$ show killer-sh/cks-course-environment
This repository provides a comprehensive environment for the Certified Kubernetes Security Specialist (CKS) course. It contains shell scripts for setting up Kubernetes clusters (master and worker nodes) on Ubuntu 24.04, along with numerous Kubernetes manifests demonstrating security concepts including network policies, OPA/Gatekeeper admission control, runtime auditing, supply chain security, and system hardening. The repository serves as both instructional material and practical setup tools for learning Kubernetes security practices. The architecture consists of three main components: cluster setup scripts (bash), Kubernetes YAML manifests for various security demonstrations, and documentation files. Key entry points are the install_master.sh and install_worker.sh scripts which automate cluster provisioning. The course-content directory organizes security topics into separate directories with corresponding YAML examples that can be applied via kubectl. While primarily educational, the repository contains several highly reusable components that demonstrate advanced engineering practices, particularly in the area of container security profiles.
The LLM identified 3 files worth highlighting for reuse:
A comprehensive AppArmor profile for nginx containers that implements least-privilege access controls. It demonstrates advanced Linux security skills by granularly restricting filesystem access, network capabilities, and /proc interactions while allowing only necessary nginx operations. The profile is self-contained and can be reused for nginx containers with minimal modification.
A detailed seccomp profile that implements a default-deny policy for nginx containers, carefully selecting only the system calls required for nginx operation. It demonstrates expert-level understanding of Linux syscalls and security by including architecture-specific rules, conditional kernel version checks, and comprehensive syscall filtering. The profile is production-ready and can be extracted for use in any nginx container deployment.
A reusable OPA ConstraintTemplate that enforces required labels on Kubernetes resources. It demonstrates good Rego practices by separating the constraint logic from parameters, making it adaptable to different label requirements. The template follows the standard Gatekeeper structure and can be reused by modifying only the parameters schema and label validation logic.