{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/k8s-security-policies",
  "version": "1.0.0",
  "name": "K8S Security Policies",
  "description": "Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or ...",
  "system_prompt_fragment": "# Kubernetes Security Policies\n\nComprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.\n\n## Do not use this skill when\n\n- The task is unrelated to kubernetes security policies\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources/implementation-playbook.md`.\n\n## Purpose\n\nImplement defense-in-depth security for Kubernetes clusters using network policies, pod security standards, and RBAC.\n\n## Use this skill when\n\n- Implement network segmentation\n- Configure pod security standards\n- Set up RBAC for least-privilege access\n- Create security policies for compliance\n- Implement admission control\n- Secure multi-tenant clusters\n\n## Pod Security Standards\n\n### 1. Privileged (Unrestricted)\n```yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: privileged-ns\n  labels:\n    pod-security.kubernetes.io/enforce: privileged\n    pod-security.kubernetes.io/audit: privileged\n    pod-security.kubernetes.io/warn: privileged\n```\n\n### 2. Baseline (Minimally restrictive)\n```yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: baseline-ns\n  labels:\n    pod-security.kubernetes.io/enforce: baseline\n    pod-security.kubernetes.io/audit: baseline\n    pod-security.kubernetes.io/warn: baseline\n```\n\n### 3. Restricted (Most restrictive)\n```yaml\napiVersion: v1\nkind: Namespace\nmetadata:\n  name: restricted-ns\n  labels:\n    pod-security.kubernetes.io/enforce: restricted\n    pod-security.kubernetes.io/audit: restricted\n    pod-security.kubernetes.io/warn: restricted\n```\n\n## Network Policies\n\n### Default Deny All\n```yaml\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-all\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress\n  - Egress\n```\n\n### Allow Frontend to Backend\n```yaml\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-frontend-to-backend\n  namespace: production\nspec:\n  podSelector:\n    matchLabels:\n      app: backend\n  policyTypes:\n  - Ingress\n  ingress:\n  - from:\n    - podSelector:\n        matchLabels:\n          app: frontend\n    ports:\n    - protocol: TCP\n      port: 8080\n```\n\n### Allow DNS\n```yaml\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: allow-dns\n  namespace: production\nspec:\n  podSelector: {}\n  policyTypes:\n  - Egress\n  egress:\n  - to:\n    - namespaceSelector:\n        matchLabels:\n          name: kube-system\n    ports:\n    - protocol: UDP\n      port: 53\n```\n\n**Reference:** See `assets/network-policy-template.yaml`\n\n## RBAC Configuration\n\n### Role (Namespace-scoped)\n```yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: Role\nmetadata:\n  name: pod-reader\n  namespace: production\nrules:\n- apiGroups: [\"\"]\n  resources: [\"pods\"]\n  verbs: [\"get\", \"watch\", \"list\"]\n```\n\n### ClusterRole (Cluster-wide)\n```yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n  name: secret-reader\nrules:\n- apiGroups: [\"\"]\n  resources: [\"secrets\"]\n  verbs: [\"get\", \"watch\", \"list\"]\n```\n\n### RoleBinding\n```yaml\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: read-pods\n  namespace: production\nsubjects:\n- kind: User\n  name: jane\n  apiGroup: rbac.authorization.k8s.io\n- kind: ServiceAccount\n  name: default\n  namespace: production\nroleRef:\n  kind: Role\n  name: pod-reader\n  apiGroup: rbac.authorization.k8s.io\n```\n\n**Reference:** See `references/rbac-patterns.md`\n\n## Pod Security Context\n\n### Restricted Pod\n```yaml\napiVersion: v1\nkind: Pod\nmetadata:\n  name: secure-pod\nspec:\n  securityContext:\n    runAsNonRoot: true\n    runAsUser: 1000\n    fsGroup: 1000\n    seccompProfile:\n      type: RuntimeDefault\n  containers:\n  - name: app\n    image: myapp:1.0\n    securityContext:\n      allowPrivilegeEscalation: false\n      readOnlyRootFilesystem: true\n      capabilities:\n        drop:\n        - ALL\n```\n\n## Policy Enforcement with OPA Gatekeeper\n\n### ConstraintTemplate\n```yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n  name: k8srequiredlabels\nspec:\n  crd:\n    spec:\n      names:\n        kind: K8sRequiredLabels\n      validation:\n        openAPIV3Schema:\n          type: object\n          properties:\n            labels:\n              type: array\n              items:\n                type: string\n  targets:\n    - target: admission.k8s.gatekeeper.sh\n      rego: |\n        package k8srequiredlabels\n        violation[{\"msg\": msg, \"details\": {\"missing_labels\": missing}}] {\n          provided := {label | input.review.object.metadata.labels[label]}\n          required := {label | label := input.parameters.labels[_]}\n          missing := required - provided\n          count(missing) > 0\n          msg := sprintf(\"missing required labels: %v\", [missing])\n        }\n```\n\n### Constraint\n```yaml\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: K8sRequiredLabels\nmetadata:\n  name: require-app-label\nspec:\n  match:\n    kinds:\n      - apiGroups: [\"apps\"]\n        kinds: [\"Deployment\"]\n  parameters:\n    labels: [\"app\", \"environment\"]\n```\n\n## Service Mesh Security (Istio)\n\n### PeerAuthentication (mTLS)\n```yaml\napiVersion: security.istio.io/v1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default\n  namespace: production\nspec:\n  mtls:\n    mode: STRICT\n```\n\n### AuthorizationPolicy\n```yaml\napiVersion: security.istio.io/v1beta1\nkind: AuthorizationPolicy\nmetadata:\n  name: allow-frontend\n  namespace: production\nspec:\n  selector:\n    matchLabels:\n      app: backend\n  action: ALLOW\n  rules:\n  - from:\n    - source:\n        principals: [\"cluster.local/ns/production/sa/frontend\"]\n```\n\n## Best Practices\n\n1. **Implement Pod Security Standards** at namespace level\n2. **Use Network Policies** for network segmentation\n3. **Apply least-privilege RBAC** for all service accounts\n4. **Enable admission control** (OPA Gatekeeper/Kyverno)\n5. **Run containers as non-root**\n6. **Use read-only root filesystem**\n7. **Drop all capabilities** unless needed\n8. **Implement resource quotas** and limit ranges\n9. **Enable audit logging** for security events\n10. **Regular security scanning** of images\n\n## Compliance Frameworks\n\n### CIS Kubernetes Benchmark\n- Use RBAC authorization\n- Enable audit logging\n- Use Pod Security Standards\n- Configure network policies\n- Implement secrets encryption at rest\n- Enable node authentication\n\n### NIST Cybersecurity Framework\n- Implement defense in depth\n- Use network segmentation\n- Configure security monitoring\n- Implement access controls\n- Enable logging and monitoring\n\n## Troubleshooting\n\n**NetworkPolicy not working:**\n```bash\n# Check if CNI supports NetworkPolicy\nkubectl get nodes -o wide\nkubectl describe networkpolicy <name>\n```\n\n**RBAC permission denied:**\n```bash\n# Check effective permissions\nkubectl auth can-i list pods --as system:serviceaccount:default:my-sa\nkubectl auth can-i '*' '*' --as system:serviceaccount:default:my-sa\n```\n\n## Reference Files\n\n- `assets/network-policy-template.yaml` - Network policy examples\n- `assets/pod-security-template.yaml` - Pod security policies\n- `references/rbac-patterns.md` - RBAC configuration patterns\n\n## Related Skills\n\n- `k8s-manifest-generator` - For creating secure manifests\n- `gitops-workflow` - For automated policy deployment",
  "applicable_domains": [
    "devops"
  ],
  "category": "devops",
  "invocation": [
    "/k8s-security-policies"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/k8s-security-policies",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/k8s-security-policies",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "devops"
  ],
  "lifecycle": "draft"
}