skills.rest
SanketAdlak
SanketAdlakCOMMUNITY
Explore all skills by this author →
Website𝕏@devsanket14GitHub

k8s-security-policies

Implement Kubernetes NetworkPolicy, RBAC, and Pod Security Standards for cluster hardening.

Updated Apr 23, 2026
Search Tags:#rbac#kubernetes#istio#networkpolicy#opa gatekeeper#pod security#cluster security
One-click install
npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill k8s-security-policies-sanketadlak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: k8s-security-policies
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/k8s-security-policies
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill k8s-security-policies-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve? Securing Kubernetes clusters requires correctly configuring network isolation, access control, and pod security, which involves many interlocking YAML resources that are easy to misconfigure. This Skill provides ready-to-adapt manifests and patterns for defense-in-depth cluster security. ## Core Features & Use Cases - Network Segmentation: Apply NetworkPolicy templates including default-deny, DNS egress, frontend-to-backend, and cross-namespace rules. - Access Control: Configure RBAC Roles, ClusterRoles, and RoleBindings following least-privilege patterns for users and ServiceAccounts. - Pod Hardening & Policy Enforcement: Enforce Pod Security Standards, restricted security contexts, OPA Gatekeeper constraints, and Istio mTLS/AuthorizationPolicy. - Use Case: When onboarding a new production namespace, apply the default-deny NetworkPolicy, enable the restricted Pod Security Standard, and bind a least-privilege Role to the application's ServiceAccount. ## Quick Start Generate a default-deny NetworkPolicy and a restricted pod security configuration for my production namespace.

Frequently Asked Questions about k8s-security-policies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a default deny NetworkPolicy in Kubernetes?▼

Create a NetworkPolicy with an empty podSelector and both Ingress and Egress policyTypes to block all traffic in a namespace. Then add explicit allow policies, such as DNS egress to kube-system, so essential traffic still works.

How to configure least-privilege RBAC for a ServiceAccount?▼

Create a dedicated ServiceAccount per application, define a Role granting only the required verbs and resources, and bind them with a RoleBinding. Use resourceNames for fine-grained access and disable token auto-mounting when the API is not needed.

What is the difference between baseline and restricted Pod Security Standards?▼

Baseline prevents known privilege escalations while remaining minimally restrictive, whereas restricted enforces hardened practices like runAsNonRoot, seccomp, and dropped capabilities. Apply them per namespace using pod-security.kubernetes.io/enforce labels.

Why is my NetworkPolicy not working in Kubernetes?▼

NetworkPolicy only works if your CNI plugin supports it, so first verify the CNI on your nodes. Then inspect the policy with kubectl describe networkpolicy and confirm pod and namespace selectors match the intended labels.

How do I debug RBAC permission denied errors?▼

Use kubectl auth can-i with the --as flag to check effective permissions for a user or ServiceAccount, for example kubectl auth can-i list pods --as system:serviceaccount:default:my-sa. Also review RoleBindings and ClusterRoleBindings referencing that identity.

Related Skills

Explore More Software Engineering Skills→
pluginagentmarketplacepluginagentmarketplace
1

storage-networking

Provision Kubernetes storage and networking configurations across CSI drivers and CNI plugins.

Community
Advanced
altrupetsaltrupets

Security & Compliance Automation

Automate security and compliance checks for cloud-native environments using OPA, Trivy, and CIS benchmarks.

Official
Advanced
altrupetsaltrupets

Container Security

Automate container security with image scanning, runtime monitoring, and signing.

Official
Advanced
JhabbigJhabbig

k8s-security-policies

Implement Kubernetes security policies for network isolation, pod hardening, and access control.

Community
Advanced