是一項專業(yè)前認(rèn)證,專為有興趣通過展示對 kubernetes 基礎(chǔ)知識和技能的理解而晉升到專業(yè)水平的候選人而設(shè)計。
此認(rèn)證非常適合學(xué)習(xí)或使用云原生技術(shù)的學(xué)生或有興趣使用云原生技術(shù)的學(xué)生。
經(jīng)過認(rèn)證的KCNA將確認(rèn)整個云原生生態(tài)系統(tǒng)的概念知識,特別是專注于Kubernetes。
KCNA 考試旨在為考生準(zhǔn)備使用云原生技術(shù)并進(jìn)一步獲得 CNCF 證書,包括 CKA、CKAD 和 CKS。
KCNA將展示候選人對Kubernetes和云原生技術(shù)的基本知識,包括如何使用基本的kubectl命令部署應(yīng)用程序,Kubernetes的架構(gòu)(容器,pod,節(jié)點,集群),了解云原生環(huán)境和項目(存儲,網(wǎng)絡(luò),GitOps,服務(wù)網(wǎng)格),以及了解云原生安全的原則。
適用于管理 Kubernetes 實例的 Kubernetes 管理員、云管理員和其他 IT 專業(yè)人員適用于管理 Kubernetes 實例的 Kubernetes 管理員、云管理員和其他 IT 專業(yè)人員。
CKA 由 Linux 基金會和云原生計算基金會 (CNCF) 創(chuàng)建,作為他們幫助開發(fā) Kubernetes 生態(tài)系統(tǒng)的持續(xù)努力的一部分。
該考試是一項在線、監(jiān)考、基于性能的測試,需要從運(yùn)行 Kubernetes 的命令行解決多個任務(wù)。
經(jīng)過認(rèn)證的 K8s 管理員已經(jīng)展示了執(zhí)行基本安裝以及配置和管理生產(chǎn)級 Kubernetes 集群的能力。
他們將了解關(guān)鍵概念,例如 Kubernetes 網(wǎng)絡(luò)、存儲、安全性、維護(hù)、日志記錄和監(jiān)控、應(yīng)用程序生命周期、故障排除、API 對象原語以及為最終用戶建立基本用例的能力。
適用于負(fù)責(zé)使用 Kubernetes 構(gòu)建、部署和配置云原生應(yīng)用程序的 Kubernetes 工程師、云工程師和其他 IT 專業(yè)人員。
CKAD 由 Linux 基金會和云原生計算基金會 (CNCF) 開發(fā),旨在通過標(biāo)準(zhǔn)化培訓(xùn)和認(rèn)證幫助擴(kuò)展 Kubernetes 生態(tài)系統(tǒng)。
本考試是一項在線、監(jiān)考、基于性能的考試,由一組要在命令行中解決的基于性能的任務(wù)(問題)組成。
CKAD 可以為 Kubernetes 設(shè)計、構(gòu)建和部署云原生應(yīng)用程序,
可以定義應(yīng)用程序資源并使用 Kubernetes 核心原語來創(chuàng)建/遷移、配置、公開和觀察可擴(kuò)展的應(yīng)用程序。
需要具備容器運(yùn)行時和微服務(wù)架構(gòu)的知識,需要熟悉:
使用容器映像、應(yīng)用云原生應(yīng)用程序概念和架構(gòu)、使用和驗證 Kubernetes 資源定義。
認(rèn)證 Kubernetes 安全專家 (CKS) 是一位成功的 Kubernetes 從業(yè)者(必須通過 CKA 認(rèn)證),能夠展示在構(gòu)建、部署和運(yùn)行時保護(hù)基于容器的應(yīng)用程序和 Kubernetes 平臺的廣泛最佳實踐方面的能力。
CKS 是一項基于實際操作能力的認(rèn)證考試,旨在測試考生在模擬的真實環(huán)境中對 Kubernetes 和云安全的了解。
考生必須參加并通過認(rèn)證 Kubernetes 管理員 (CKA) 考試,然后才能參加 CKS 考試??梢再徺I CKS,但在獲得 CKA 認(rèn)證之前不安排。
CKA認(rèn)證必須在安排CKS考試(包括重考)之日有效(未過期)。
獲得 CKS 表明候選人具備在構(gòu)建、部署和運(yùn)行時保護(hù)基于容器的應(yīng)用程序和 Kubernetes 平臺的必要能力,并且有資格在專業(yè)環(huán)境中執(zhí)行這些任務(wù)。
Kubernetes Fundamentals 46%
Container Orchestration 22%
Cloud Native Architecture 16%
Cloud Native Observability 8%
Cloud Native Application Delivery 8%
Kubernetes Resources
Kubernetes Architecture
Kubernetes API
Containers
Scheduling
Container Orchestration Fundamentals
Runtime
Security
Networking
Service Mesh
Storage
Autoscaling
Serverless
Community and Governance
Roles and Personas
Open Standards
Telemetry & Observability
Prometheus
Cost Management
Application Delivery Fundamentals
GitOps
CI/CD
Storage 10%
Troubleshooting 30%
Workloads & Scheduling 15%
Cluster Architecture, Installation & Configuration 25%
Services & Networking 20%
Understand storage classes, persistent volumes
Understand volume mode, access modes and reclaim policies for volumes
Understand persistent volume claims primitive
Know how to configure applications with persistent storage
Evaluate cluster and node logging
Understand how to monitor applications
Manage container stdout & stderr logs
Troubleshoot application failure
Troubleshoot cluster component failure
Troubleshoot networking
Understand deployments and how to perform rolling update and rollbacks
Use ConfigMaps and Secrets to configure applications
Know how to scale applications
Understand the primitives used to create robust, self-healing, application deployments
Understand how resource limits can affect Pod scheduling
Awareness of manifest management and common templating tools
Manage role based access control (RBAC)
Use Kubeadm to install a basic cluster
Manage a highly-available Kubernetes cluster
Provision underlying infrastructure to deploy a Kubernetes cluster
Perform a version upgrade on a Kubernetes cluster using Kubeadm
Implement etcd backup and restore
Understand host networking configuration on the cluster nodes
Understand connectivity between Pods
Understand ClusterIP, NodePort, LoadBalancer service types and endpoints
Know how to use Ingress controllers and Ingress resources
Know how to configure and use CoreDNS
Choose an appropriate container network interface plugin
Application Design and Build 20%
Application Deployment 20%
Application Observability and Maintenance 15%
Application Environment, Configuration and Security 25%
Services and Networking 20%
Define, build and modify container images
Understand Jobs and CronJobs
Understand multi-container Pod design patterns (e.g. sidecar, init and others)
Utilize persistent and ephemeral volumes
Use Kubernetes primitives to implement common deployment strategies (e.g. blue/green or canary)
Understand Deployments and how to perform rolling updates
Use the Helm package manager to deploy existing packages
Understand API deprecations
Implement probes and health checks
Use provided tools to monitor Kubernetes applications
Utilize container logs
Debugging in Kubernetes
Discover and use resources that extend Kubernetes (CRD)
Understand authentication, authorization and admission control
Understanding and defining resource requirements, limits and quotas
Understand ConfigMaps
Create & consume Secrets
Understand ServiceAccounts
Understand SecurityContexts
Demonstrate basic understanding of NetworkPolicies
Provide and troubleshoot access to applications via services
Use Ingress rules to expose applications
Cluster Setup 10%
Cluster Hardening 15%
System Hardening 15%
Minimize Microservice Vulnerabilities 20%
Supply Chain Security 20%
Monitoring, Logging and Runtime Security 20%
Use Network security policies to restrict cluster level access
Use CIS benchmark to review the security configuration of Kubernetes components (etcd, kubelet, kubedns, kubeapi)
Properly set up Ingress objects with security control
Protect node metadata and endpoints
Minimize use of, and access to, GUI elements
Verify platform binaries before deploying
Restrict access to Kubernetes API
Use Role Based Access Controls to minimize exposure
Exercise caution in using service accounts e.g. disable defaults, minimize permissions on newly created ones
Update Kubernetes frequently
Minimize host OS footprint (reduce attack surface)
Minimize IAM roles
Minimize external access to the network
Appropriately use kernel hardening tools such as AppArmor, seccomp
Setup appropriate OS level security domains
Manage Kubernetes secrets
Use container runtime sandboxes in multi-tenant environments (e.g. gvisor, kata containers)
Implement pod to pod encryption by use of mTLS
Minimize base image footprint
Secure your supply chain: whitelist allowed registries, sign and validate images
Use static analysis of user workloads (e.g.Kubernetes resources, Docker files)
Scan images for known vulnerabilities
Perform behavioral analytics of syscall process and file activities at the host and container level to detect malicious activities
Detect threats within physical infrastructure, apps, networks, data, users and workloads
Detect all phases of attack regardless where it occurs and how it spreads
Perform deep analytical investigation and identification of bad actors within environment
Ensure immutability of containers at runtime
Use Audit Logs to monitor access