securityContext.appArmorProfile from Kubernetes 1.30, restricting file paths and capabilities.

Block cloud metadata endpoint

An egress NetworkPolicy denying 169.254.169.254/32 stops pods from reading node instance credentials from the cloud metadata service.

hostPath volume risk

Mounts a node filesystem path into the container, giving read or write access to host files; the baseline Pod Security level rejects it.

Minimal node image

Removing unused packages, services and compilers from the node operating system shrinks the host attack surface and reduces the patching effort.

runAsNonRoot: true

SecurityContext setting that makes the kubelet refuse to start the container when the image would otherwise run as UID 0.

readOnlyRootFilesystem

Mounts the container root filesystem read-only so an attacker cannot modify binaries or drop tooling; writable paths require explicit emptyDir mounts.

Drop ALL capabilities

capabilities.drop: ["ALL"] removes Linux capabilities from the container; required ones such as NET_BIND_SERVICE are added back individually, with allowPrivilegeEscalation false.

Pod Security Admission levels

Namespaces labelled with privileged, baseline or restricted set enforcement, audit and warn behaviour; restricted demands non-root, no escalation and dropped capabilities.

Gatekeeper ConstraintTemplates

OPA Gatekeeper policy is defined by a ConstraintTemplate holding Rego logic plus a Constraint resource that selects which objects it is evaluated against.

Trivy image scan

Scanner that inspects container images for vulnerable OS packages and language dependencies and reports known CVEs by severity, usable in CI or on a registry.

cosign image signing

Sigstore tool that signs an image digest with a key or keyless OIDC identity, storing the signature in the registry for admission-time verification.

Image digest pinning

Referencing image@sha256:<digest> instead of a tag guarantees the exact same bytes run, because tags are mutable and can be repointed.

ImagePullPolicy defaults

The default is Always when the tag is :latest or omitted and IfNotPresent otherwise; digest references with IfNotPresent avoid repeated registry pulls.

Distroless base image

Image containing only the application and its runtime libraries, with no shell or package manager, removing tooling an attacker needs after code execution.

Falco

CNCF runtime security tool that consumes kernel syscalls through eBPF or a kernel module and raises alerts when events match its rule set.

Kubernetes audit policy levels

Each audit rule sets None, Metadata, Request or RequestResponse, controlling how much of the request and response body is written to the audit backend.

Audit event stages

RequestReceived, ResponseStarted, ResponseComplete and Panic; the stage field records which point in the request lifecycle produced the audit event.

Audit webhook backend

kube-apiserver forwards batched audit events to an HTTP endpoint configured with --audit-webhook-config-file so an external SIEM can ingest them.

sysdig forensics

Captures live system calls and container events on a node, letting an investigator inspect processes, file writes and network activity after a suspected compromise.