OpenSkillIndex← back to search
claude-code

Skillshub k8s-security

Kubernetes Security

install
source · Clone the upstream repo
git clone https://github.com/ComeOnOliver/skillshub
Claude Code · Install into ~/.claude/skills/
T=$(mktemp -d) && git clone --depth=1 https://github.com/ComeOnOliver/skillshub "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/rohitg00/kubectl-mcp-server/k8s-security" ~/.claude/skills/comeonoliver-skillshub-k8s-security && rm -rf "$T"
manifest: skills/rohitg00/kubectl-mcp-server/k8s-security/SKILL.md
source content

Kubernetes Security

Security auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.

When to Apply

Use this skill when:

  • User mentions: "security", "RBAC", "permissions", "policy", "audit", "secrets"
  • Operations: security review, permission check, policy enforcement
  • Keywords: "who can", "access control", "compliance", "vulnerable"

Priority Rules

PriorityRuleImpactTools
1Check cluster-admin bindings firstCRITICAL
get_cluster_role_bindings
2Audit secrets access permissionsCRITICALReview role rules
3Verify network isolationHIGH
get_network_policies
4Check policy complianceHIGH
kyverno_*
, 
gatekeeper_*
5Review pod security contextsMEDIUM
describe_pod

Quick Reference

TaskToolExample
List roles
get_roles
get_roles(namespace)
Cluster roles
get_cluster_roles
get_cluster_roles()
Role bindings
get_role_bindings
get_role_bindings(namespace)
Service accounts
get_service_accounts
get_service_accounts(namespace)
Kyverno policies
kyverno_clusterpolicies_list_tool
kyverno_clusterpolicies_list_tool()

RBAC Auditing

List Roles and Bindings

get_roles(namespace)
get_cluster_roles()
get_role_bindings(namespace)
get_cluster_role_bindings()

Check Service Account Permissions

get_service_accounts(namespace)

Common RBAC Patterns

PatternRisk LevelCheck
cluster-admin bindingCritical
get_cluster_role_bindings()
Wildcard verbs (*)HighReview role rules
secrets accessHighCheck get/list on secrets
pod/execHighAllows container access

See RBAC-PATTERNS.md for detailed patterns and remediation.

Policy Enforcement

Kyverno Policies

kyverno_policies_list_tool(namespace)
kyverno_clusterpolicies_list_tool()
kyverno_policy_get_tool(name, namespace)

OPA Gatekeeper

gatekeeper_constraints_list_tool()
gatekeeper_constraint_get_tool(kind, name)
gatekeeper_templates_list_tool()

Common Policies to Enforce

PolicyPurpose
Disallow privilegedPrevent root containers
Require resource limitsPrevent resource exhaustion
Restrict host namespacesIsolate from node
Require labelsEnsure metadata
Allowed registriesControl image sources

Secret Management

List Secrets

get_secrets(namespace)

Secret Best Practices

  1. Use external secret managers (Vault, AWS SM)
  2. Encrypt secrets at rest (EncryptionConfiguration)
  3. Limit secret access via RBAC
  4. Rotate secrets regularly

Network Policies

List Policies

get_network_policies(namespace)

Cilium Network Policies

cilium_policies_list_tool(namespace)
cilium_policy_get_tool(name, namespace)

Default Deny Template

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Security Scanning Workflow

  1. RBAC Audit

    get_cluster_role_bindings()
get_roles(namespace)

  2. Policy Compliance

    kyverno_clusterpolicies_list_tool()
gatekeeper_constraints_list_tool()

  3. Network Isolation

    get_network_policies(namespace)
cilium_endpoints_list_tool(namespace)

  4. Pod Security

    get_pods(namespace)
describe_pod(name, namespace)

Multi-Cluster Security

Audit across clusters:

get_cluster_role_bindings(context="production")
get_cluster_role_bindings(context="staging")

Automated Audit Script

For comprehensive security audit, see scripts/audit-rbac.py.

Related Tools

  • RBAC: 
    get_roles
    , 
    get_cluster_roles
    , 
    get_role_bindings
  • Policy: 
    kyverno_*
    , 
    gatekeeper_*
  • Network: 
    get_network_policies
    , 
    cilium_policies_*
  • Istio: 
    istio_authorizationpolicies_list_tool
    , 
    istio_peerauthentications_list_tool

Related Skills