K8s Security Policies

Implements the security trifecta for Kubernetes clusters: NetworkPolicies for network segmentation, RBAC for least-privilege access, and Pod Security Standards for container restrictions. Generates manifests for default-deny network policies, service account bindings, and OPA Gatekeeper constraints. Also covers Istio service mesh security with mTLS and authorization policies. Use this when you need to lock down a cluster for production, meet compliance requirements like CIS benchmarks, or implement multi-tenant security. The examples are comprehensive but you'll need to adapt the specific rules to your application architecture and security requirements.

skills.sh installs: 15.1K
GitHub stars: 42.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wshobson/agents --skill k8s-security-policies --agent claude-code

Installs into .claude/skills of the current project.

Files

Kubernetes Security Policies

Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

Purpose

Implement defense-in-depth security for Kubernetes clusters using network policies, pod security standards, and RBAC.

When to Use This Skill

Implement network segmentation
Configure pod security standards
Set up RBAC for least-privilege access
Create security policies for compliance
Implement admission control
Secure multi-tenant clusters

Pod Security Standards

1. Privileged (Unrestricted)

apiVersion: v1
kind: Namespace
metadata:
  name: privileged-ns
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged

2. Baseline (Minimally restrictive)

apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline