k8s-security-policies

NetworkPolicy, RBAC, and Pod Security Standards enforce network isolation and least-privilege access by controlling traffic between pods, restricting user permissions to specific resources, and hardening container execution contexts. This Skill provides templates and patterns to implement these controls across namespaces and multi-tenant environments.

NetworkPolicy controls pod-to-pod traffic flow, PodSecurityPolicy (now Pod Security Standards) restricts container capabilities and privilege levels, and RBAC governs who can perform actions on which resources. Each layer addresses a distinct security domain: network, runtime, and access control.

Admission controllers like OPA Gatekeeper and Kyverno intercept and validate resource requests before they enter the cluster, enforcing security policies without manual intervention. This Skill covers admission control guidance and policy templates to prevent non-compliant workloads from running in production.

Yes, both OPA Gatekeeper and Kyverno are admission control engines that enforce policy-driven security. This Skill provides reference manifests and patterns to deploy and configure either tool to validate NetworkPolicy, Pod Security Standards, and RBAC compliance across your cluster.

You need a running Kubernetes cluster, kubectl access, understanding of RBAC concepts, and familiarity with network policies and pod security standards. This Skill provides ready-to-apply manifests and templates to codify these controls without requiring deep policy engine expertise.

Codifying security policies ensures consistent, repeatable enforcement across all clusters and namespaces, reduces configuration drift, enables version control and auditing, and supports multi-tenant isolation at scale. Policy-as-code makes security measurable and maintainable in production environments.