Menu
Use when implementing Kubernetes security best practices including RBAC, pod security policies, and network policies.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | kubernetes-security |
| user-invocable | false |
| description | Use when implementing Kubernetes security best practices including RBAC, pod security policies, and network policies. |
| allowed-tools | [] |
Security best practices for Kubernetes deployments.
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
spec:
containers:
- name: app
securityContext:
readOnlyRootFilesystem: true
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: tmp
emptyDir: {}
spec:
containers:
- name: app
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
spec:
containers:
- name: app
securityContext:
allowPrivilegeEscalation: false
privileged: false
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-allow
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- protocol: TCP
port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: database
ports:
- protocol: TCP
port: 5432
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-sa
namespace: default
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
subjects:
- kind: ServiceAccount
name: app-sa
namespace: default
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Enable encryption for secrets at rest in etcd.
Use external secret management:
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: app-secrets
spec:
refreshInterval: 1h
secretStoreRef:
name: vault-backend
kind: SecretStore
target:
name: app-secrets
data:
- secretKey: password
remoteRef:
key: secret/data/app
property: password
# Bad
env:
- name: DB_PASSWORD
value: "hardcoded-password"
# Good
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
spec:
containers:
- name: app
resources:
limits:
memory: "256Mi"
cpu: "500m"
requests:
memory: "128Mi"
cpu: "250m"
apiVersion: v1
kind: LimitRange
metadata:
name: mem-limit-range
spec:
limits:
- max:
memory: 512Mi
min:
memory: 64Mi
type: Container
apiVersion: v1
kind: ResourceQuota
metadata:
name: compute-quota
spec:
hard:
requests.cpu: "10"
requests.memory: 20Gi
limits.cpu: "20"
limits.memory: 40Gi
# Bad
image: nginx:latest
# Good
image: nginx:1.21.6
spec:
containers:
- name: app
image: myapp:1.0.0
imagePullPolicy: IfNotPresent
spec:
imagePullSecrets:
- name: registry-credentials
containers:
- name: app
image: private.registry.com/myapp:1.0.0
apiVersion: v1
kind: Namespace
metadata:
name: production
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
# Scan manifests with kubesec
kubesec scan pod.yaml
# Scan images with trivy
trivy image nginx:1.21
# Policy validation with OPA
opa eval -d policy.rego -i manifest.yaml
Use when building modular Angular applications requiring dependency injection with providers, injectors, and services.
Use when handling async operations in Angular applications with observables, operators, and subjects.
Use when building Angular 16+ applications requiring fine-grained reactive state management and zone-less change detection.
Guides end-to-end feature development through 8 phases: discover requirements, explore codebase patterns, clarify ambiguities with the user, design architecture, implement with TDD, run multi-agent code review, validate all quality gates, and write a blog post. Use when asked to add a feature, implement a new capability, build functionality, or develop a feature end-to-end.
Use when creating or modifying Han plugins. Covers plugin structure, configuration, hooks, skills, and best practices.
Minimize token consumption through efficient tool usage patterns