メニュー
Reviews Kubernetes storage configurations, PVs, and VolumeMounts for data leakage and privilege escalation risks.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Autonomously poll, triage, investigate, and resolve unaddressed open issues on our target GitHub repository strictly within authorized scope.
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto Provisioning configuration or general GKE cluster creation.
Audit, monitor, and debug the logging, tracing, metrics, and API/dashboard observability of the Platform Agent.
Standard Operating Procedure (SOP) for generating and updating secure, compliant, and cost-effective GKE manifests.
Systematic Standard Operating Procedure (SOP) for diagnosing GKE workload failures, crash loops, resource OOMs, mounting errors, and connectivity timeouts.
Reviews Kubernetes Pod security contexts for workload-level isolation and privilege escalation risks.
| name | review-security-k8s-storage |
| description | Reviews Kubernetes storage configurations, PVs, and VolumeMounts for data leakage and privilege escalation risks. |
Review storage configurations (StorageClass, PersistentVolume, PVC), Volumes, and VolumeMounts to prevent data leaks and privilege escalation.
VolumeMounts missing readOnly: true for writable types (PVCs, hostPath, emptyDir) unless write is required.subPath on volumes writable by untrusted users (symlink breakout risk).hostPath usage. Recommend local PVs.fsGroup in securityContext to avoid running containers as root for storage access.ReadWriteMany (RWX). Require ReadWriteOnce (RWO) or ReadOnlyMany (ROX) to reduce blast radius.StorageClasses to enforce encryption at rest (e.g., CMEK, encrypted: "true").Recycle. Flag Retain on sensitive volumes without automated wipe processes.allowVolumeExpansion: true without strict namespace ResourceQuotas (DoS risk).