Hands-on Lab·Certified Kubernetes Security Specialist
Threat Detection Across Cluster Layers
The competency asks you to detect threats across infrastructure, apps, networks, data and users. This guide does one small thing to a cluster and then hunts for it from every vantage point that exists, which is the fastest way to learn what each layer is for.
Monitoring and Runtime Guide 37 of 40 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 15 min
containerd 2.2.6 and the kubelet's own log layout on disk. Nothing here needs a tool that is not already on the node.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA6001 | 192.168.0.46 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA6001-NODE01 | 192.168.0.47 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA6001-NODE02 | 192.168.0.48 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when detection has to be assessed across layers rather than in one place. This matters because a single action shows up at some layers and not others - and knowing which is the difference between having coverage and assuming it.
- performing one action, and then going looking for it deliberately
- checking the Kubernetes layer, then the workload layer where it actually lives
- checking the runtime layer, with two separate inventories of the same node
- scoring three vantage points against one question
Before you start
- guide 36 - the same question asked about a whole attack.
-
One action, then go looking for it
-
The Kubernetes layer, and the workload layer
-
The runtime layer
-
The scoreboard