From vanguard-frontier-agentic
Reviews Kubernetes workload identity configurations across AWS, Azure, and GCP, covering IRSA, Workload Identity Federation, OIDC trust policies, and ServiceAccount token projection.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:kubernetes-workload-identity-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review how pods authenticate to cloud services. Long-lived static credentials in Secrets are the largest unmanaged credential surface in most Kubernetes deployments. Workload identity replaces them with short-lived federated tokens via the cluster's OIDC issuer. The review covers ServiceAccount token projection, OIDC issuer trust policy, the cloud-provider IAM mapping, and the runtime check tha...
Review how pods authenticate to cloud services. Long-lived static credentials in Secrets are the largest unmanaged credential surface in most Kubernetes deployments. Workload identity replaces them with short-lived federated tokens via the cluster's OIDC issuer. The review covers ServiceAccount token projection, OIDC issuer trust policy, the cloud-provider IAM mapping, and the runtime check that the pod is actually using the federated token rather than falling back to a static credential.
kubectl get serviceaccount,pods -A -o yaml plus the cluster's OIDC issuer URL and the cloud-provider IAM trust policy) when the active client exposes it; otherwise fall back to official cloud-provider and Kubernetes documentation.StringEquals on aud but StringLike (wildcard) on sub as a critical finding — any ServiceAccount in the cluster can assume the role.automountServiceAccountToken: true on pods that don't use the Kubernetes API as a high finding — token is mounted and exfiltratable, even when not used.audiences claim — projected tokens should target a specific cloud audience (sts.amazonaws.com, api://AzureADTokenExchange, https://iam.googleapis.com/projects/.../workloadIdentityPools/...).Load these only when needed:
Return, at minimum:
aud, sub, iss) — must constrain to a specific ServiceAccount,npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticReplaces long-lived IAM keys in Kubernetes with AWS IRSA, GCP Workload Identity, or Azure Managed Identity to eliminate credential leakage risks.
Hardens managed Kubernetes clusters on EKS, AKS, GKE with Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring.
Hardens managed Kubernetes clusters on EKS, AKS, and GKE with Pod Security Standards, network policies, workload identity, RBAC, image admission controls, and runtime security monitoring.