From vanguard-frontier-agentic
Reviews Kubernetes Pod Security Admission posture including namespace label profiles (privileged/baseline/restricted), enforce/audit/warn modes, version pinning, and PodSecurityPolicy migration. Activated when the user asks about safety of label changes, workload profile compliance, or mode promotion.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:kubernetes-pod-security-admission-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review the Kubernetes Pod Security Admission posture: namespace labels for `pod-security.kubernetes.io/enforce`, `audit`, and `warn`, the chosen profile (`privileged`, `baseline`, `restricted`), version pinning, and exemptions. PSA replaced the deprecated PodSecurityPolicy in Kubernetes 1.25. It is the foundation for any admission-time security story — Kyverno, OPA Gatekeeper, and other policy ...
Review the Kubernetes Pod Security Admission posture: namespace labels for pod-security.kubernetes.io/enforce, audit, and warn, the chosen profile (privileged, baseline, restricted), version pinning, and exemptions. PSA replaced the deprecated PodSecurityPolicy in Kubernetes 1.25. It is the foundation for any admission-time security story — Kyverno, OPA Gatekeeper, and other policy engines layer on top of (or alongside) PSA, not as replacements.
kubectl get namespaces --show-labels plus kubectl get pods -n <ns> -o yaml) when the active client exposes it; otherwise fall back to official Kubernetes documentation and sanitized YAML.enforce: privileged as a critical finding — the most permissive profile is enabled in a tier where nothing should be running with host access, privilege escalation, or capabilities.privileged unless the cluster admin set a different default in AdmissionConfiguration.audit/warn set but enforce missing — security violations are only logged, not blocked.enforce-version: latest — every Kubernetes upgrade can change profile semantics; pin to a specific minor.kube-system and operator namespaces excluded from PSA without documentation of which workloads require privileged access.Load these only when needed:
Return, at minimum:
privileged / baseline / restricted) and active mode (enforce / audit / warn),AdmissionConfiguration exemptions, namespace label override),npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticImplements Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using the built-in admission controller.
Implements Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller (stable since v1.25).
Implements Kubernetes Pod Security Admission (PSA) to enforce Privileged, Baseline, and Restricted profiles on namespaces via labels in enforce, audit, or warn modes. For container security and compliance.