KCSA — Platform Security
Platform Security
The Platform Security domain accounts for 16% of the KCSA exam. This domain tests your understanding of how to harden the underlying platform that Kubernetes runs on — from the operating system and container runtime to admission control, image assurance, and multi-tenancy boundaries.
Platform security is not about application code — it is about the infrastructure, tooling, and policies that ensure workloads run in a hardened, trustworthy environment.
What You Will Learn
This chapter covers the five core areas of platform security that the KCSA exam expects you to understand.
| # | Topic | Description |
|---|---|---|
| 1 | Node & OS Hardening | CIS benchmarks, minimal OS, kernel security |
| 2 | Runtime Security & Sandboxing | gVisor, Kata Containers, Seccomp, AppArmor |
| 3 | Admission Controllers & Policy Engines | OPA/Gatekeeper, Kyverno, validating/mutating webhooks |
| 4 | Image Assurance & Pipeline Security | CI/CD security, image scanning in pipelines, signing gates |
| 5 | Multi-Tenancy & Isolation | Namespace isolation, virtual clusters, hard vs soft tenancy |
After completing all five sub-topics, test yourself with the Practice Questions.
Why This Domain Matters
Kubernetes does not run in a vacuum. It runs on operating systems, uses container runtimes, pulls images from registries, and often serves multiple teams or customers from the same cluster. Each of these layers introduces attack surface.
Platform security ensures that:
- Nodes are hardened against compromise (a compromised node means compromised pods)
- Runtimes provide adequate isolation between containers and the host kernel
- Admission control enforces policies before workloads reach the cluster
- Images are scanned, signed, and verified before deployment
- Tenants are isolated so that one team cannot affect another
The KCSA exam asks conceptual questions about these areas — you need to know what tools and techniques exist, why they matter, and when to use each one.
Prerequisites
Before starting this chapter, make sure you are comfortable with:
- Chapter 1 — Overview of Cloud Native Security (4Cs model, defense in depth)
- Chapter 2 — Kubernetes Cluster Component Security (API server, etcd, kubelet)
- Chapter 3 — Kubernetes Security Fundamentals (RBAC, SecurityContext, NetworkPolicy)
- Chapter 4 — Pod & Network Security (PSA, network policies, pod security)
- Chapter 5 — Compliance and Security Frameworks (governance, audit)
- Chapter 6 — Kubernetes Threat Model (STRIDE, attack surface, mitigations)
These chapters provide the foundation that platform security builds upon.
Exam Tips
- Know the CIS Kubernetes Benchmark categories and what kube-bench does.
- Understand the difference between gVisor and Kata Containers — their isolation approaches and trade-offs.
- Be able to compare OPA/Gatekeeper vs Kyverno — policy language, features, and use cases.
- Know the image signing and verification workflow with tools like cosign.
- Understand multi-tenancy models — namespace-per-tenant vs cluster-per-tenant and the isolation mechanisms at each level.
Ready to Begin?
Start with the first topic to understand how to harden the nodes and operating systems your cluster runs on.
