implementing-kubernetes-pod-security-standards

Repositorio: xalgord/xalgorix
Última actividad en el origen: 6 de junio de 2026 a las 16:41
Idioma detectado de SKILL.md: inglés
Estrellas: 813
Forks: 146

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-kubernetes-pod-security-standards

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

Ver todos los de este repositorio

Implementing Kubernetes Pod Security Standards

Overview

Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PSA replaces the deprecated PodSecurityPolicy and provides namespace-level enforcement with three modes: enforce, audit, and warn.

When to Use

When deploying or configuring implementing kubernetes pod security standards capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

enforce label missing: namespaces labelled only pod-security.kubernetes.io/audit=restricted and /warn=restricted log and warn but never block - a privileged: true pod still schedules. Confirm enforce is set: kubectl get ns -L pod-security.kubernetes.io/enforce.

Label key typos: pod-security.kubernetes.io/enforced or a missing mode value is silently ignored by the admission controller; PSA does not error on unknown labels.

enforce-version: latest drift: pinning to latest means an apiserver upgrade can tighten or change checks unexpectedly. Pin a concrete version (e.g. v1.28) for predictable behavior.

PSA can't inspect image contents: it evaluates the pod spec only, so it won't catch a root USER baked into the image or an unsigned image - layer Gatekeeper/Kyverno for those.

Workload lives in an exempt namespace: restricted on production is moot if the deployment actually runs in default/a system namespace; verify the target namespace's labels, not the cluster default.

Verify before enforcing: kubectl label --dry-run=server --overwrite ns <ns> pod-security.kubernetes.io/enforce=restricted lists existing violators; then kubectl run test --image=nginx -n <ns> --dry-run=server should be rejected under restricted (nginx runs as root).

Prerequisites

Kubernetes cluster 1.25+ (PSA GA)

kubectl configured with cluster-admin access