skills.rest
notque
notqueCOMMUNITY
Explore all skills by this author →
GitHub

kubernetes-security

Generate Kubernetes RBAC, PodSecurity, and NetworkPolicy manifests for cluster hardening.

415|44|Updated Mar 18, 2026
Search Tags:#rbac#kubernetes#secrets#supply chain security#yaml manifests#networkpolicy#podsecurity
One-click install
npx skills add https://github.com/notque/vexjoy-agent --skill kubernetes-security-notque
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kubernetes-security
Source: https://github.com/notque/vexjoy-agent/tree/main/skills/infrastructure/kubernetes-security
Command: npx skills add https://github.com/notque/vexjoy-agent --skill kubernetes-security-notque

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill reduces the risk of compromised Kubernetes workloads by ensuring least-privilege RBAC, enforcing pod hardening, isolating network traffic, and protecting secrets and supply chain integrity.

Core Features & Use Cases

  • RBAC least-privilege hardening: Generates Roles, RoleBindings, and ServiceAccount practices that prevent overbroad Kubernetes access.
  • PodSecurity-compliant workload configuration: Applies non-root, restricted securityContext settings and image hardening patterns.
  • Network isolation with default-deny policies: Produces NetworkPolicy manifests for ingress/egress isolation and required DNS egress.
  • Supply chain and secret security controls: Adds guidance for cosign signing, admission controls (e.g., Kyverno), and safer secret handling (Sealed Secrets / External Secrets).

Use it when you need to secure a new namespace or retrofit production hardening so that common misconfigurations are detected and blocked.

Quick Start

Ask: "Secure my Kubernetes namespace by generating RBAC, restricted pod security settings, and a default-deny NetworkPolicy with DNS egress."

Frequently Asked Questions about kubernetes-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure least-privilege RBAC for a Kubernetes namespace?▼

To configure least-privilege RBAC for a Kubernetes namespace, generate specific Roles and RoleBindings bound to dedicated ServiceAccounts. This prevents overbroad cluster access by restricting workload permissions to only the required resources and verbs.

What is a default-deny NetworkPolicy and how does it isolate pods?▼

A default-deny NetworkPolicy isolates pods by blocking all ingress and egress traffic by default. You then explicitly allow required connections, such as DNS egress, ensuring strict network reachability controls between workloads.

How do I enforce PodSecurity restricted policies for non-root containers?▼

Enforce PodSecurity restricted policies by applying non-root securityContext settings in your YAML manifests. This hardens container runtimes by preventing privileged escalation and requiring strict volume and capability configurations.

Can I use Kyverno admission controls with cosign for Kubernetes supply chain security?▼

Yes, you can use Kyverno admission controls with cosign image signing to secure your Kubernetes supply chain. This combination verifies image signatures during deployment, blocking untrusted or unsigned containers from running.

What is the best way to manage Kubernetes secrets safely during deployment?▼

The best way to manage Kubernetes secrets safely is by using Sealed Secrets or External Secrets. These tools protect sensitive data in your YAML manifests by encrypting it at rest and preventing plaintext exposure in version control.

Does this approach validate existing Kubernetes manifests against common security misconfigurations?▼

Yes, this approach validates existing Kubernetes manifests against common security misconfigurations. It detects and blocks insecure patterns during deployment or remediation, ensuring your cluster posture meets hardening requirements.

Related Skills

Explore More Software Engineering Skills→
haxlyshaxlys

k8s-security-policies

Generate and enforce Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security policies.

Community
Advanced
iulianditaiuliandita
2

kubernetes

Write and review Kubernetes manifests, Helm charts, and cluster architecture.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
rajyeole6rajyeole6

agency-cloud-security-architect

Design and validate secure cloud-native architectures across AWS, Azure, and GCP.

Community
Advanced