# Kubernetes Security Policies (k8s-security-policies)

> Implements defense-in-depth for Kubernetes clusters with NetworkPolicy, Pod Security Standards, RBAC, OPA Gatekeeper and Istio mTLS.

- Category: [Hardening](https://www.myskills.tools/en/categories/hardening/)
- Source: Community · Seth Hobson
- Repository: https://github.com/wshobson/agents/tree/main/plugins/kubernetes-operations/skills/k8s-security-policies (commit 47a5dbc)
- SKILL.md: https://github.com/wshobson/agents/blob/main/plugins/kubernetes-operations/skills/k8s-security-policies/SKILL.md
- Install command: `npx skills add wshobson/agents --skill k8s-security-policies`
- License: MIT
- Compatible with: Claude Code, Codex, Cursor, Copilot, OpenCode
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.
- ⚠ The troubleshooting commands need kubectl credentials for the target cluster.

## Core rule

Apply least-privilege RBAC to every service account and layer it with Pod Security Standards and network policies for defense in depth.

## Execution Phases

1. **Set Pod Security Standards** — Label namespaces with privileged, baseline or restricted levels for enforce, audit and warn.
2. **Write network policies** — Start from default-deny ingress and egress, then allow specific traffic such as frontend-to-backend and DNS.
3. **Least-privilege RBAC** — Define Roles and ClusterRoles with only the verbs needed and bind them to users and service accounts.
4. **Harden pods and admission** — Run as non-root with a read-only root filesystem and all capabilities dropped; enforce rules with OPA Gatekeeper and enable Istio mTLS and AuthorizationPolicy.
5. **Troubleshoot** — If a NetworkPolicy has no effect, check CNI support and describe it; for RBAC denials, check effective permissions with kubectl auth can-i.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Writes YAML manifests for NetworkPolicy, RBAC, pod security contexts, Gatekeeper and Istio. |
| Command execution | Limited | Only uses diagnostic kubectl commands such as get, describe and auth can-i when troubleshooting. |
| Network outbound | Limited | Only talks to the target Kubernetes cluster API through kubectl. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: k8s-security-policies
description: Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/k8s-security-policies/