CKS 官方考纲

CKS 官方考纲: [CKS_Curriculum_ v1.19.pdf](./CKS_Curriculum_ v1.19.pdf)

Cluster Setup - 10%

Securing a Cluster

• Use Network security policies to restrict cluster level access

  • https://kubernetes.io/docs/concepts/services-networking/network-policies/

• Use CIS benchmark to review the security configuration of Kubernetes components(etcd, kubelet, kubedns, kubeapi)

  • https://www.cisecurity.org/benchmark/kubernetes/)

• Properly set up Ingress objects with security control

  • https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

• Protect node metadata and endpoints

  • https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access

• Minimize use of, and access to, GUI elements

  • https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/#accessing-the-dashboard-ui

• Verify platform binaries before deploying

  • https://github.com/kubernetes/kubernetes/releases
    • Kubernetes binaries can be verified by their digest sha512 hash
      • checking the Kubernetes release page for the specific release
      • checking the change log for the images and their digests

Cluster Hardening - 15%

• Restrict access to Kubernetes API

  • https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/

• Use Role-Based Access Controls to minimize exposure

  • https://kubernetes.io/docs/reference/access-authn-authz/rbac/
  • handy site collects together articles, tools and the official documentation all in one place

• Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones

  • opt out of automounting API credentials for a service account

    • service account scope

      apiVersion: v1
      kind: ServiceAccount
      metadata:
      name: build-robot
      automountServiceAccountToken: false

    • pod scope

      apiVersion: v1
      kind: Pod
      metadata:
        name: cks-pod
      spec:
        serviceAccountName: default
        automountServiceAccountToken: false

• Update Kubernetes frequently

  • https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/

System Hardening - 15%

• Minimize host OS footprint (reduce attack surface)

  • Reduce host attack surface
  • seccomp which stands for secure computing was originally intended as a means of safely running untrusted compute-bound programs.
    • https://kubernetes.io/docs/tutorials/clusters/seccomp/)
  • AppArmor can be configured for any application to reduce its potential host attack surface and provide greater in-depth defense.
    • https://kubernetes.io/docs/tutorials/clusters/apparmor/)
    • PSP pod security policy enforces
      • https://kubernetes.io/docs/concepts/policy/pod-security-policy/
    • apply host updates frequently
    • Install minimal required OS fingerprint 安装所需的最小操作系统
    • Protect access to data with permissions
      • Restirct allowed hostpaths
        • https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems

• Minimize IAM roles

  • Access authentication and authorization
    • https://kubernetes.io/docs/reference/access-authn-authz/authentication/

• Minimize external access to the network

  • not tested, however, the thinking is that all pods can talk to all pods in all name spaces but not to the outside of the cluster!!!

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: deny-external-egress
    spec:
      podSelector: {}
      policyTypes:
      - Egress
      egress:
        to:
        - namespaceSelector: {}

• Appropriately use kernel hardening tools such as AppArmor, seccomp

  • AppArmor
    • https://kubernetes.io/docs/tutorials/clusters/apparmor/
  • seccomp
    • https://kubernetes.io/docs/tutorials/clusters/seccomp/

Minimize Microservice Vulnerabilities - 20%

• Setup appropriate OS level security domains e.g. using PSP, OPA, security contexts

  • Pod Security Policies
    • https://kubernetes.io/docs/concepts/policy/pod-security-policy/
  • Open Policy Agent
    • https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/
  • Security Contexts
    • https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

• Manage kubernetes secrets

  • https://kubernetes.io/docs/concepts/configuration/secret/

• Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)

  • container runtime
    • https://kubernetes.io/docs/concepts/containers/runtime-class/
  • gvisor, kata containers
    • https://github.com/kubernetes/enhancements/blob/5dcf841b85f49aa8290529f1957ab8bc33f8b855/keps/sig-node/585-runtime-class/README.md#examples

• Implement pod to pod encryption by use of mTLS

  • https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/
  • TODO: Check if service mesh is part of the CKS exam.

Supply Chain Security - 20%

• Minimize base image footprint

  • Use distroless, UBI minimal, Alpine, or relavent to your app nodejs, python but the minimal build.
  • Do not include uncessary software not required for container during runtime
    • e.g build tools and utilities, troubleshooting and debug binaries.
      • Learnk8s smaller docker images blog
      • GKE 7 best practices for building containers

• Secure your supply chain: whitelist allowed image registries, sign and validate images

  • whitelist allowed image registries
    • https://kubernetes.io/blog/2019/03/21/a-guide-to-kubernetes-admission-controllers/#why-do-i-need-admission-controllers

• Use static analysis of user workloads (e.g. kubernetes resources, docker files)

  • https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#7-statically-analyse-yaml

• Scan images for known vulnerabilities

  • https://kubernetes.io/blog/2018/07/18/11-ways-not-to-get-hacked/#10-scan-images-and-run-ids
  • Aqua security Trivy
  • Anchore command line scans

Monitoring, Logging and Runtime Security - 20%

• Perform behavioural analytics of syscall process and file activities at the host and container level to detect malicious activities

  • Old kubernetes.io URL: install falco on k8s 1.17

• Detect threats within a physical infrastructure, apps, networks, data, users and workloads

• Detect all phases of attack regardless where it occurs and how it spreads

  • Attack Phases

    • Kubernetes attack martix Microsoft blog
    • MITRE attack framwork using sysdig falco
    • CNCF Webinar: Mitigating Kubernetes attacks

• Perform deep analytical investigation and identification of bad actors within the environment

  • Monitoring Kubernetes with sysdig
  • CNCF Webinar: Getting started with container runtime security using Falco

• Ensure immutability of containers at runtime

  • https://kubernetes.io/blog/2018/03/principles-of-container-app-design/

• Use Audit Logs to monitor access

  • https://kubernetes.io/docs/tasks/debug-application-cluster/audit/

Extra helpful material

Books

1. Container Security or view [here](./books/Container Security by Liz Rice)
2. Learn Kubernetes Security or view [here](./books/Learn Kubernetes Security by Pranjal Jumde; Loris Degioanni; Kaizhe Huang)

Youtube Videos

1. Google/Ian Lewis: Kubernetes security best practices
2. Code in Action for the book Learn Kubernetes Security playlist
3. Kubernetes security concepts and demos
4. How to Train your Red Team (for Cloud-Native) - Andrew Martin, ControPlane
5. InGuardians/Jay Beale: Kubernetes Practical attacks and defences\

• Webinars
  • AquaSec webiners collection - Webinars and videos presented by leading industry experts covering Microservices, Container & Serverless security, Kubernetes, DevSecOps, and everything related to the most disruptive area in IT.

Containers and Kubernetes Security Training

1. Killer.sh CKS practice exam ⟹ use code walidshaari for 20% discount
2. Udemy Kubernetes CKS 2020 Complete Course and Simulator
3. Linux Foundation Kubernetes Security essentials LFS 260
4. Linux Academy/ACloudGuru Kubernetes security
5. Cloud native security defending containers and kubernetes
6. Tutorial: Getting Started With Cloud-Native Security - Liz Rice, Aqua Security & Michael Hausenblas
   • hands-on tutorial
7. K21 academy CKS step by step activity hands-on-lab activity guide
8. Andrew Martin Attacking and Defending Cloud Native Infrastructure
9. Andrew Martin Control Plane Security training

Extra Kubernetes security resources

1. Kubernetes-security.info
2. Aquasecurity Blogs
3. Control-plane/Andrew Martin @sublimino: 11 ways not to get hacked
4. Securekubernetes
5. Simulator: A distributed systems and infrastructure simulator for attacking and debugging Kubernetes

CVEs

1. CNCF Kubernetes Security Anatomy and the Recently Disclosed CVEs (CVE-2020-8555, CVE-2020-8552)
2. Kubernetes Vulnerability Puts Clusters at Risk of Takeover (CVE-2020-8558)

Other CKS related repos

1. Stackrox CKS study guide
2. Viktor Vedmich - CKS resources
3. Abdennour - CKS resources
4. Ibrahim Jelliti - CKS resources
5. Madhu Akula's Kubernetes Goat - vulnerable cluster environment to learn and practice Kubernetes security.
6. Kubernetes Capture the Flag vagrant environment - was hosted online on http://k8s-ctf.rocks/

参考资料：

walidshaari/Certified-Kubernetes-Security-Specialist