mcpField
K
kubernetes-hardening

kubernetes-hardening

github.com/bagelholeSecurity1.2k368 installsUpdated 23w ago
Repository

About kubernetes-hardening

kubernetes-hardening is a skill for teams securing Kubernetes clusters and workloads. It covers practical configuration for pod security, network policies, and RBAC, alongside broader hardening practices.

Key features

  1. 01Pod Security Standards 配置
  2. 02安全上下文设置
  3. 03网络策略配置
  4. 04最小权限 RBAC
  5. 05集群加固实践

Use cases

  1. 01为生产命名空间启用受限策略
  2. 02限制 Pod 的网络流量
  3. 03为应用配置最小权限角色

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill kubernetes-hardening

After installing, type/kubernetes-hardeningin Claude Code to confirm it loaded.

Details

From the project README

Kubernetes Hardening

Secure Kubernetes clusters and workloads.

When to Use This Skill

Use this skill when:

  • Hardening Kubernetes clusters
  • Implementing Pod Security Standards
  • Configuring network policies
  • Meeting security compliance

Pod Security Standards

# Namespace with restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Security Context

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader-binding
subjects:
- kind: ServiceAccount
  name: myapp
roleRef:
  kind: Role
  name: app-reader
  apiGroup: rbac.authorization.k8s.io

Best Practices

  • Enable Pod Security Standards
  • Implement network policies
  • Use RBAC with least privilege
  • Enable audit logging
  • Secure etcd with encryption
  • Use service mesh for mTLS
  • Regular security scanning

Related Skills

Comments

Markdown supported