Certified Kubernetes Security Specialist (CKS): key terms

Flashcards for this exam Certified Kubernetes Security Specialist (CKS) guide

• Admission ControllerA Kubernetes API server plugin that intercepts requests after authentication and authorization to validate or mutate objects before persistence.Advanced
• Artifact SigningCryptographically signing build artifacts or container images so consumers can verify their origin and integrity.Advanced
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• Container Network Interface (CNI)A CNCF specification and plugin model for configuring network interfaces for containers, used by Kubernetes for pod networking.Intermediate
• Container RuntimeThe software that runs containers on a host, such as containerd, CRI-O, or the low-level runc.Intermediate
• CosignSigstore's command-line tool for signing, verifying and attaching attestations to container images and other OCI artifacts.Advanced
• Distroless ImageA minimal container image containing only the application and its runtime dependencies, without a shell or package manager.Advanced
• Ephemeral ContainerA temporary container added to a running pod for interactive troubleshooting with kubectl debug.Advanced
• etcdA distributed, consistent key-value store that holds all Kubernetes cluster state.Intermediate
• hostPathA Kubernetes volume type that mounts a file or directory from the node's filesystem into a pod.Advanced
• Image DigestThe immutable sha256 content hash that uniquely identifies a specific container image manifest.Intermediate
• Image ScanningAnalyzing container images for known vulnerabilities, misconfigurations, secrets, and license issues.Intermediate
• Image SigningCryptographically signing container images so deployment systems can verify their origin and integrity before running them.Intermediate
• Infrastructure as Code ScanningStatic analysis of Terraform, CloudFormation, Kubernetes manifests, Helm charts and similar templates for security misconfigurations before deployment.Intermediate
• kube-apiserverThe Kubernetes component that exposes the REST API and is the front end and only component that talks directly to etcd.Intermediate
• kubectlThe Kubernetes command-line tool for interacting with the API server to create, inspect, update, and delete resources.Foundational
• Kubernetes SecretA Kubernetes object for storing small amounts of sensitive data such as passwords, tokens, and TLS keys.Foundational
• Kubernetes Security ContextPod and container settings that define privilege and access controls, such as user ID, privilege escalation, capabilities and filesystem permissions.Advanced
• KyvernoA CNCF Kubernetes-native policy engine that validates, mutates, generates, and verifies resources using policies written as YAML.Advanced
• Linux NamespacesA Linux kernel feature that isolates process views of system resources such as PIDs, network, mounts, users, IPC, and hostnames.Advanced
• Multi-Stage BuildA Dockerfile technique using multiple FROM stages so build tools stay in early stages and only needed artifacts are copied to the final image.Intermediate
• Mutual TLS (mTLS)TLS in which both client and server present and verify certificates, providing two-way authentication and encryption.Intermediate
• Network PolicyA Kubernetes resource that controls allowed ingress and egress traffic for selected pods at the IP and port level.Intermediate
• Open Policy Agent (OPA)A CNCF graduated general-purpose policy engine that evaluates policies written in Rego against JSON input.Advanced
• Pod Security Standards (PSS)Three Kubernetes security profiles (Privileged, Baseline, Restricted) enforced per namespace by the built-in Pod Security Admission controller.Advanced
• Policy as CodeExpressing security, compliance, and operational policies in code that is versioned and automatically evaluated.Intermediate
• Privileged ContainerA container run with all host capabilities and device access, effectively removing isolation from the host.Intermediate
• Role-Based Access Control (RBAC)The Kubernetes authorization mode that grants permissions through Roles/ClusterRoles bound to users, groups, or service accounts.Intermediate
• Rootless ContainerA container run by an unprivileged user, using user namespaces so root inside the container maps to a non-root host user.Advanced
• Runtime Container SecurityMonitoring running containers and hosts for anomalous or malicious behavior such as unexpected processes, file changes or network connections.Advanced
• SeccompA Linux kernel feature that restricts which system calls a process may make, reducing kernel attack surface for containers.Advanced
• Security ContextPod- and container-level Kubernetes settings that define privilege and access controls such as user ID, capabilities, and read-only filesystems.Advanced
• Service AccountA Kubernetes identity for processes running in pods to authenticate to the API server and, via federation, to cloud services.Intermediate
• Service MeshAn infrastructure layer that manages service-to-service communication with traffic management, mTLS security, and observability, usually via proxies.Intermediate
• SigstoreAn open-source project (OpenSSF) providing free tooling and public infrastructure for signing and verifying software artifacts.Advanced
• TrivyAn open-source security scanner from Aqua Security for container images, file systems, Git repositories, Kubernetes and IaC.Intermediate