KCSA flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Four Cs model

Cloud, Cluster, Container, Code. Each layer inherits trust from the layer below; a compromised cloud provider undermines all higher layers. Used to structure defense in depth for cloud native systems.

Shared responsibility model

Security duties split by service model. In IaaS the customer patches the OS; in managed Kubernetes the provider patches the control plane while the customer secures workloads and configuration.

Defense in depth

Layering independent controls so no single failure grants full compromise. In Kubernetes this means RBAC, network policy, admission control, and runtime detection all apply concurrently.

Ephemeral workload assumption

Cloud native workloads are short-lived and replaced, not patched in place. Controls must be automated, identity-based, and applied at admission rather than configured manually on hosts.

Confidentiality, integrity, availability

The CIA triad. In Kubernetes, confidentiality maps to RBAC and encryption, integrity to admission control and image signing, availability to quotas and disruption budgets.

kube-apiserver role

The only component that communicates with etcd and the single entry point for all cluster API requests. Authentication, authorization, and admission all occur here.

etcd encryption at rest

Configured through EncryptionConfiguration with aescbc, aesgcm, or a KMS provider. Without it, Secrets are stored base64-encoded and readable by anyone with etcd access.

Kubelet port 10250

The kubelet HTTPS API endpoint used for pod operations and exec. Anonymous authentication must be disabled and authorization delegated to the API server via webhook mode.

Kubelet read-only port

Port 10255 served unauthenticated metrics and pod data. It is deprecated and should be disabled with readOnlyPort set to zero.

NodeRestriction admission

Limits a kubelet to reading and modifying only its own Node object and pods scheduled to it. Reduces blast radius when a single node is compromised.

Container runtime socket risk

Mounting containerd or CRI-O sockets into a pod grants effective root on the node. Such mounts should be blocked by admission policy.

API server secure flags

Set authorization-mode to Node,RBAC, disable anonymous authentication, and enable the NodeRestriction admission plugin. These are baseline control plane hardening settings.

RBAC additive model

RBAC grants permissions only; there are no deny rules. Effective permissions are the union of all bound roles, so over-broad ClusterRoleBindings silently expand access.

Pod Security Standards

Three profiles: Privileged, Baseline, and Restricted. Baseline blocks known privilege escalations; Restricted adds non-root, seccomp, and dropped capabilities requirements.

Pod Security Admission labels

Namespace labels pod-security.kubernetes.io/enforce, audit, and warn select a profile per mode. Enforce rejects violating pods; audit and warn only record or report them.

NetworkPolicy default behavior

Pods are non-isolated until a policy selects them. Once selected, only explicitly allowed traffic passes; egress control requires listing Egress in policyTypes.

Service account token automount

Tokens are mounted into pods by default. Setting automountServiceAccountToken to false removes the credential where the workload does not call the API server.

Secrets are not encrypted

Kubernetes Secrets are base64-encoded by default. Confidentiality requires etcd encryption at rest plus RBAC restrictions on reading Secret objects.

Admission controllers

Intercept requests after authentication and authorization but before persistence to etcd. Gatekeeper, Kyverno, and ValidatingAdmissionPolicy enforce policy at this point.

Hardened securityContext fields

Key settings: runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation false, capabilities drop ALL, and a seccompProfile of RuntimeDefault or Localhost.

STRIDE threat categories

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Applied per trust boundary when threat modeling Kubernetes components and data flows.

Kubernetes threat actors

External attacker, compromised container, compromised node, malicious insider with API access, and supply chain attacker. Each has different capabilities and detection signals.

MITRE ATT&CK for Containers

A technique catalog covering exposed dashboards, privileged containers, hostPath mounts, and cloud metadata access. Used to map detections and red-team scenarios.

HostPath escape path

A pod mounting hostPath or running privileged can reach the node filesystem. Combined with a mounted service account token it escalates to cluster-level access.

Cloud metadata endpoint

169.254.169.254 issues instance credentials. Workloads reaching it can steal node IAM identity; block via egress NetworkPolicy or require IMDSv2.

Lateral movement detection

Stolen service account tokens and broad ClusterRoles enable movement between namespaces. API audit logs and admission logs are the primary detection sources.

Supply chain threat

Typosquatted, unsigned, or CI-compromised images. Mitigations include digest pinning, signature verification at admission, and provenance attestation.

Image digest pinning

Referencing an image by sha256 digest instead of a mutable tag prevents tag-rewrite attacks and guarantees the exact artifact that was scanned and signed is deployed.

Image signing with cosign

Sigstore cosign signs container images and stores signatures in a registry. Admission policies verify signatures before allowing a pod to be created.

SBOM formats

Software Bill of Materials in SPDX or CycloneDX lists components and versions. Used to trace vulnerable dependencies and satisfy supply chain audit requirements.

Runtime threat detection

Tools such as Falco and Tetragon observe syscalls and process behavior. They alert on signals like a shell spawned inside a container or unexpected binary execution.

CIS Kubernetes Benchmark

A configuration checklist for control plane, nodes, and policies. kube-bench automates the checks and produces pass/fail evidence for audits.

Kubernetes conformance

A program certifying API behavior and portability, not security posture. Passing conformance tests does not demonstrate compliance with any regulatory framework.