skills.rest
google
googleOFFICIAL
Explore all skills by this author →
Website𝕏@GoogleOSSGitHub

gke-platform-security

Configures and hardens platform-level GKE cluster security controls and IAM roles.

19.1k|1.5k|Updated Mar 31, 2026
Search Tags:#rbac#kubernetes#iam#gke#security hardening#Secret Manager#shielded nodes
One-click install
npx skills add https://github.com/google/skills --skill gke-platform-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gke-platform-security
Source: https://github.com/google/skills/tree/main/skills/cloud/gke-platform-security
Command: npx skills add https://github.com/google/skills --skill gke-platform-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Securing a Google Kubernetes Engine cluster at the platform level involves many scattered controls—Secret Manager add-ons, RBAC hardening, Shielded Nodes, GKE Sandbox, Binary Authorization, and IAM roles—and misconfiguring any of them leaves the cluster exposed. This Skill consolidates golden-path security defaults and verified gcloud commands into one operational reference.

Core Features & Use Cases

  • Golden Path Security Defaults: A Day-0/Day-1 configuration table covering Workload Identity Federation, Secret Manager rotation, insecure RBAC binding blocks, Shielded Nodes, and metadata concealment.
  • Cluster Hardening Commands: Ready-to-run gcloud commands to enable Secret Manager with rotation, disable insecure legacy RBAC bindings, enable Binary Authorization, Shielded Nodes, and the GKE Sandbox (gVisor) runtime.
  • IAM Role Guidance: A comparison of the five most common GKE IAM roles (container.admin, clusterAdmin, developer, viewer, clusterViewer) with least-privilege recommendations, plus cross-service authentication patterns for granting Google Service Accounts access to Cloud Storage, Cloud SQL, and Pub/Sub.
  • Use Case: A platform engineer onboarding a new production GKE cluster uses this Skill to verify Secret Manager is enabled, audit clusterrolebindings for insecure system:authenticated grants, and enable Shielded Nodes before handing the cluster to application teams.

Quick Start

Ask the agent to audit my GKE cluster's platform security settings and enable the golden-path hardening controls such as Secret Manager, Shielded Nodes, and secure RBAC bindings.

Frequently Asked Questions about gke-platform-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden GKE cluster security at the platform level?▼

Enable the golden-path defaults: Workload Identity Federation, Secret Manager add-on with 120s rotation, Shielded Nodes with secure boot and integrity monitoring, and GKE_METADATA mode. Also disable insecure RBAC bindings for system:authenticated and system:unauthenticated groups.

How to enable Secret Manager add-on on a GKE cluster?▼

Run gcloud container clusters update with --enable-secret-manager and --secret-manager-rotation-interval=120s. Verify with gcloud container clusters describe checking the secretManagerConfig.enabled field.

What is the difference between GKE platform security and workload security?▼

Platform security covers cluster-level controls like RBAC hardening, Shielded Nodes, Binary Authorization, and IAM roles. Workload-level controls such as Workload Identity bindings, SecretProviderClass mounts, Network Policies, and Pod Security Standards belong to the gke-workload-security skill.

Which GKE IAM role should I assign to developers?▼

Assign roles/container.developer for deploying workloads to existing clusters, following least privilege. Use roles/container.viewer for read-only access and reserve roles/container.admin for platform team admins managing cluster lifecycle.

Does enabling GKE Sandbox automatically sandbox my pods?▼

No. Enabling GKE Sandbox at the cluster level only makes the gVisor runtime available. Pods must explicitly set runtimeClassName: gvisor in their specs, which is covered by the gke-workload-security skill.

How do I audit GKE RBAC bindings for insecure permissions?▼

Check the cluster's rbacBindingConfig via gcloud container clusters describe, then review bindings with kubectl get clusterrolebindings,rolebindings --all-namespaces or the k8s:get_k8s_resource MCP tool. Use kubectl auth can-i --list --as=<user> to audit effective permissions.

Related Skills

Explore More Software Engineering Skills→
googlegoogle
17.1k

gke-security

Configure GKE cluster security with Workload Identity, RBAC, and IAM roles.

Official
Advanced
YukiIto1999YukiIto1999

securing-kubernetes-on-cloud

Apply layered security controls to managed Kubernetes clusters on cloud platforms.

Community
Advanced
brucebanner010198-commitsbrucebanner010198-commits

gke-basics

Plan and provision production GKE Autopilot clusters with golden path security defaults.

Community
Intermediate
googlegoogle
17.1k

gke-multitenancy

Configure GKE multi-tenancy with namespaces, RBAC, quotas, and network policies.

Official
Advanced