Configures Kubernetes RBAC to enforce least privilege access on cluster resources. Covers Role/ClusterRole design, RoleBinding setup, service account security, namespace isolation, and audit logging for multi-tenant clusters.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
配置 Kubernetes 基于角色的访问控制（RBAC），对集群资源强制执行最小权限访问。涵盖 Role/ClusterRole 设计、RoleBinding 配置、服务账户安全、命名空间隔离，以及多租户 Kubernetes 环境的审计日志。
Hardens Kubernetes RBAC by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating OIDC providers. Use for compliance, security architecture, and audits.
Hardens Kubernetes RBAC by auditing bindings, enforcing least-privilege Roles/RoleBindings, eliminating cluster-admin sprawl, and integrating OIDC providers.
Hardens Kubernetes RBAC by auditing cluster-admin bindings, enforcing least privilege with namespace Roles, dedicating service accounts, restricting dangerous permissions, and integrating OIDC.
Share bugs, ideas, or general feedback.
配置 Kubernetes 基于角色的访问控制（RBAC），对集群资源强制执行最小权限访问。涵盖 Role/ClusterRole 设计、RoleBinding 配置、服务账户安全、命名空间隔离，以及多租户 Kubernetes 环境的审计日志。
get、list、watch：只读操作create、update、patch：写操作delete、deletecollection：破坏性操作impersonate：模拟其他用户身份escalate：修改 RBAC 角色（高度特权）bind：创建 RoleBinding（高度特权）--authorization-mode=RBAC# 开发者角色 - 命名空间范围
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: app-team
name: developer
rules:
- apiGroups: ["", "apps", "batch"]
resources: ["pods", "deployments", "services", "configmaps", "jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list"] # 可读取但限制创建/更新
- apiGroups: [""]
resources: ["pods/log", "pods/exec"]
verbs: ["get", "create"]
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: developer-binding
namespace: app-team
subjects:
- kind: Group
name: "dev-team"
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: developer
apiGroup: rbac.authorization.k8s.io
| 控制项 | NIST 800-53 | 描述 |
|---|---|---|
| 访问控制 | AC-3 | RBAC 强制执行 |
| 最小权限 | AC-6 | 最小必要 Kubernetes 权限 |
| 账户管理 | AC-2 | 服务账户生命周期 |
| 审计 | AU-3 | Kubernetes 审计日志 |
| 职责分离 | AC-5 | 命名空间隔离 |
kubectl auth can-i 验证每个人员的预期权限