# clhlc/cks_prepare architecture

> Architecture diagram of the GitHub repository clhlc/cks_prepare, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/clhlc/cks_prepare
- Repository: https://github.com/clhlc/cks_prepare

## Overview

CKS Prepare is a collection of Kubernetes security study materials, not an application with an evidenced runtime pipeline. The likely user workflow is to study the topic-specific guides and examples as preparation for the CKS exam. The tree shows capabilities across admission, access control, workload security, auditing, and assessment tools; source excerpts were not provided, so relationships between those topics are omitted.

Main entry points: [`01.ImagePolicyWebhook/Readme.md`](https://github.com/clhlc/cks_prepare/blob/main/01.ImagePolicyWebhook/Readme.md) (Image policy webhook), [`02.ClusterRole/README.md`](https://github.com/clhlc/cks_prepare/blob/main/02.ClusterRole/README.md) (ClusterRole), [`03.Secrets/README.md`](https://github.com/clhlc/cks_prepare/blob/main/03.Secrets/README.md) (Secrets), [`06.ServiceAccount/README.md`](https://github.com/clhlc/cks_prepare/blob/main/06.ServiceAccount/README.md) (ServiceAccount)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_admission_access["Admission and access"]
  node_image_policy["Image policy webhook<br/>[Readme.md]"]
  node_cluster_role["ClusterRole<br/>[README.md]"]
  node_secrets["Secrets<br/>[README.md]"]
  node_service_account["ServiceAccount<br/>[README.md]"]
  node_role["Role<br/>[README.md]"]
end

subgraph group_workload_security["Workload security"]
  node_network_policy["Network policy<br/>[README.md]"]
  node_apparmor["AppArmor<br/>[README.md]"]
  node_runtime_class["RuntimeClass<br/>[README.md]"]
  node_pod_security_policy["Pod security policy<br/>[README.md]"]
end

subgraph group_audit_assessment["Audit and assessment"]
  node_trivy["Trivy<br/>[README.md]"]
  node_kube_bench["kube-bench<br/>[README.md]"]
  node_audit["Kubernetes audit<br/>[README.md]"]
  node_sysdig["Sysdig<br/>[README.md]"]
end

subgraph group_platform_hardening["Platform hardening"]
  node_dockerfile_pod["Dockerfile Pod<br/>[README.md]"]
  node_container["Container<br/>[README.md]"]
  node_api_server["API server<br/>[README.md]"]
end

node_learner(("CKS learner"))

node_learner -->|"studies"| node_image_policy
node_learner -->|"studies"| node_cluster_role
node_learner -->|"studies"| node_secrets
node_learner -->|"studies"| node_service_account
node_learner -->|"studies"| node_role
node_learner -->|"studies"| node_network_policy
node_learner -->|"studies"| node_apparmor
node_learner -->|"studies"| node_runtime_class
node_learner -->|"studies"| node_pod_security_policy
node_learner -->|"studies"| node_trivy
node_learner -->|"studies"| node_kube_bench
node_learner -->|"studies"| node_audit
node_learner -->|"studies"| node_sysdig
node_learner -->|"studies"| node_dockerfile_pod
node_learner -->|"studies"| node_container
node_learner -->|"studies"| node_api_server

click node_image_policy "https://github.com/clhlc/cks_prepare/blob/main/01.ImagePolicyWebhook/Readme.md"
click node_cluster_role "https://github.com/clhlc/cks_prepare/blob/main/02.ClusterRole/README.md"
click node_secrets "https://github.com/clhlc/cks_prepare/blob/main/03.Secrets/README.md"
click node_service_account "https://github.com/clhlc/cks_prepare/blob/main/06.ServiceAccount/README.md"
click node_role "https://github.com/clhlc/cks_prepare/blob/main/16.Role/README.md"
click node_network_policy "https://github.com/clhlc/cks_prepare/blob/main/04.NetworkPolicy/README.md"
click node_apparmor "https://github.com/clhlc/cks_prepare/blob/main/05.AppArmor/README.md"
click node_runtime_class "https://github.com/clhlc/cks_prepare/blob/main/07.RuntimeClass/README.md"
click node_pod_security_policy "https://github.com/clhlc/cks_prepare/blob/main/08.PodSecurityPolicy/README.md"
click node_trivy "https://github.com/clhlc/cks_prepare/blob/main/09.Trivy/README.md"
click node_kube_bench "https://github.com/clhlc/cks_prepare/blob/main/10.kube-bench/README.md"
click node_audit "https://github.com/clhlc/cks_prepare/blob/main/13.Audit/README.md"
click node_sysdig "https://github.com/clhlc/cks_prepare/blob/main/14.Sysdig/README.md"
click node_dockerfile_pod "https://github.com/clhlc/cks_prepare/blob/main/11.Dockerfile-Pod/README.md"
click node_container "https://github.com/clhlc/cks_prepare/blob/main/12.Container/README.md"
click node_api_server "https://github.com/clhlc/cks_prepare/blob/main/15.API-Server/README.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_image_policy,node_cluster_role,node_secrets,node_service_account,node_role toneBlue
class node_network_policy,node_apparmor,node_runtime_class,node_pod_security_policy toneAmber
class node_trivy,node_kube_bench,node_audit,node_sysdig toneMint
class node_dockerfile_pod,node_container,node_api_server toneRose
class node_learner toneIndigo
```

## Components

### Admission and access

- [Image policy webhook](https://github.com/clhlc/cks_prepare/blob/main/01.ImagePolicyWebhook/Readme.md): `01.ImagePolicyWebhook/Readme.md`
- [ClusterRole](https://github.com/clhlc/cks_prepare/blob/main/02.ClusterRole/README.md): `02.ClusterRole/README.md`
- [Secrets](https://github.com/clhlc/cks_prepare/blob/main/03.Secrets/README.md): `03.Secrets/README.md`
- [ServiceAccount](https://github.com/clhlc/cks_prepare/blob/main/06.ServiceAccount/README.md): `06.ServiceAccount/README.md`
- [Role](https://github.com/clhlc/cks_prepare/blob/main/16.Role/README.md): `16.Role/README.md`

### Workload security

- [Network policy](https://github.com/clhlc/cks_prepare/blob/main/04.NetworkPolicy/README.md): `04.NetworkPolicy/README.md`
- [AppArmor](https://github.com/clhlc/cks_prepare/blob/main/05.AppArmor/README.md): `05.AppArmor/README.md`
- [RuntimeClass](https://github.com/clhlc/cks_prepare/blob/main/07.RuntimeClass/README.md): `07.RuntimeClass/README.md`
- [Pod security policy](https://github.com/clhlc/cks_prepare/blob/main/08.PodSecurityPolicy/README.md): `08.PodSecurityPolicy/README.md`

### Audit and assessment

- [Trivy](https://github.com/clhlc/cks_prepare/blob/main/09.Trivy/README.md): `09.Trivy/README.md`
- [kube-bench](https://github.com/clhlc/cks_prepare/blob/main/10.kube-bench/README.md): `10.kube-bench/README.md`
- [Kubernetes audit](https://github.com/clhlc/cks_prepare/blob/main/13.Audit/README.md): `13.Audit/README.md`
- [Sysdig](https://github.com/clhlc/cks_prepare/blob/main/14.Sysdig/README.md): `14.Sysdig/README.md`

### Platform hardening

- [Dockerfile Pod](https://github.com/clhlc/cks_prepare/blob/main/11.Dockerfile-Pod/README.md): `11.Dockerfile-Pod/README.md`
- [Container](https://github.com/clhlc/cks_prepare/blob/main/12.Container/README.md): `12.Container/README.md`
- [API server](https://github.com/clhlc/cks_prepare/blob/main/15.API-Server/README.md): `15.API-Server/README.md`

### Other components

- **CKS learner**

## Connections

- CKS learner → Image policy webhook: studies
- CKS learner → ClusterRole: studies
- CKS learner → Secrets: studies
- CKS learner → ServiceAccount: studies
- CKS learner → Role: studies
- CKS learner → Network policy: studies
- CKS learner → AppArmor: studies
- CKS learner → RuntimeClass: studies
- CKS learner → Pod security policy: studies
- CKS learner → Trivy: studies
- CKS learner → kube-bench: studies
- CKS learner → Kubernetes audit: studies
- CKS learner → Sysdig: studies
- CKS learner → Dockerfile Pod: studies
- CKS learner → Container: studies
- CKS learner → API server: studies