skills.rest
gke-labs
gke-labsOFFICIAL
Explore all skills by this author →
GitHub

review-security-k8s-nodes

Analyzes Kubernetes manifests for node boundary violations and privilege escalation risks.

42|32|Updated May 7, 2026
Search Tags:#security#audit#rbac#kubernetes#manifests#node-security
One-click install
npx skills add https://github.com/gke-labs/kube-agents --skill review-security-k8s-nodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-security-k8s-nodes
Source: https://github.com/gke-labs/kube-agents/tree/main/.agents/skills/review-security-k8s-nodes
Command: npx skills add https://github.com/gke-labs/kube-agents --skill review-security-k8s-nodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill identifies critical security misconfigurations in Kubernetes manifests that could allow attackers to escalate privileges from a compromised pod to the underlying node or the entire cluster.

Core Features & Use Cases

  • Boundary Violation Detection: Flags dangerous hostPath mounts that expose sensitive node directories or container runtime sockets.
  • RBAC & NodeRestriction Analysis: Detects overprivileged node groups and improper impersonation roles that bypass standard security boundaries.
  • Scheduling Risk Assessment: Identifies broad tolerations that could allow untrusted workloads to execute on sensitive control-plane nodes.

Quick Start

Use the review-security-k8s-nodes skill to scan the deployment manifests in the current directory for potential node privilege escalation risks.

Frequently Asked Questions about review-security-k8s-nodes

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Kubernetes manifests for node privilege escalation risks?▼

Auditing Kubernetes manifests for node privilege escalation involves analyzing hostPath mounts, RBAC permissions, and scheduling tolerations to detect boundary violations and prevent node-to-cluster compromise.

How does hostPath mount usage expose Kubernetes node security vulnerabilities?▼

Dangerous hostPath mounts expose sensitive node directories or container runtime sockets, creating a boundary violation vector that allows attackers to escalate privileges from a compromised pod to the underlying node.

Can broad scheduling tolerations allow untrusted workloads on Kubernetes control-plane nodes?▼

Yes, broad scheduling tolerations can allow untrusted workloads to execute on sensitive control-plane nodes, posing a significant scheduling risk to overall cluster integrity and security boundaries.

What Kubernetes RBAC misconfigurations bypass NodeRestriction security boundaries?▼

Overprivileged node groups and improper impersonation roles bypass standard security boundaries, allowing attackers to escalate privileges and compromise the entire Kubernetes cluster via node access.

Do I need a live Kubernetes cluster to scan manifests for node security misconfigurations?▼

No, you do not need a live cluster. You can directly scan local deployment manifest files in your current directory to evaluate configurations against established security best practices.

Related Skills

Explore More Software Engineering Skills→
sandeshbagmaresandeshbagmare

k8s-manifest-generator

Generate Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets.

Community
Advanced
stolostronstolostron

add-team-member

Add a user to the Submariner team's Konflux RBAC with updated Web UI and cluster permissions.

Official
Intermediate
camoneartcamoneart
5

k8s-security-policies

Implement Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC configurations.

Community
Advanced
YukiIto1999YukiIto1999

detecting-privilege-escalation-in-kubernetes-pods

Audit Kubernetes pod security contexts and generate privilege escalation reports.

Community
Advanced