k8s-security-policiescommit 47a5dbcSKILL.md · Hardening
Kubernetes Security Policies
Implements defense-in-depth for Kubernetes clusters with NetworkPolicy, Pod Security Standards, RBAC, OPA Gatekeeper and Istio mTLS.
The troubleshooting commands need kubectl credentials for the target cluster.
npx skills add wshobson/agents --skill k8s-security-policiesCommand selected. Copy it manually.
- Permissions
- read-repo
- write-files
- shell
- network
- Compatible with
- Claude Code, Codex, Cursor, Copilot, OpenCode
- GitHub
- 42.1k
- Source
- Community · Seth Hobson
- Status
- Scan passed
- License
- MIT
- Category
- Hardening
Core rule
Apply least-privilege RBAC to every service account and layer it with Pod Security Standards and network policies for defense in depth.
Execution Phases
Phase 01Set Pod Security Standards
Label namespaces with privileged, baseline or restricted levels for enforce, audit and warn.
Phase 02Write network policies
Start from default-deny ingress and egress, then allow specific traffic such as frontend-to-backend and DNS.
Phase 03Least-privilege RBAC
Define Roles and ClusterRoles with only the verbs needed and bind them to users and service accounts.
Phase 04Harden pods and admission
Run as non-root with a read-only root filesystem and all capabilities dropped; enforce rules with OPA Gatekeeper and enable Istio mTLS and AuthorizationPolicy.
Phase 05Troubleshoot
If a NetworkPolicy has no effect, check CNI support and describe it; for RBAC denials, check effective permissions with kubectl auth can-i.
Permissions (summarised from SKILL.md)
| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Writes YAML manifests for NetworkPolicy, RBAC, pod security contexts, Gatekeeper and Istio. |
| Command execution | Limited | Only uses diagnostic kubectl commands such as get, describe and auth can-i when troubleshooting. |
| Network outbound | Limited | Only talks to the target Kubernetes cluster API through kubectl. |
SKILL.md frontmatter (YAML)
---
name: k8s-security-policies
description: Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
---