securing-kubernetes-on-cloud

name	securing-kubernetes-on-cloud
description	Use when this skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for GKE, and Managed Identities for AKS.
domain	cybersecurity
tags	["kubernetes-security","eks","aks","gke","pod-security-standards","container-runtime"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Securing Kubernetes On Cloud

Overview

Cybersecurity skill for securing kubernetes on cloud. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "securing kubernetes on cloud"

• "This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by "

• When deploying new managed Kubernetes clusters in production with security requirements

• When hardening existing EKS, AKS, or GKE clusters after a security audit or pentest finding

• When implementing workload identity to eliminate static cloud credentials in pods

• When enforcing pod security policies across namespaces to prevent container escapes

• When integrating runtime security monitoring for detecting container-level threats

Do not use for non-Kubernetes container deployments like ECS Fargate or Azure Container Instances, for application-level security within containers (see securing-serverless-functions), or for CI/CD pipeline security (see implementing-cloud-devsecops).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Managed Kubernetes cluster provisioned on EKS, AKS, or GKE with admin access
• kubectl configured with cluster admin credentials
• Familiarity with Kubernetes RBAC, namespaces, and security contexts
• Container network interface plugin supporting network policies (Calico, Cilium)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}