KCSA — Kubernetes Cluster Component Security
Welcome to Chapter 3 — Kubernetes Cluster Component Security
Chapters 1 and 2 covered the why and the what of cloud native security. Now we go deeper — into the heart of the Kubernetes cluster itself.
This chapter focuses on the critical control plane and node-level components that keep your cluster running — and how to lock them down. If an attacker compromises any of these components, the entire cluster is at risk.
At 22% of the KCSA exam, this is the single largest domain. Expect more questions from this chapter than any other. Master it.
What This Chapter Covers
Every Kubernetes cluster is built on a set of core components — the API server, etcd, kubelet, container runtime, and the mechanisms that tie them together. Each one has its own attack surface and its own set of security controls.
In this chapter, you’ll learn:
- How the API server handles authentication, authorization, and admission control — the three gates every request must pass
- Why etcd is the single most sensitive component in the cluster and how to protect it
- How kubelet and container runtimes can be hardened at the node level
- The reality of Kubernetes Secrets — what they actually protect (and what they don’t)
- How audit logging and monitoring give you visibility into who did what, and when
Think of these components as the walls, gates, and watchtowers of your castle. If the gates are wide open or the watchtowers are unmanned, it doesn’t matter how good your application security is.
Chapter Topics
| # | Topic | Description |
|---|---|---|
| 1 | API Server Security | Authentication, authorization, admission control pipeline |
| 2 | etcd Security | Encryption at rest, access control, backup security |
| 3 | Kubelet & Container Runtime Security | Kubelet authentication, CRI security, node protection |
| 4 | Kubernetes Secrets Management | Secret types, encryption, external secret managers |
| 5 | Audit Logging & Monitoring | Audit policies, log levels, security monitoring |
After covering all five topics, test yourself with the Practice Questions.
KCSA Exam Relevance
| Detail | Info |
|---|---|
| Exam Domain | Kubernetes Cluster Component Security |
| Weight | 22% |
| Question Types | Multiple-choice, conceptual |
22% makes this the most heavily tested domain on the entire KCSA exam. You can expect questions about:
- The order of the API server request flow (authentication → authorization → admission control)
- Which authentication methods and authorization modes Kubernetes supports
- The difference between mutating and validating admission controllers
- How etcd encryption at rest works and which providers are available
- Kubelet authentication and why anonymous access must be disabled
- How Kubernetes Secrets are stored and their limitations
- Audit policy levels and what each one captures
This domain is where conceptual understanding meets real cluster architecture. Don’t just memorize flags — understand why each security control exists and what it protects against.
Prerequisites
Before diving in, make sure you’re comfortable with:
- Chapter 1 — Kubernetes Security Fundamentals (threat landscape, attack surfaces, security principles)
- Chapter 2 — Cloud Native Security Overview (4Cs model, shared responsibility, supply chain security)
- Basic understanding of Kubernetes architecture (control plane, worker nodes, Pods)
- Familiarity with TLS, certificates, and basic cryptography concepts
How to Use This Chapter
- Read each topic in order — API server security sets the foundation for everything that follows
- Pay special attention to the tables — they summarize exactly the kind of comparisons the exam tests
- Understand the flags and configurations — KCSA won’t ask you to configure them, but you need to know what they do
- Take the practice quiz at the end — it covers all five topics with exam-style questions
- Revisit weak areas before moving on to Chapter 4
Ready?
Let’s start with the most important component in the entire cluster — the API server.
