Skip to content
Get packs

Kubernetes Security Policies

Writes Kubernetes network isolation, RBAC, and pod security configurations for clusters.

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
3 files

What it does

This skill gives an AI agent a reference guide for securing Kubernetes clusters. Once installed, the agent can write configuration files for network policies that control which pods can talk to each other, role-based access control (RBAC) rules that limit who can do what, and pod security settings such as running as non-root and dropping Linux capabilities. It also covers Pod Security Standards, OPA Gatekeeper constraints and Istio mTLS examples, and includes troubleshooting commands for kubectl. It provides guidance and templates; it does not connect to or change any cluster itself.

Great for

  • Platform or DevOps engineers hardening a Kubernetes cluster
  • Developers who need a starting NetworkPolicy or RBAC manifest to review
  • Teams preparing for CIS or NIST-style compliance checks

Skip it if

  • Production clusters without human review: the generated YAML can block traffic or grant wrong permissions if applied unchecked
  • Anyone expecting a complete security audit: the skill is a reference of examples, not a scanner that inspects a live cluster
  • Users on PodSecurityPolicy clusters: PSP was removed from Kubernetes in v1.25, although the skill's description still mentions it

Try asking

  • “Write a default-deny NetworkPolicy for my production namespace and allow only frontend to backend on port 8080”
  • “Create a least-privilege Role and RoleBinding so my CI service account can only read pods”
  • “Set the Pod Security Standard to restricted on my staging namespace and show what pod spec changes I need”
  • “Give me a Kubernetes security checklist mapped to the CIS benchmark”
Step-by-step guide: how to use Kubernetes Security PoliciesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    k8s-security-policies.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip k8s-security-policies.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip k8s-security-policies.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always test policies in a non-production namespace first and keep a rollback manifest ready.
  • Ask the agent to check the cluster's CNI and Kubernetes version, since some examples depend on them.
  • Note that the Allow DNS example assumes the kube-system namespace is labelled name: kube-system, which is not always true by default.

What's inside

  • assets/network-policy-template.yaml
  • references/rbac-patterns.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.