skills.rest
lurodrisilva
lurodrisilvaCOMMUNITY
Explore all skills by this author →
GitHub

kubernetes-security

Harden Kubernetes clusters across RBAC, secrets, network policy, supply chain, and runtime detection.

Updated Apr 11, 2026
Search Tags:#security#RBAC#Kubernetes#network policy#supply chain#hardening#falco
One-click install
npx skills add https://github.com/lurodrisilva/personal-skills --skill kubernetes-security-lurodrisilva
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kubernetes-security
Source: https://github.com/lurodrisilva/personal-skills/tree/main/security/kubernetes-security
Command: npx skills add https://github.com/lurodrisilva/personal-skills --skill kubernetes-security-lurodrisilva

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Kubernetes clusters ship with insecure defaults — unencrypted etcd secrets, flat networks, over-privileged RBAC, and unsigned images — and engineers lack a single threat-model-driven playbook for closing these gaps systematically. ## Core Features & Use Cases - Defense-in-depth guidance: Covers the 4Cs threat model, control plane and kubelet hardening, etcd encryption-at-rest, least-privilege RBAC, Pod Security Admission, supply-chain signing with Cosign/SLSA, admission policy (ValidatingAdmissionPolicy, Gatekeeper, Kyverno), zero-trust NetworkPolicy with Calico/Cilium, and runtime detection with Falco/Tetragon. - Read-only audit scripts: Ships five kubectl-based scripts under tools/ that flag cluster-admin bindings, missing PSA enforcement, flat namespaces, privileged workloads, and unpinned images. - Use Case: Before a compliance review, run tools/rbac-audit.sh and tools/netpol-coverage.sh against a cluster to surface wildcard RBAC grants and namespaces lacking default-deny policies, then apply the skill's remediation checklist. ## Quick Start Ask the AI to threat-model your Kubernetes cluster and audit it for privileged workloads, missing network policies, and unencrypted secrets.

Frequently Asked Questions about kubernetes-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden a Kubernetes cluster against common attacks?▼

Hardening a Kubernetes cluster starts with disabling anonymous API access, enabling audit logging, encrypting etcd secrets at rest with EncryptionConfiguration and KMS, and locking down the kubelet with --read-only-port=0 and Webhook authorization. Then enforce restricted Pod Security Admission and default-deny NetworkPolicies.

What is the difference between Gatekeeper, Kyverno, and ValidatingAdmissionPolicy?▼

ValidatingAdmissionPolicy is the in-tree, webhook-free option using CEL for lightweight native rules. OPA Gatekeeper uses Rego ConstraintTemplates for complex org-wide policy, while Kyverno offers YAML-native validate, mutate, generate, and verifyImages rules including built-in image signature verification.

How do I enforce default-deny NetworkPolicy in Kubernetes?▼

Create a NetworkPolicy with an empty podSelector and policyTypes listing both Ingress and Egress in each workload namespace, then add explicit allow rules such as DNS egress to CoreDNS. The included netpol-coverage.sh script flags namespaces that have pods but no NetworkPolicy at all.

Does seccompProfile RuntimeDefault require a kubelet flag?▼

No, setting seccompProfile: RuntimeDefault on a pod works on its own without any kubelet flag. The kubelet --seccomp-default flag is a separate convenience that only makes RuntimeDefault the cluster-wide default for pods that do not specify a profile.

Are the audit scripts safe to run against a production cluster?▼

Yes, all five scripts under tools/ are strictly read-only and only run kubectl get commands, never mutating the cluster. They need only cluster-reader RBAC, though you should review each script before running as they are starting points, not certified audits.

When should I use kubernetes-operations instead of this skill?▼

Use kubernetes-operations for day-to-day cluster operation such as applying RBAC or PSA labels, draining nodes, and scaling. This skill owns the security discipline: why controls exist, how they fail, and which attack chains they block.

Related Skills

Explore More Software Engineering Skills→
kcns008kcns008
25

developer-experience

Automate Kubernetes and OpenShift namespace provisioning and pod issue debugging.

Community
Intermediate
Omar-ObandoOmar-Obando
44

kubernetes-orchestration

Generates Kubernetes manifests for deploying and orchestrating containerized applications securely and scalably.

Community
Advanced
xalgordxalgord
954

implementing-image-provenance-verification-with-cosign

Sign and verify container image provenance using Sigstore Cosign with keyless OIDC signing and Kubernetes admission enforcement.

Community
Intermediate
xalgordxalgord
954

securing-azure-with-microsoft-defender

Configure Microsoft Defender for Cloud plans, Secure Score, and multi-cloud connectors for Azure workloads.

Community
Advanced