From kubernetes
Provides Kubernetes security best practices for pod security contexts, network policies, RBAC, secrets management, and resource limits. Use when securing K8s deployments.
How this skill is triggered — by the user, by Claude, or both
Slash command
/kubernetes:kubernetes-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Security best practices for Kubernetes deployments.
Security best practices for Kubernetes deployments.
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
spec:
containers:
- name: app
securityContext:
readOnlyRootFilesystem: true
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: tmp
emptyDir: {}
spec:
containers:
- name: app
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
spec:
containers:
- name: app
securityContext:
allowPrivilegeEscalation: false
privileged: false
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-allow
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-sa
namespace: default
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
subjects:
- kind: ServiceAccount
name: app-sa
namespace: default
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Enable encryption for secrets at rest in etcd.
Use external secret management:
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: app-secrets
spec:
refreshInterval: 1h
secretStoreRef:
name: vault-backend
kind: SecretStore
target:
name: app-secrets
data:
- secretKey: password
remoteRef:
key: secret/data/app
property: password
# Bad
env:
- name: DB_PASSWORD
value: "hardcoded-password"
# Good
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
spec:
containers:
- name: app
resources:
limits:
memory: "256Mi"
cpu: "500m"
requests:
memory: "128Mi"
cpu: "250m"
apiVersion: v1
kind: LimitRange
metadata:
name: mem-limit-range
spec:
limits:
- max:
memory: 512Mi
min:
memory: 64Mi
type: Container
apiVersion: v1
kind: ResourceQuota
metadata:
name: compute-quota
spec:
hard:
requests.cpu: "10"
requests.memory: 20Gi
limits.cpu: "20"
limits.memory: 40Gi
# Bad
image: nginx:latest
# Good
image: nginx:1.21.6
spec:
containers:
- name: app
image: myapp:1.0.0
imagePullPolicy: IfNotPresent
spec:
imagePullSecrets:
- name: registry-credentials
containers:
- name: app
image: private.registry.com/myapp:1.0.0
apiVersion: v1
kind: Namespace
metadata:
name: production
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
# Scan manifests with kubesec
kubesec scan pod.yaml
# Scan images with trivy
trivy image nginx:1.21
# Policy validation with OPA
opa eval -d policy.rego -i manifest.yaml
npx claudepluginhub thebushidocollective/han --plugin kubernetesHardens Kubernetes clusters by enforcing RBAC least privilege, network policies, pod security standards, and encrypted secrets to prevent privilege escalation and lateral movement.
Secure Kubernetes clusters through RBAC, network policies, pod security, and runtime monitoring.
Secures containerized apps with Docker hardening, image vulnerability scanning, Kubernetes pod security standards, network policies, RBAC, secrets management, and runtime protection.