skills.rest
haryelramalho
haryelramalhoCOMMUNITY
Explore all skills by this author →
Website𝕏@haryel_devGitHub

k8s-security-policies

Generate Kubernetes security policies for network segmentation, pod security, and RBAC.

Updated May 28, 2026
Search Tags:#security#rbac#kubernetes#istio#pod-security#gatekeeper#networkpolicy
One-click install
npx skills add https://github.com/haryelramalho/skills --skill k8s-security-policies-haryelramalho
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: k8s-security-policies
Source: https://github.com/haryelramalho/skills/tree/main/skills/community/k8s-security-policies
Command: npx skills add https://github.com/haryelramalho/skills --skill k8s-security-policies-haryelramalho

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you harden Kubernetes clusters by translating security requirements into practical policies that reduce attack surface and enforce consistent controls.

Core Features & Use Cases

  • Network isolation with default-deny and allow-list NetworkPolicy patterns.
  • Pod security hardening using privileged, baseline, and restricted Pod Security Standards plus secure securityContext settings.
  • Least-privilege access with Roles, ClusterRoles, and RoleBindings for users and service accounts.
  • Policy enforcement with OPA Gatekeeper and service mesh authorization examples.
  • Use case: Secure a production namespace so only approved frontend pods can reach backend services while DNS, ingress, and monitoring remain allowed.

Quick Start

Use this skill to design a secure Kubernetes policy set for a production namespace with default-deny networking, restricted pod security, and least-privilege RBAC.

Frequently Asked Questions about k8s-security-policies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Kubernetes NetworkPolicy for default-deny and allow-list traffic isolation?▼

Kubernetes NetworkPolicy default-deny configurations block all unspecified traffic, while allow-list patterns explicitly permit approved frontend pods to reach backend services while keeping DNS, ingress, and monitoring active. This skill generates those policy sets for production namespaces to enforce network segmentation.

What are the Pod Security Standards for hardening Kubernetes workloads?▼

Pod Security Standards harden Kubernetes workloads through privileged, baseline, and restricted policy profiles. This skill applies these profiles alongside secure securityContext settings to enforce pod security controls and reduce cluster attack surfaces in multi-tenant environments.

How do I set up least-privilege RBAC for Kubernetes service accounts?▼

Least-privilege RBAC for Kubernetes service accounts is configured using Roles, ClusterRoles, and RoleBindings. This skill translates security requirements into practical policies that grant users and service accounts only the specific permissions needed.

Can I use OPA Gatekeeper for Kubernetes admission control and policy enforcement?▼

Yes, OPA Gatekeeper can be used for Kubernetes admission control and policy enforcement. This skill provides OPA Gatekeeper examples to enforce consistent security controls and reduce attack surfaces across production clusters.

Does this approach support Istio service mesh authorization policies?▼

Yes, this approach supports Istio service mesh authorization policies. This skill includes service mesh protection examples to secure communications and enforce authorization alongside standard Kubernetes RBAC and NetworkPolicy controls.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

k8s-workload-hardening

Review and apply Pod Security Standards to harden Kubernetes workloads.

Community
Advanced
GoldenWing-360GoldenWing-360
15

kubernetes-security

Analyze Kubernetes cluster configurations for security weaknesses and hardening best practices.

Official
Advanced
Prompt-or-Die-LabsPrompt-or-Die-Labs
7

service-mesh-integrator

Configure Istio service mesh with mTLS, VirtualService routing, and DestinationRule policies.

Official
Intermediate
Tony363Tony363
19

agent-kubernetes-specialist

Manage Kubernetes clusters for secure, scalable cloud-native deployments.

Community
Advanced