Exam
CKS
CKS · Cluster Hardening
Enable Istio Sidecar Injection and Enforce STRICT mTLS
Istio is installed in the cluster. Deployment target-app runs in namespace app-ns, but the namespace was never enabled for sidecar injection, so its pods are not in the mesh.
Live lab access
This task description is public. Live practice requires full access unless this is the selected free weekly task. See this week's free task.
Create an account to continue →
On a phone? Read the task and create your account here, then sign in on a desktop or laptop for the terminal lab. Nothing starts until you choose Start.
The task
Task
Istio is installed in the cluster. Deployment target-app runs in namespace app-ns, but the namespace was never enabled for sidecar injection, so its pods are not in the mesh.
Requirements
- Enable Istio sidecar injection on namespace
app-ns(the namespace label documented on Istio's sidecar-injection page) - Roll the
target-appworkload so its pods are recreated and would be admitted with the sidecar injected - existing pods are never injected retroactively - Create a
PeerAuthenticationnameddefaultin namespaceapp-nsthat enforces STRICT mutual TLS for the whole namespace
Note
This lab ships the Istio security CRDs without the istiod webhook, so no istio-proxy container is literally added to the pods - do not wait for 2/2. Grading checks the work you do: the namespace label, the re-roll, and the policy.
What this tests
Restrict RBAC and service accounts, tighten API server flags, and keep the cluster patched. On the CKS exam, Cluster Hardening tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
The public description lets you study the task before signing up. Full access includes this live lab; the selected Task of the Week is free with an account. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). You can open the solution while practising, then retry and use the failed checks to improve your score.