docs: add Kubernetes CKS study notes

kubernetes/cks/exam-by-claude/README.md

@@ -0,0 +1,37 @@
+# CKS Mock Exam — k8s v1.35
+
+Timed practice that mirrors the current CKS (17 tasks, 2h, six domains). Runs on kind (k8s v1.35.5) with the host-side / kernel bits on your Ubuntu VM.
+
+## Prereqs (Ubuntu VM)
+- docker, `kind >= v0.32.0`, `kubectl` v1.35, `helm`
+- host tools installed latest: `kube-bench`, `trivy`, `kubesec`, `falco` (v0.44.x), optional `cosign`
+- host must have AppArmor enabled (default on Ubuntu) for Task 7
+
+## Quickstart
+```bash
+chmod +x bootstrap.sh seed.sh
+./bootstrap.sh     # creates 'cks' cluster (1 cp + 2 workers) + ingress-nginx
+./seed.sh          # plants the target/vulnerable objects
+# set a 2h timer, open exam.md, go.
+```
+
+## Files
+- `kind-config.yaml` — cluster topology, v1.35.5 pinned digest, exam-files mount
+- `bootstrap.sh` — cluster + ingress controller + tooling checklist
+- `seed.sh` — objects for the kubectl-only tasks
+- `exam.md` — the 17 tasks (per-task setup + statement, no answers)
+- `answers/solutions.md` — worked solutions (don't peek until you've timed a full run)
+
+## Domain coverage (weights)
+Cluster Setup 15 · Cluster Hardening 15 · System Hardening 10 · Microservice Vuln 20 · Supply Chain 20 · Monitoring/Logging/Runtime 20.
+
+## Reset
+```bash
+kind delete cluster --name cks && ./bootstrap.sh && ./seed.sh
+```
+
+## Notes / kind caveats
+- **Version:** exam is on v1.35 per the Linux Foundation page. k8s 1.36 shipped ~May 2026; the exam env aligns "within 4–8 weeks" of a release, so it *may* have rolled to 1.36 by your date — verify on the LF exam page. Nothing in this set changes between 1.35/1.36. To bump: swap the digest in `kind-config.yaml` for a `kindest/node:v1.36.x` one.
+- **AppArmor** needs a real AppArmor host; works on Ubuntu, not on Docker Desktop/macOS.
+- **gVisor (Task 11)** pod stays Pending in kind (no `runsc` in kind's containerd) — the config is the graded artifact.
+- **ImagePolicyWebhook / audit / encryption** edit the live apiserver: always `cp` the manifest first so you can revert fast.