SKILL.md
Kubernetes Security
Security auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.
When to Apply
Use this skill when:
- User mentions: "security", "RBAC", "permissions", "policy", "audit", "secrets"
- Operations: security review, permission check, policy enforcement
- Keywords: "who can", "access control", "compliance", "vulnerable"
Priority Rules
| Priority | Rule | Impact | Tools |
|---|---|---|---|
| 1 | Check cluster-admin bindings first | CRITICAL | getclusterrole_bindings |
| 2 | Audit secrets access permissions | CRITICAL | Review role rules |
| 3 | Verify network isolation | HIGH | getnetworkpolicies |
| 4 | Check policy compliance | HIGH | kyverno, gatekeeper |
| 5 | Review pod security contexts | MEDIUM | describe_pod |
Quick Reference
| Task | Tool | Example |
|---|---|---|
| List roles | get_roles |
get_roles(namespace) |
| Cluster roles | getclusterroles |
getclusterroles() |
| Role bindings | getrolebindings |
getrolebindings(namespace) |
| Service accounts | getserviceaccounts |
getserviceaccounts(namespace) |
| Kyverno policies | kyvernoclusterpolicieslist_tool |
kyvernoclusterpolicieslist_tool() |
RBAC Auditing
List Roles and Bindings
get_roles(namespace)
get_cluster_roles()
get_role_bindings(namespace)
get_cluster_role_bindings()Check Service Account Permissions
get_service_accounts(namespace)Common RBAC Patterns
| Pattern | Risk Level | Check |
|---|---|---|
| cluster-admin binding | Critical | getclusterrole_bindings() |
| Wildcard verbs (*) | High | Review role rules |
| secrets access | High | Check get/list on secrets |
| pod/exec | High | Allows container access |
See [RBAC-PATTERNS.md](RBAC-PATTERNS.md) for detailed patterns and remediation.
Policy Enforcement
Kyverno Policies
kyverno_policies_list_tool(namespace)
kyverno_clusterpolicies_list_tool()
kyverno_policy_get_tool(name, namespace)OPA Gatekeeper
gatekeeper_constraints_list_tool()
gatekeeper_constraint_get_tool(kind, name)
gatekeeper_templates_list_tool()Common Policies to Enforce
| Policy | Purpose |
|---|---|
| Disallow privileged | Prevent root containers |
| Require resource limits | Prevent resource exhaustion |
| Restrict host namespaces | Isolate from node |
| Require labels | Ensure metadata |
| Allowed registries | Control image sources |
Secret Management
List Secrets
get_secrets(namespace)Secret Best Practices
- Use external secret managers (Vault, AWS SM)
- Encrypt secrets at rest (EncryptionConfiguration)
- Limit secret access via RBAC
- Rotate secrets regularly
Network Policies
List Policies
get_network_policies(namespace)Cilium Network Policies
cilium_policies_list_tool(namespace)
cilium_policy_get_tool(name, namespace)Default Deny Template
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
spec:
podSelector: {}
policyTypes:
- Ingress
- EgressSecurity Scanning Workflow
- RBAC Audit
``python getclusterrolebindings() getroles(namespace) ``
- Policy Compliance
``python kyvernoclusterpolicieslisttool() gatekeeperconstraintslisttool() ``
- Network Isolation
``python getnetworkpolicies(namespace) ciliumendpointslist_tool(namespace) ``
- Pod Security
``python getpods(namespace) describepod(name, namespace) ``
Multi-Cluster Security
Audit across clusters:
get_cluster_role_bindings(context="production")
get_cluster_role_bindings(context="staging")Automated Audit Script
For comprehensive security audit, see [scripts/audit-rbac.py](scripts/audit-rbac.py).
Related Tools
- RBAC:
getroles,getclusterroles,getrole_bindings - Policy:
kyverno,gatekeeper - Network:
getnetworkpolicies,ciliumpolicies* - Istio:
istioauthorizationpolicieslisttool,istiopeerauthenticationslisttool
Related Skills
- [k8s-policy](../k8s-policy/SKILL.md) - Policy management
- [k8s-cilium](../k8s-cilium/SKILL.md) - Cilium network security