skills.rest
GoldenWing-360
GoldenWing-360OFFICIAL
Explore all skills by this author →
WebsiteGitHub

kubernetes-security

Analyze Kubernetes cluster configurations for security weaknesses and hardening best practices.

15|Updated May 12, 2026
Search Tags:#security#RBAC#kubernetes#secrets management#network policy#cluster hardening#admission controller
One-click install
npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill kubernetes-security-goldenwing-360
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kubernetes-security
Source: https://github.com/GoldenWing-360/claude-security-skills/tree/main/kubernetes-security
Command: npx skills add https://github.com/GoldenWing-360/claude-security-skills --skill kubernetes-security-goldenwing-360

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps administrators and DevOps teams harden and secure Kubernetes clusters by providing best practices, security controls, and compliance checks.

Core Features & Use Cases

  • Cluster Baseline Hardening: Ensures Kubernetes version support, API endpoint restrictions, audit logging, and encryption at rest.
  • Pod Security Standards Enforcement: Guides the application of Privileged, Baseline, and Restricted security levels per namespace.
  • RBAC Setup and Validation: Assists in implementing minimal privilege RBAC policies, detecting over-permissioned ServiceAccounts, and auditing ClusterRoleBindings.
  • NetworkPolicy Deployment: Establishes default-deny policies and explicit ingress/egress rules to isolate workloads.
  • Secrets Management: Recommends secure secrets handling via external secret management solutions, avoiding raw Secrets in env vars.
  • Admission Controllers Enforcement: Promotes policies with Kyverno or Gatekeeper to prevent non-compliant resource creation.
  • Image Hygiene: Supports image scanning, signing enforcement, and pinning images by digest or version.
  • Cluster Hygiene and Audit: Provides scripts to audit for common misconfigurations, privilege escalations, and insecure pod deployment practices.

Quick Start

Use the security insights to verify cluster version support, enable audit logs, and enforce Pod Security Standards across namespaces.

Frequently Asked Questions about kubernetes-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce Pod Security Standards across Kubernetes namespaces?▼

To enforce Pod Security Standards in Kubernetes, apply Privileged, Baseline, and Restricted security levels per namespace. This ensures workloads operate with appropriate limitations, preventing privilege escalation and insecure pod deployment practices across the cluster environment.

What's the best way to set up default-deny NetworkPolicy in Kubernetes?▼

The best way to establish Kubernetes NetworkPolicy is by deploying default-deny policies alongside explicit ingress and egress rules. This isolates workloads effectively, ensuring only approved traffic flows between pods within the cluster.

How do I audit over-permissioned ServiceAccounts in Kubernetes RBAC?▼

Auditing over-permissioned ServiceAccounts in Kubernetes RBAC involves implementing minimal privilege policies and reviewing ClusterRoleBindings. This identifies excessive permissions, reducing the attack surface and ensuring service accounts have only necessary access.

Can I use Kyverno or Gatekeeper admission controllers to prevent non-compliant Kubernetes resource creation?▼

Yes, you can use Kyverno or Gatekeeper admission controllers to enforce policies in Kubernetes. These admission controllers prevent non-compliant resource creation, ensuring cluster configurations meet security standards before deployment.

When do I need external secrets management solutions instead of raw Kubernetes Secrets?▼

You need external secrets management solutions when avoiding raw Kubernetes Secrets in environment variables. This approach recommends secure secrets handling, preventing sensitive data exposure and improving overall cluster secrets hygiene.

How do I check if my Kubernetes cluster has encryption at rest and audit logging enabled?▼

Checking for encryption at rest and audit logging involves verifying cluster baseline hardening configurations. This includes validating Kubernetes version support, API endpoint restrictions, and ensuring audit logs are active for continuous security monitoring.

Related Skills

Explore More Software Engineering Skills→
sayalinvidiasayalinvidia

dynamo-recipe-runner

Validate and patch existing Dynamo Kubernetes recipes, then deploy and smoke-test endpoints.

Community
Advanced
AngelP17AngelP17
1

k8s-security-policies

Implement Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security controls.

Community
Advanced
Probably-GroupProbably-Group
3

devsecops-expert

Embed secret scanning, SAST, SCA, SBOM, and image signing into CI/CD pipelines.

Official
Advanced
zzw4257zzw4257

kube-bench

Audit Kubernetes clusters against the CIS Kubernetes Benchmark.

Community
Intermediate