skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

lf-cks

Guides Kubernetes security hardening and CKS certification preparation using CNCF curriculum and CIS Benchmark.

Updated Jun 5, 2026
Search Tags:#security#rbac#kubernetes#networkpolicy#cis-benchmark#cks#falco
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill lf-cks-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: lf-cks
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/lf-cks
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill lf-cks-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Preparing for the Certified Kubernetes Security Specialist (CKS) exam and hardening production clusters requires mastering a broad, layered security model — RBAC, Pod Security Standards, NetworkPolicy, supply chain signing, runtime detection, and etcd encryption — which is difficult to navigate without a structured framework. ## Core Features & Use Cases - Defense-in-Depth Framework: Covers the full trust boundary chain (User → API → AuthN/AuthZ → Admission → Workload → Network → Storage → Runtime) with per-domain mindset guidance mapped to CKS exam weights. - Domain Reference Guides: Nine reference documents covering authentication/RBAC, workload security (PSS, seccomp, AppArmor), supply chain (Cosign, SBOM, SLSA), runtime defense (Falco, audit logging, crictl), network segmentation, data encryption (KMS v2), cluster isolation, and CIS Benchmark compliance. - Exam Strategy & Decision Frameworks: Provides a 3-pass exam strategy, common gotchas (DNS traps in NetworkPolicy, non-retroactive PSA labels), and security-vs-operability tradeoff tables. - Use Case: When designing a NetworkPolicy for a multi-tier application, load the network-security reference to apply default-deny patterns, allow DNS egress to CoreDNS, and block cloud metadata access via ipBlock. ## Quick Start Ask the agent to help you design a restricted Pod Security Standard configuration and NetworkPolicy for a production namespace using the CKS skill.

Frequently Asked Questions about lf-cks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prepare for the CKS certification exam?▼

CKS preparation requires an active CKA certification, then study across six weighted domains: cluster setup, hardening, system hardening, microservice vulnerabilities, supply chain, and runtime monitoring. Use a 3-pass exam strategy and practice with the killer.sh simulator.

How do I enforce Pod Security Standards in Kubernetes?▼

Apply Pod Security Admission labels to namespaces, such as pod-security.kubernetes.io/enforce=restricted. Start in warn or audit mode before enforcing, since labels are not retroactive and only affect newly created pods.

Why do pods fail DNS resolution after applying NetworkPolicy?▼

A default-deny egress NetworkPolicy blocks DNS queries to CoreDNS in kube-system. You must explicitly add an egress rule allowing traffic to CoreDNS on port 53, or pods cannot resolve service names.

What is the difference between seccomp and AppArmor?▼

Seccomp filters which system calls a container can make, while AppArmor restricts file and network access through mandatory access control profiles. They are complementary controls, not substitutes for each other.

Should I use KMS v1 or KMS v2 for etcd encryption?▼

Use KMS v2 for production clusters. KMS v1 is deprecated and lacks key ID visibility, status reporting, and native key rotation, all of which KMS v2 provides for encryption at rest.

When should I use OPA Gatekeeper versus Kyverno for admission control?▼

Use PSA labels for basic Pod Security Standards enforcement, OPA Gatekeeper for complex custom policies written in Rego, and Kyverno when you need mutation capabilities with simpler YAML-based policies.

Related Skills

Explore More Software Engineering Skills→
personamanagmentlayerpersonamanagmentlayer
41

kubernetes-expert

Provide Kubernetes cluster management commands and YAML manifest examples.

Official
Advanced
jayjpatel9717jayjpatel9717

container-security

Scan Docker images and audit Kubernetes clusters for security vulnerabilities.

Community
Advanced
xalgordxalgord
954

securing-container-registry-images

Secures container registry images with vulnerability scanning, signing, and CI/CD enforcement gates.

Community
Intermediate
lloydchanglloydchang
2

manage-certificates

Automate TLS certificate provisioning, rotation, and auditing across AWS, Azure, GCP, and on-premises clusters.

Community
Advanced