skills.rest
Jhabbig
JhabbigCOMMUNITY
Explore all skills by this author →
GitHub

k8s-security-policies

Implement Kubernetes security policies for network isolation, pod hardening, and access control.

Updated Apr 5, 2026
Search Tags:#rbac#kubernetes#istio#gatekeeper#networkpolicy#pod-security-standards
One-click install
npx skills add https://github.com/Jhabbig/Habbig --skill k8s-security-policies-jhabbig
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: k8s-security-policies
Source: https://github.com/Jhabbig/Habbig/tree/main/.claude/plugins/wshobson/kubernetes-operations/skills/k8s-security-policies
Command: npx skills add https://github.com/Jhabbig/Habbig --skill k8s-security-policies-jhabbig

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and references (resource) components.

What problem does it solve?

This Skill helps teams secure Kubernetes clusters by turning security requirements into enforceable network, pod, and access-control policies instead of relying on manual review.

Core Features & Use Cases

  • Network Segmentation: Define default-deny and allowlist rules with NetworkPolicy to isolate services and reduce blast radius.
  • Pod Hardening: Apply Pod Security Standards and securityContext settings to keep workloads non-root and minimally privileged.
  • Access Control: Build least-privilege RBAC roles and bindings for users, service accounts, and automation pipelines.
  • Policy Enforcement: Use OPA Gatekeeper and Istio policies to enforce labels, mTLS, and service-to-service authorization.
  • Use Case: A platform engineer can secure a production namespace by combining namespace labels, ingress restrictions, and tightly scoped service account permissions.

Quick Start

Use this Skill to assess a Kubernetes namespace and generate production-ready security policies for network isolation, pod hardening, and least-privilege access.

Frequently Asked Questions about k8s-security-policies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce Kubernetes Pod Security Standards for non-root workloads?▼

To enforce Kubernetes Pod Security Standards, you apply securityContext settings to keep workloads non-root and minimally privileged. This hardens pods by restricting capabilities and preventing privileged execution within production namespaces.

How do I create default-deny NetworkPolicy rules to isolate services?▼

You create default-deny NetworkPolicy rules by defining allowlists that explicitly permit required traffic. This isolates services and significantly reduces the blast radius of potential security incidents across your cluster.

What is the best way to implement least-privilege RBAC for service accounts?▼

The best way to implement least-privilege RBAC is to build tightly scoped roles and bindings specifically for users, service accounts, and automation pipelines. This ensures components only have permissions strictly necessary for operation.

Can I use OPA Gatekeeper with Istio to enforce mTLS and authorization policies?▼

Yes, you can use OPA Gatekeeper with Istio to enforce mTLS and service-to-service authorization. This combination ensures strict policy enforcement for labels, traffic encryption, and access control in service meshes.

Does Kubernetes network segmentation work for multi-tenant environments?▼

Kubernetes network segmentation works effectively for multi-tenant environments by combining namespace labels, ingress restrictions, and NetworkPolicy. This isolates tenant workloads and enforces strict access control boundaries.

Related Skills

Explore More Software Engineering Skills→
CaneproCanepro

kubernetes-platform-architecture

Design Kubernetes platform architectures for production workloads.

Community
Advanced
gke-labsgke-labs
42

review-security-k8s-admission

Analyze Kubernetes admission webhooks and policies for security misconfigurations.

Official
Advanced
manutejmanutej
61

microservices-patterns

Automate Istio and Kubernetes microservices patterns for traffic, resilience, and security.

Community
Advanced
rajyeole6rajyeole6

agency-cloud-security-architect

Design and validate secure cloud-native architectures across AWS, Azure, and GCP.

Community
Advanced