k8s-security
Provides security auditing for K8s RBAC, secrets, and policy compliance.
Install
mkdir -p .claude/skills/k8s-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/7136" && unzip -o skill.zip -d .claude/skills/k8s-security && rm skill.zipInstalls to .claude/skills/k8s-security
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Audit Kubernetes RBAC, enforce policies, and manage secrets. Use for security reviews, permission audits, policy enforcement with Kyverno/Gatekeeper, and secret management.Key capabilities
- →Audit RBAC permissions
- →Enforce security policies
- →Manage Kubernetes secrets
- →Verify network isolation
How it works
It utilizes specific tools to audit roles, bindings, network policies, and security policies to ensure cluster compliance.
Inputs & outputs
When to use k8s-security
- →Auditing RBAC permissions
- →Reviewing secret access controls
- →Verifying network policy isolation
About this skill
Kubernetes Security
Security auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.
When to Apply
Use this skill when:
- User mentions: "security", "RBAC", "permissions", "policy", "audit", "secrets"
- Operations: security review, permission check, policy enforcement
- Keywords: "who can", "access control", "compliance", "vulnerable"
Priority Rules
| Priority | Rule | Impact | Tools |
|---|---|---|---|
| 1 | Check cluster-admin bindings first | CRITICAL | get_cluster_role_bindings |
| 2 | Audit secrets access permissions | CRITICAL | Review role rules |
| 3 | Verify network isolation | HIGH | get_network_policies |
| 4 | Check policy compliance | HIGH | kyverno_*, gatekeeper_* |
| 5 | Review pod security contexts | MEDIUM | describe_pod |
Quick Reference
| Task | Tool | Example |
|---|---|---|
| List roles | get_roles | get_roles(namespace) |
| Cluster roles | get_cluster_roles | get_cluster_roles() |
| Role bindings | get_role_bindings | get_role_bindings(namespace) |
| Service accounts | get_service_accounts | get_service_accounts(namespace) |
| Kyverno policies | kyverno_clusterpolicies_list_tool | kyverno_clusterpolicies_list_tool() |
RBAC Auditing
List Roles and Bindings
get_roles(namespace)
get_cluster_roles()
get_role_bindings(namespace)
get_cluster_role_bindings()
Check Service Account Permissions
get_service_accounts(namespace)
Common RBAC Patterns
| Pattern | Risk Level | Check |
|---|---|---|
| cluster-admin binding | Critical | get_cluster_role_bindings() |
| Wildcard verbs (*) | High | Review role rules |
| secrets access | High | Check get/list on secrets |
| pod/exec | High | Allows container access |
See RBAC-PATTERNS.md for detailed patterns and remediation.
Policy Enforcement
Kyverno Policies
kyverno_policies_list_tool(namespace)
kyverno_clusterpolicies_list_tool()
kyverno_policy_get_tool(name, namespace)
OPA Gatekeeper
gatekeeper_constraints_list_tool()
gatekeeper_constraint_get_tool(kind, name)
gatekeeper_templates_list_tool()
Common Policies to Enforce
| Policy | Purpose |
|---|---|
| Disallow privileged | Prevent root containers |
| Require resource limits | Prevent resource exhaustion |
| Restrict host namespaces | Isolate from node |
| Require labels | Ensure metadata |
| Allowed registries | Control image sources |
Secret Management
List Secrets
get_secrets(namespace)
Secret Best Practices
- Use external secret managers (Vault, AWS SM)
- Encrypt secrets at rest (EncryptionConfiguration)
- Limit secret access via RBAC
- Rotate secrets regularly
Network Policies
List Policies
get_network_policies(namespace)
Cilium Network Policies
cilium_policies_list_tool(namespace)
cilium_policy_get_tool(name, namespace)
Default Deny Template
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
Security Scanning Workflow
-
RBAC Audit
get_cluster_role_bindings() get_roles(namespace) -
Policy Compliance
kyverno_clusterpolicies_list_tool() gatekeeper_constraints_list_tool() -
Network Isolation
get_network_policies(namespace) cilium_endpoints_list_tool(namespace) -
Pod Security
get_pods(namespace) describe_pod(name, namespace)
Multi-Cluster Security
Audit across clusters:
get_cluster_role_bindings(context="production")
get_cluster_role_bindings(context="staging")
Automated Audit Script
For comprehensive security audit, see scripts/audit-rbac.py.
Related Tools
- RBAC:
get_roles,get_cluster_roles,get_role_bindings - Policy:
kyverno_*,gatekeeper_* - Network:
get_network_policies,cilium_policies_* - Istio:
istio_authorizationpolicies_list_tool,istio_peerauthentications_list_tool
Related Skills
- k8s-policy - Policy management
- k8s-cilium - Cilium network security
When not to use it
- →When the cluster lacks security policy controllers
- →When performing non-security related cluster tasks
Prerequisites
Limitations
- →Requires appropriate permissions to list roles and policies
- →Limited by the scope of installed security tools
How it compares
It provides a structured security-focused audit workflow rather than general cluster management.
Compared to similar skills
k8s-security side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| k8s-security (this skill) | 1 | 6mo | Review | Advanced |
| k8s-policy | 1 | 6mo | Review | Advanced |
| container-security-testing | 1 | 7mo | Review | Intermediate |
| k8s-certs | 1 | 6mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by rohitg00
View all by rohitg00 →You might also like
k8s-policy
rohitg00
Kubernetes policy management with Kyverno and Gatekeeper. Use when enforcing security policies, validating resources, or auditing policy compliance.
container-security-testing
Ed1s0nZ
容器安全测试的专业技能和方法论
k8s-certs
rohitg00
Kubernetes certificate management with cert-manager. Use when managing TLS certificates, configuring issuers, or troubleshooting certificate issues.
benchmarking-kubernetes-with-kube-bench
mukul975
Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.
linkerd-patterns
wshobson
Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.
managing-network-policies
jeremylongshore
Execute use when managing Kubernetes network policies and firewall rules. Trigger with phrases like "create network policy", "configure firewall rules", "restrict pod communication", or "setup ingress/egress rules". Generates Kubernetes NetworkPolicy manifests following least privilege and zero-trust principles.