CKS — System Hardening
Chapter 5 — System Hardening (15%)
System Hardening is Domain 3 of the CKS exam and carries 15% of the total score. This domain tests your ability to lock down the underlying OS, manage cloud identity, restrict network exposure, and enforce kernel-level security with AppArmor and Seccomp.
A running Kubernetes cluster is only as secure as the hosts that run it. If an attacker escapes a container, a hardened node limits what they can do next. Every topic in this chapter reduces the blast radius of a compromise.
What This Chapter Covers
| # | Topic | Focus | Link |
|---|---|---|---|
| 1 | Minimize Host OS Footprint | Remove packages, disable services, minimal images, SSH hardening | Go → |
| 2 | IAM Roles | Cloud IAM integration, IRSA, Workload Identity, least privilege | Go → |
| 3 | Minimize External Access | Restrict NodePort, internal API server, bastion hosts, VPN | Go → |
| 4 | AppArmor | Mandatory Access Control, profile modes, Pod annotations | Go → |
| 5 | Seccomp | Syscall filtering, RuntimeDefault, custom profiles | Go → |
| 6 | Hands-On Lab | End-to-end exercises combining all topics | Go → |
Exam Relevance
The CKS exam expects you to:
- Reduce attack surfaces on worker nodes
- Configure AppArmor and Seccomp profiles on Pods
- Restrict network access to and from the cluster
- Apply the principle of least privilege at every layer
Exam Tip: AppArmor and Seccomp questions are almost guaranteed. Practice loading profiles, applying them to Pods, and verifying enforcement — all from the command line.
Prerequisites
You should already be comfortable with:
- Linux system administration (systemctl, apt/yum, SSH)
- Kubernetes Pods, Deployments, and Services
kubectland YAML manifests- Basic networking (ports, protocols, firewalls)
| Previous | Up | Next |
|---|---|---|
| Supply Chain Security Lab | CKS Home | Minimize Host OS Footprint |
