Habilidades k8s-security-policies

🔒

k8s-security-policies

Name: k8s-security-policies
Author: sickn33

Seguro

Implement Kubernetes Security Policies

Também disponível em: wshobson

Secure your Kubernetes clusters with production-ready network policies, RBAC configurations, and pod security standards. This skill provides comprehensive templates and best practices for defense-in-depth security.

Suporta: Claude Codex Code(CC)

🥈 78 Prata

Baixar o ZIP da skill

Upload no Claude

Vá em Configurações → Capacidades → Skills → Upload skill

Ative e comece a usar

Testar

A utilizar "k8s-security-policies". Create a default deny NetworkPolicy for the production namespace

Resultado esperado:

A complete NetworkPolicy manifest with empty podSelector and both Ingress and Egress policy types, blocking all traffic by default

A utilizar "k8s-security-policies". Generate RBAC for a deployment manager role

Resultado esperado:

A Role with permissions for deployments (full CRUD) and pods (read-only), plus a RoleBinding to attach users or service accounts

Auditoria de Segurança

Seguro

v1 • 2/25/2026

All static analyzer findings are false positives. The skill contains documentation and YAML templates for Kubernetes security configurations. Network pattern detections reference metadata endpoint blocking (security best practice), and external command findings are bash examples in Markdown documentation, not executable code.

Arquivos analisados

715

Linhas analisadas

achados

Total de auditorias

Nenhum problema de segurança encontrado

Auditado por: claude

Pontuação de qualidade

Arquitetura

100

Manutenibilidade

Conteúdo

Comunidade

100

Segurança

Conformidade com especificações

O Que Você Pode Construir

DevSecOps Engineer

Implement network isolation between microservices and enforce least-privilege access controls for CI/CD pipelines

Platform Team Lead

Establish security baselines and compliance controls across multi-tenant Kubernetes clusters

Security Auditor

Review and validate existing Kubernetes security configurations against CIS benchmarks and NIST frameworks

Tente Estes Prompts

Basic Network Policy

Create a NetworkPolicy that allows frontend pods to communicate with backend pods on port 8080 in the production namespace

RBAC for Service Account

Generate RBAC configuration for a service account that needs read-only access to ConfigMaps in the default namespace

Pod Security Standards

Configure namespace labels to enforce restricted Pod Security Standards with audit and warn modes

Complete Security Setup

Create a comprehensive security configuration including default deny NetworkPolicy, RBAC for developers, and Pod Security Standards for a new production namespace

Melhores Práticas

Start with default deny NetworkPolicies, then explicitly allow required traffic
Apply least-privilege principle for RBAC - grant minimum permissions needed
Use dedicated ServiceAccounts for each application instead of default ServiceAccount

Evitar

Using wildcard (*) permissions in RBAC for production workloads
Running containers as root or with privileged security context
Allowing unrestricted egress traffic without explicit NetworkPolicy rules

Perguntas Frequentes

What CNI plugins support NetworkPolicy?

Popular CNIs with NetworkPolicy support include Calico, Cilium, Weave Net, and Antrea. Check your cluster documentation for compatibility.

How do I test NetworkPolicy changes safely?

Apply policies in audit or warn mode first, use kubectl auth can-i for RBAC testing, and test in non-production environments before deploying.

What is the difference between Role and ClusterRole?

Roles are namespace-scoped and grant permissions within a single namespace. ClusterRoles are cluster-wide and can grant permissions across all namespaces.

Are Pod Security Policies still available?

Pod Security Policies are deprecated since Kubernetes 1.21 and removed in 1.25. Use Pod Security Standards with namespace labels instead.

How do I allow DNS traffic with NetworkPolicy?

Create an egress rule allowing UDP port 53 to the kube-system namespace where DNS pods typically run.

Can I block access to cloud metadata endpoints?

Yes, use NetworkPolicy egress rules with ipBlock.except to block 169.254.169.254/32, preventing pods from accessing AWS/Azure metadata services.