Does this skill support modern Kubernetes security standards?

Yes, it specifically focuses on Pod Security Standards (PSS) and NetworkPolicies, which are the current recommended methods for securing Kubernetes clusters.

Can I use this for network segmentation?

Absolutely. The skill provides templates for default-deny-all policies and specific ingress/egress rules to isolate frontend, backend, and database traffic.

Does it include support for service meshes?

Yes, it includes patterns for Istio PeerAuthentication and AuthorizationPolicies to implement mTLS and fine-grained access control within a mesh.

How does it handle RBAC configuration?

It follows the principle of least privilege, generating scoped Roles and ClusterRoles that restrict access to only the resources required by specific users or service accounts.

Kubernetes Security Policy Expert

Name: Kubernetes Security Policy Expert
Author: HermeticOrmus

byHermeticOrmus

•

セキュリティとテスト

Implements production-grade Kubernetes security configurations including NetworkPolicies, RBAC, and Pod Security Standards.

概要

This skill empowers Claude to design and implement robust defense-in-depth security layers within Kubernetes clusters by providing standardized templates and best practices for network segmentation, least-privilege access, and pod security enforcement. It streamlines the creation of complex security manifests like NetworkPolicies for traffic isolation, RBAC for granular permission management, and Pod Security Standards (PSS) to ensure containers run with minimal risk. Whether you are hardening a multi-tenant cluster or preparing for a security audit, this skill provides the necessary patterns for OPA Gatekeeper, Istio security, and CIS Benchmark compliance.

主な機能

Configures Pod Security Standards (Baseline and Restricted) via namespace labels
Creates least-privilege RBAC Roles, ClusterRoles, and RoleBindings
Implements admission control policies using OPA Gatekeeper ConstraintTemplates
2 GitHub stars
Generates NetworkPolicies for default-deny and microservice isolation
Provides Istio service mesh security configurations for mTLS and authorization

ユースケース

Hardening production Kubernetes clusters to meet CIS Benchmarks and NIST standards
Implementing zero-trust network segmentation between application tiers
Securing multi-tenant environments through strict RBAC and pod security context enforcement

概要

主な機能

Configures Pod Security Standards (Baseline and Restricted) via namespace labels
Creates least-privilege RBAC Roles, ClusterRoles, and RoleBindings
Implements admission control policies using OPA Gatekeeper ConstraintTemplates
2 GitHub stars
Generates NetworkPolicies for default-deny and microservice isolation
Provides Istio service mesh security configurations for mTLS and authorization

ユースケース

Hardening production Kubernetes clusters to meet CIS Benchmarks and NIST standards
Implementing zero-trust network segmentation between application tiers
Securing multi-tenant environments through strict RBAC and pod security context enforcement