From nickcrew-claude-ctx-plugin
Guides Kubernetes cluster security with Pod Security Standards, Network Policies, RBAC, admission controllers, and secrets management for hardened, compliant deployments.
npx claudepluginhub nickcrew/claude-cortexThis skill uses the workspace's default tool permissions.
Comprehensive guidance for implementing security policies in Kubernetes clusters, covering Pod Security Standards, Network Policies, RBAC, Security Contexts, admission control, secrets management, and runtime security for production-grade hardened deployments.
Implements Kubernetes security policies including NetworkPolicy for network isolation, Pod Security Standards, and RBAC for cluster security and compliance.
Provides Kubernetes security best practices for pod security contexts, network policies, RBAC, secrets management, and resource limits. Use when securing K8s deployments.
Implements Kubernetes security policies including NetworkPolicies, Pod Security Standards, and RBAC for network segmentation, least-privilege access, and compliance.
Share bugs, ideas, or general feedback.
Comprehensive guidance for implementing security policies in Kubernetes clusters, covering Pod Security Standards, Network Policies, RBAC, Security Contexts, admission control, secrets management, and runtime security for production-grade hardened deployments.
Pod Security Standards (PSS): Three progressive security levels enforced via Pod Security Admission (PSA):
Network Policies: Zero-trust micro-segmentation controlling pod-to-pod and pod-to-external traffic using label selectors and namespace isolation.
RBAC (Role-Based Access Control): Least-privilege access control using ServiceAccounts, Roles, RoleBindings for namespace-scoped permissions, and ClusterRoles for cluster-wide access.
Security Contexts: Container and pod-level security settings including user/group IDs, capabilities, seccomp profiles, and filesystem restrictions.
Admission Control: Policy enforcement at API admission time using OPA Gatekeeper (Rego) or Kyverno (YAML) to validate, mutate, or reject resources.
Secrets Management: External secret storage integration (Vault, AWS Secrets Manager, Sealed Secrets) instead of native Kubernetes secrets.
Image Security: Vulnerability scanning, signature verification, digest-based immutability, and private registry authentication.
| Task | Load reference |
|---|---|
| Pod Security Standards (PSS/PSA) | skills/kubernetes-security-policies/references/pod-security-standards.md |
| Network Policies | skills/kubernetes-security-policies/references/network-policies.md |
| RBAC (Roles, ServiceAccounts) | skills/kubernetes-security-policies/references/rbac.md |
| Security Contexts (capabilities, seccomp) | skills/kubernetes-security-policies/references/security-contexts.md |
| Admission Control (OPA, Kyverno) | skills/kubernetes-security-policies/references/admission-control.md |
| Secrets Management (Vault, ESO) | skills/kubernetes-security-policies/references/secrets-management.md |
| Image Security (scanning, signing) | skills/kubernetes-security-policies/references/image-security.md |
| Best Practices & Compliance | skills/kubernetes-security-policies/references/best-practices.md |
kubectl get pods -A --show-labelskubectl auth can-i --listautomountServiceAccountToken by defaultPod Security:
runAsNonRoot: true)readOnlyRootFilesystem: true)Network Policies:
RBAC:
* verbs or resources in RolesSecrets:
Admission Control:
Images:
latest tag (not immutable, breaks reproducibility)