Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Kubernetes Security Policies · microck | DecimalAI

microck/k8s-security-policies

SkillScore96Maintained

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

DevOpsby microck

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/microck-k8s-security-policies/SKILL.md

decimalai skills pull microck-k8s-security-policies --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/microck-k8s-security-policies/SKILL.md https://app.decimal.ai/s/microck-k8s-security-policies/SKILL.md

Raw file: /s/microck-k8s-security-policies/SKILL.md ↗ · machine-readable summary at /s/microck-k8s-security-policies.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

Runs

all versions · 30d

Eval pass

100%

global

Used when offered

96%

used / offered · all versions

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 8d ago

Yes — +4% lift · at higher cost+143% tokens0% turns96% of whole cases pass with skill (22/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-20	✗→✓	▲ Improved	149%	0%
case-01	✓→✓	＝ Same ✓	223%	0%
case-02	✓→✓	＝ Same ✓	186%	0%
case-03	✓→✓	＝ Same ✓	282%	0%
case-04	✓→✓	＝ Same ✓	215%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

microck / ordinary-claude-skills

skills_all/k8s-security-policies/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

Kubernetes Security Policies

Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

Purpose

Implement defense-in-depth security for Kubernetes clusters using network policies, pod security standards, and RBAC.

When to Use This Skill

Implement network segmentation
Configure pod security standards
Set up RBAC for least-privilege access
Create security policies for compliance
Implement admission control
Secure multi-tenant clusters

Pod Security Standards

1. Privileged (Unrestricted)

yaml
apiVersion: v1
kind: Namespace
metadata:
  name: privileged-ns
  labels:
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: privileged
    pod-security.kubernetes.io/warn: privileged

2. Baseline (Minimally restrictive)

yaml
apiVersion: v1
kind: Namespace
metadata:
  name: baseline-ns
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline

3. Restricted (Most restrictive)

yaml
apiVersion: v1
kind: Namespace
metadata:
  name: restricted-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Network Policies

Default Deny All

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Allow Frontend to Backend

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Allow DNS

yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53

Reference: See assets/network-policy-template.yaml

RBAC Configuration

Role (Namespace-scoped)

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

ClusterRole (Cluster-wide)

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

RoleBinding

yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: default
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Reference: See references/rbac-patterns.md

Pod Security Context

Restricted Pod

yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL

Policy Enforcement with OPA Gatekeeper

ConstraintTemplate

yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredlabels
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredLabels
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg, "details": {"missing_labels": missing}}] {
          provided := {label | input.review.object.metadata.labels[label]}
          required := {label | label := input.parameters.labels[_]}
          missing := required - provided
          count(missing) > 0
          msg := sprintf("missing required labels: %v", [missing])
        }

Constraint

yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-app-label
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  parameters:
    labels: ["app", "environment"]

Service Mesh Security (Istio)

PeerAuthentication (mTLS)

yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

AuthorizationPolicy

yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend
  namespace: production
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/frontend"]

Best Practices

Implement Pod Security Standards at namespace level
Use Network Policies for network segmentation
Apply least-privilege RBAC for all service accounts
Enable admission control (OPA Gatekeeper/Kyverno)
Run containers as non-root
Use read-only root filesystem
Drop all capabilities unless needed
Implement resource quotas and limit ranges
Enable audit logging for security events
Regular security scanning of images

Compliance Frameworks

CIS Kubernetes Benchmark

Use RBAC authorization
Enable audit logging
Use Pod Security Standards
Configure network policies
Implement secrets encryption at rest
Enable node authentication

NIST Cybersecurity Framework

Implement defense in depth
Use network segmentation
Configure security monitoring
Implement access controls
Enable logging and monitoring

Troubleshooting

NetworkPolicy not working:

bash
# Check if CNI supports NetworkPolicy
kubectl get nodes -o wide
kubectl describe networkpolicy <name>

RBAC permission denied:

bash
# Check effective permissions
kubectl auth can-i list pods --as system:serviceaccount:default:my-sa
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-sa

Reference Files

assets/network-policy-template.yaml - Network policy examples
assets/pod-security-template.yaml - Pod security policies
references/rbac-patterns.md - RBAC configuration patterns

Related Skills

k8s-manifest-generator - For creating secure manifests
gitops-workflow - For automated policy deployment

Want to see if microck/k8s-security-policies would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/21/2026, 04:05 UTC · 23 cases

Lift

+4%

96% vs 91%

Agent turns

1.0 vs 1.0

Tokens

+143%

3,080.87 vs 1,267.7

fail → pass · 1pass → pass · 21fail → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I need a Kubernetes namespace manifest for a high-security workload in namespace `restricted-ns`. I usually only set up network policies, but I want Kubernetes Pod Security Admission configured across all standard modes (enforce, audit, warn) at the strictest security level. Provide the namespace YAML.	pass→pass	4,588	5,213	+14%	1	1	0%	883	2,851	+223%	0	0	—
case-02 Create a Kubernetes namespace manifest for `baseline-ns` intended for application workloads that cannot meet strict non-root filesystem requirements but must still block known privilege escalations. Configure all three admission modes (enforce, audit, warn) to use the baseline profile.	pass→pass	5,061	5,318	+5%	1	1	0%	954	2,732	+186%	0	0	—
case-03 Write a Kubernetes Namespace specification for `privileged-ns` hosting host monitoring daemons requiring unrestricted host access. Set enforce, audit, and warn labels for Pod Security Admission to the permissive profile.	pass→pass	4,187	3,660	-13%	1	1	0%	694	2,648	+282%	0	0	—
case-04 We want to isolate all pods in the `production` namespace by default. Developers frequently write network policies that only specify `Ingress`, leaving egress open. Provide a NetworkPolicy named `default-deny-all` that blocks both incoming and outgoing traffic for every pod in the namespace.	pass→pass	5,241	5,044	-4%	1	1	0%	926	2,919	+215%	0	0	—
case-05 Write a Kubernetes NetworkPolicy manifest named `allow-frontend-to-backend` in the `production` namespace. It should select backend pods (`app: backend`) and allow ingress traffic exclusively from frontend pods (`app: frontend`) on TCP port 8080.	pass→pass	6,224	3,898	-37%	1	1	0%	744	2,561	+244%	0	0	—
case-06 After enforcing default egress denial in namespace `production`, pods can no longer reach cluster DNS. Provide a NetworkPolicy named `allow-dns` that allows egress from all pods in the namespace specifically for DNS resolving to core DNS pods in `kube-system` on port 53 UDP.	pass→pass	5,926	8,680	+46%	1	1	0%	1,205	3,608	+199%	0	0	—
case-07 Define a namespace-scoped RBAC Role named `pod-reader` in namespace `production`. Developers think `get` verb is sufficient, but developers need real-time streams via `kubectl get -w` and bulk listings as well. Which API group, resource, and verbs should be set?	pass→pass	5,438	4,058	-25%	1	1	0%	990	2,709	+174%	0	0	—
case-08 We need an RBAC authorization object named `secret-reader` for cluster auditors to view secrets across all namespaces. Provide the specification for this cluster-scoped role allowing read access to secrets.	pass→pass	3,034	4,291	+41%	1	1	0%	525	2,716	+417%	0	0	—
case-09 Bind the `pod-reader` Role in namespace `production` to user `jane` and also to the `default` ServiceAccount in namespace `production`. Name the binding `read-pods`.	pass→pass	4,981	4,042	-19%	1	1	0%	911	2,768	+204%	0	0	—
case-10 Write a Pod specification named `secure-pod` running image `myapp:1.0`. Engineers frequently default to running containers as root UID 0. Configure the pod-level security context so that root execution is prevented, UID 1000 and GID 1000 are assigned, and the runtime default seccomp profile is enabled.	pass→pass	5,476	6,587	+20%	1	1	0%	1,061	3,229	+204%	0	0	—
case-11 For a container named `app` inside a Kubernetes Pod spec, configure the container-level `securityContext` to ensure the filesystem cannot be modified at runtime, set privilege escalation to forbidden, and drop all Linux kernel capabilities.	pass→pass	3,884	3,272	-16%	1	1	0%	723	2,482	+243%	0	0	—
case-12 We want to mandate metadata labels on workloads using OPA Gatekeeper. Provide the YAML for a ConstraintTemplate custom resource named `k8srequiredlabels` including the Rego policy package and violation check that calculates missing required labels.	pass→pass	9,185	7,037	-23%	1	1	0%	1,776	3,318	+87%	0	0	—
case-13 Using OPA Gatekeeper, instantiate a constraint of kind `K8sRequiredLabels` named `require-app-label` targeting `Deployment` resources under `apps` apiGroup to enforce presence of `app` and `environment` labels.	pass→pass	7,861	3,442	-56%	1	1	0%	1,533	2,489	+62%	0	0	—
case-14 We need to enforce mutual TLS for all services in the `production` namespace using Istio. Provide the custom resource manifest named `default` that forces strict mTLS mode.	pass→pass	2,764	2,721	-2%	1	1	0%	505	2,351	+366%	0	0	—
case-15 Author an Istio AuthorizationPolicy named `allow-frontend` in namespace `production` allowing traffic to backend pods (`app: backend`) only if it originates from service account principal `cluster.local/ns/production/sa/frontend`.	pass→pass	3,639	4,777	+31%	1	1	0%	692	2,762	+299%	0	0	—
case-16 A microservice running with service account `my-sa` in namespace `default` receives HTTP 403 Forbidden when calling Kubernetes API endpoints. What exact `kubectl` impersonation command tests if this service account has permission to list pods?	pass→pass	4,647	3,716	-20%	1	1	0%	841	2,502	+198%	0	0	—
case-22 Configure AWS IAM Roles for Service Accounts (IRSA) on an EKS cluster by creating an IAM OIDC provider and attaching an IAM role trust policy configured for `sts:AssumeRoleWithWebIdentity`.	pass→pass	14,449	18,092	+25%	1	1	0%	2,933	4,805	+64%	0	0	—
case-17 NetworkPolicy objects are applied in the cluster, but pods can still communicate freely across forbidden boundaries. What command helps verify node configuration and inspect cluster networking status to confirm if CNI enforcement is active?	fail→fail	9,271	8,207	-11%	1	1	0%	1,559	3,236	+108%	0	0	—
case-18 What primary access control and network auditing measures are recommended when hardening a Kubernetes cluster against the CIS Kubernetes Benchmark standards?	pass→pass	21,948	14,418	-34%	1	1	0%	3,185	4,364	+37%	0	0	—
case-19 To comply with CIS Kubernetes Benchmark control requirements for sensitive data protection at rest, what setting must be enabled for secret objects stored inside etcd?	pass→pass	6,144	6,333	+3%	1	1	0%	1,019	3,065	+201%	0	0	—
case-20 List four key container-level security context parameter settings used to harden Kubernetes pods against host takeover and unprivileged write operations.	fail→pass	7,238	6,519	-10%	1	1	0%	1,217	3,027	+149%	0	0	—
case-21 We need to set up automated container image vulnerability scanning in our CI/CD pipeline using Trivy to scan Docker images before pushing to our container registry. Provide a GitHub Actions step for running Trivy image scans.	pass→pass	11,227	8,261	-26%	1	1	0%	2,265	3,512	+55%	0	0	—
case-23 How do I configure auto-rotation for Kubelet client and server TLS certificates in `/var/lib/kubelet/config.yaml` on Kubernetes worker nodes?	pass→pass	11,118	12,184	+10%	1	1	0%	2,016	4,206	+109%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +4 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 91.3%
Pass rate with the skill: 95.7%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/21/2026, 04:05 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-20

Prompt

List four key container-level security context parameter settings used to harden Kubernetes pods against host takeover and unprivileged write operations.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run96

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+145% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 8 days ago

Other measured skills in the registry, with their headline benchmark lift.