k8s-security-policies

Network policies enforce traffic rules between pods, blocking unwanted lateral movement. This Skill generates NetworkPolicy configurations that create precise allow/deny rules, letting you segment frontend-to-backend communication and isolate multi-tenant workloads in production clusters.

NetworkPolicy controls pod-to-pod traffic; PodSecurityPolicy enforces runtime restrictions and security contexts; RBAC manages user and service account permissions. This Skill automates all three, applying them together to achieve least-privilege access and meet CIS Benchmark compliance requirements.

Yes. This Skill generates RBAC templates that assign minimal permissions to users and service accounts, automating role and binding creation across namespaces. It eliminates manual configuration and ensures consistent least-privilege enforcement across your cluster.

Start with namespace isolation using labels, then apply default-deny network policies, pod security standards, and RBAC rules per tenant. This Skill generates production-ready policy definitions and admission control configurations, ensuring namespace-level security and tenant isolation at scale.

Yes. This Skill integrates Gatekeeper and OPA for centralized policy enforcement and auditing. It provides configuration templates that enforce admission control rules, allowing you to validate and block non-compliant workloads before they run.

Without policies, pods communicate freely, escalate privileges by default, and access is unrestricted—enabling lateral movement and privilege abuse. Security policies enforce network segmentation, runtime restrictions, and access control, preventing these attack vectors in production.