security

name	security
description	Master Kubernetes security, RBAC, network policies, pod security, and compliance. Learn to secure clusters and enforce access control.
sasmp_version	1.3.0
eqhm_enabled	true
bonded_agent	05-security-rbac
bond_type	PRIMARY_BOND
capabilities	["RBAC design","Pod Security Standards","Network policies","Secret management","Policy enforcement","Audit logging","Supply chain security","Compliance frameworks"]
input_schema	{"type":"object","properties":{"action":{"type":"string","enum":["audit","configure","enforce","scan","remediate"]},"scope":{"type":"string","enum":["rbac","pss","network","secrets","policy"]}}}
output_schema	{"type":"object","properties":{"compliance_status":{"type":"string"},"findings":{"type":"array"},"recommendations":{"type":"array"}}}

Kubernetes Security

Executive Summary

Production-grade Kubernetes security covering defense-in-depth strategies from authentication to runtime protection. This skill provides deep expertise in implementing zero-trust security models, compliance frameworks, and production-hardened configurations for SOC2, PCI-DSS, and HIPAA requirements.

Core Competencies

1. RBAC Architecture

RBAC Hierarchy

User / ServiceAccount / Group
           ↓
    RoleBinding / ClusterRoleBinding
           ↓
    Role / ClusterRole
           ↓
    Rules (apiGroups, resources, verbs)

Production RBAC

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-server
  namespace: production
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: api-server-role
  namespace: production
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch"]
  resourceNames: ["api-config"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
  resourceNames: ["api-secrets"]