Skip to content
Get packs

GKE Workload Security

Audit and harden security for apps running on Google Kubernetes Engine (GKE)

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
5 files

What it does

When installed, this skill gives an AI agent step-by-step workflows for securing applications running on Google Kubernetes Engine, a Google Cloud service that runs containerized apps. The agent can run a read-only audit script that checks a cluster's settings (Workload Identity, Network Policy, Shielded Nodes, Binary Authorization, private cluster), then guide you through applying network isolation, sandboxing risky pods with gVisor, enforcing Pod Security Standards, and mounting Secret Manager secrets into pods. It is aimed at people who already run Kubernetes workloads on GKE and need to apply these controls.

Great for

  • Platform or DevOps engineers reviewing the security posture of a GKE cluster or namespace
  • Developers locking down a namespace with default-deny network policies and restricted Pod Security labels
  • Teams moving application secrets from ad-hoc storage into Secret Manager mounted via CSI

Skip it if

  • Beginners without a running GKE cluster or kubectl access, since most steps assume existing infrastructure (the skill cannot set up a cluster)
  • Cluster-wide control plane, RBAC, Binary Authorization or Shielded Nodes changes, which the skill itself routes to other skills; applying them to production without review can break workloads
  • Anyone who runs the commands against a production cluster without first testing in staging, since network policies and Pod Security enforcement can block live traffic

Try asking

  • “Audit my GKE cluster my-cluster in us-central1 in project acme-prod for security gaps”
  • “Create a default-deny network policy for the staging namespace”
  • “Run my payments pod in GKE Sandbox using gVisor”
  • “Mount the Secret Manager secret db-password into my app pod as a read-only file”
Step-by-step guide: how to use GKE Workload SecurityInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the Apache-2.0 licence and an attribution note.

    gke-workload-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip gke-workload-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip gke-workload-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the audit script first to see current gaps, then change one control at a time and verify with kubectl.
  • Test default-deny policies and restricted Pod Security labels in a non-production namespace first, since they can block existing traffic.
  • Review scripts/audit_cluster.sh before running it; it calls gcloud and reads cluster configuration in your project.

What's inside

  • assets/default-deny-netpol.yaml
  • assets/workload-identity-pod.yaml
  • references/attribution.md
  • scripts/audit_cluster.sh
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.