CKS — Pod Security Standards
Chapter 6 — Minimize Microservice Vulnerabilities (20%)
Pod Security is part of Domain 4 — Minimize Microservice Vulnerabilities, which carries 20% of the CKS exam score. This is one of the three major domains — together with Supply Chain Security (20%) and Monitoring, Logging & Runtime Security (20%) — that make up 60% of the entire exam.
This domain tests your ability to enforce security at the workload level: controlling what Pods can do, how containers run, what runtime isolation they get, and whether traffic between services is encrypted.
If an attacker compromises an application, the controls in this chapter determine how far they can go.
Why This Domain Is Critical
Attacker Compromise Path:
Application Exploit → Container Shell → ???
Without Pod Security:
Container Shell → Root access → Host filesystem → Node takeover → Cluster
With Pod Security:
Container Shell → Non-root user → No capabilities → Read-only FS
→ Sandboxed runtime → mTLS encrypted traffic
→ STOPPED at every layer
A single misconfigured Pod — running as root, with hostNetwork, or without Seccomp — can undo all your cluster hardening work. This chapter ensures every Pod follows the principle of least privilege.
What This Chapter Covers
| # | Topic | Focus | Link |
|---|---|---|---|
| 1 | Pod Security Standards (PSS) | Privileged, Baseline, Restricted — three security levels for Pods | Go → |
| 2 | Pod Security Admission (PSA) | Enforce, audit, warn modes — namespace-level policy enforcement | Go → |
| 3 | Security Contexts Deep Dive | runAsNonRoot, capabilities, readOnlyRootFilesystem, fsGroup | Go → |
| 4 | Container Runtime Sandboxing | gVisor, Kata Containers, RuntimeClass — isolation beyond namespaces | Go → |
| 5 | mTLS & Pod-to-Pod Encryption | Istio, Linkerd, PeerAuthentication — encrypt east-west traffic | Go → |
| 6 | Hands-On Lab | End-to-end exercises combining PSA, security contexts, sandboxing | Go → |
Exam Relevance
The CKS exam expects you to:
- Understand all three Pod Security Standards levels and when to apply each
- Configure Pod Security Admission on namespaces using labels
- Write security contexts that pass the Restricted level
- Know how RuntimeClass works for sandbox runtimes
- Understand mTLS concepts and service mesh basics
Exam Tip: Pod Security Admission replaced PodSecurityPolicy (removed in 1.25). The exam tests PSA, not PSP. Know the namespace labels and what each mode (enforce, audit, warn) does.
Domain 4 Coverage Map
| Sub-Topic | CKS Weight | Where Covered |
|---|---|---|
| Pod Security Standards & Admission | High | This chapter (Files 1–2) |
| Security Contexts | High | This chapter (File 3) |
| Runtime Sandboxing (gVisor, Kata) | Medium | This chapter (File 4) |
| mTLS / Service Mesh | Medium | This chapter (File 5) |
| OPA / Gatekeeper | High | Next chapter → |
Prerequisites
You should already be comfortable with:
- Kubernetes Pods, Deployments, Namespaces
- YAML manifests and
kubectl apply - Linux users, groups, and capabilities (from CKA)
- Container runtime basics (containerd, CRI)
| Previous | Up | Next |
|---|---|---|
| System Hardening Lab | CKS Home | Pod Security Standards |
