Pass the CKS Exam with Confidence: Master These Essential Kubernetes Security Commands

Everything you need to remember for the CKS exam — a practical command guide with real-world examples.

4-8 minutes(980 words)complex

Difficulty: Advanced
Estimated Time: 25-35 minutes
Prerequisites: Kubernetes fundamentals, kubectl CLI experience, Linux command line, container runtime basics

Introduction

The CKS (Certified Kubernetes Security Specialist) exam is hands-on, time-constrained, and demands real knowledge of how to secure and troubleshoot Kubernetes environments.

One of the keys to passing is being able to quickly recall and execute critical commands for:

Pod security Runtime inspection Network access checks Secrets management RBAC & audit analysis TLS, AppArmor, and image scanning

This article is your CKS battle card — a real-world cheat sheet packed with must-know CLI commands to help you practice, revise, and shine during the exam.

Let's break down everything you need to remember, use, and apply for CKS success.

Core File Paths to Remember

Here's how to open and edit those important Kubernetes configuration files using vi in Bash

# Static Pod manifest of the API server (used with kubeadm)
vi /etc/kubernetes/manifests/kube-apiserver.yaml
# Main kubelet configuration file
vi /var/lib/kubelet/config.yaml

CRI (Container Runtime Interface) Deep Dive

Here's a clean list of e Bash commands:

watch crictl ps
crictl pods --name <podname>
crictl ps --pod <pod-id>
crictl ps -a | grep <pod_id>
crictl ps -id f86cd629e71c
crictl pods | grep <pod name>
crictl inspect <pod_id> | grep param
crictl inspect <container_id> | grep args -A1
crictl inspect <container_id> | grep pid
strace -p <pid>

AppArmor & Node Hardening

Here are the corresponding Bash commands for AppArmor management with descriptions as comments:

# Load an AppArmor profile quietly
sudo apparmor_parser -q ./profile

# Check the current AppArmor status
sudo apparmor_status
# Label a Kubernetes node to enable AppArmor enforcement
kubectl label node <node> security=apparmor

Pod Debugging & Access

Here's the list of Bash commands

# Get detailed pod information including node and IP
kubectl get pod -o wide
# Run curl inside a specific pod in a namespace
kubectl -n <namespace> exec <pod> -- curl <endpoint>
# Export pod logs to a local file
kubectl logs <pod> > /path/to/logs
# Get interactive shell access inside a pod
kubectl -n <ns> exec -it <pod> -- sh
# View environment variables of a running pod
kubectl -n <ns> exec <pod> -- env

Want me to group all these command sets into one file or script?

Secrets etcd Access

Here's the Bash command

# Retrieve a Kubernetes secret directly from etcd and view it in a readable hex+ASCII format
ETCDCTL_API=3 etcdctl \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
get /registry/secrets/default/secret1 | hexdump -C

This command reads a raw secret (secret1 in the default namespace) directly from etcd and pipes it through hexdump -C to make the binary output human-readable.

SBOM & Image Scanning

Here's the clean list of Bash commands with comments describing each:

# Scan a container image for vulnerabilities
trivy image nginx:1.16
# Generate a Software Bill of Materials (SBOM) in CycloneDX format
trivy image --format cyclonedx --output sbom.json nginx:1.16
# Scan an existing SBOM file for vulnerabilities
trivy sbom --format json sbom.json
# Generate an SBOM using Kubernetes toolchain (bom tool)
bom generate --image registry.k8s.io/kube-apiserver:<tag>

Do you want a combined script to automate all of this for a given image?

Read-Only Filesystem & Hardening Pods

securityContext:
  readOnlyRootFilesystem: true
volumeMounts:
- mountPath: /tmp
  name: temp-vol
volumes:
- name: temp-vol
  emptyDir: {}

Prevent writing to root filesystem and enforce least privilege.

Kubernetes Resource Creation (YAML Templates)

Here are the Bash commands with inline comments explaining each:

# Generate a Pod template YAML without creating it
kubectl run pod-name --dry-run=client -o yaml > file.yaml
# Generate a Deployment template YAML without creating it
kubectl create deploy name --dry-run=client -o yaml > file.yaml

System Monitoring & Upgrade

Here's the list of relevant Bash commands with inline comments for system and Kubernetes upgrades:

# View kernel ring buffer messages (can be run inside a pod)
dmesg
# Inspect which process is using which port
netstat -plnt | grep <port>
# Show the upgrade plan for Kubernetes control-plane components
kubeadm upgrade plan
# Apply the planned upgrade to the control-plane
kubeadm upgrade apply
# Prepare a node for upgrade by safely evicting pods (excluding daemonsets)
kubectl drain <node> --ignore-daemonsets
# Mark the node as schedulable again after upgrade
kubectl uncordon <node>

RBAC & Access Audit

Here are the Bash commands with inline comments for RBAC inspection:

# Check if a specific user has permission to get secrets
kubectl auth can-i get secrets --as user
# List all ClusterRoleBindings in YAML and filter for entries related to "gianna"
kubectl get clusterrolebinding -o yaml | grep gianna

Would you like to expand this with how to trace a user's permissions across roles and bindings?

Ingress TLS & Secrets

Here are the Bash commands with comments for TLS setup in Kubernetes:

# Create a TLS secret in the 'team-pink' namespace using a certificate and key
kubectl -n team-pink create secret tls tls-secret --key tls.key --cert tls.crt
# Edit the 'secure' ingress in 'team-pink' namespace to attach the TLS secret
kubectl -n team-pink edit ingress secure

Would you like an example Ingress YAML with the TLS section pre-configured?

Cluster Security Benchmarks

Tool	Usage
`kube-bench run --targets=master`	CIS benchmark master node
`kube-bench run --targets=node`	CIS benchmark worker node

Bonus Tips

Use k config get-contexts -o name > contexts.txt to back up context info Use sha512sum binary + diff to validate file integrity Use falco and auditd to detect suspicious behavior

Conclusion

Kubernetes security and observability don't have to be overwhelming. With the right tools and commands, you can detect vulnerabilities, secure your pods, debug your nodes, and enforce best practices.

Whether you're upgrading clusters, inspecting runtime syscalls, or performing an RBAC audit — this cheat sheet will keep you ahead of the curve.

Bookmark it. Share it. Secure your cluster like a boss.

Service Mesh Tool Selection Guide

Mastering Kubernetes Scalability