PaperclipOrg
Claude Agent Skill · by Wshobson

K8s Security Policies

Implements the security trifecta for Kubernetes clusters: NetworkPolicies for network segmentation, RBAC for least-privilege access, and Pod Security Standards

Install
Terminal · npx
$npx skills add https://github.com/wshobson/agents --skill k8s-security-policies
Works with Paperclip

How K8s Security Policies fits into a Paperclip company.

K8s Security Policies drops into any Paperclip agent that handles this kind of work. Assign it to a specialist inside a pre-configured PaperclipOrg company and the skill becomes available on every heartbeat — no prompt engineering, no tool wiring.

S
SaaS FactoryPaired

Pre-configured AI company — 18 agents, 18 skills, one-time purchase.

$27$59
Explore pack
Source file
SKILL.md347 lines
Expand
---name: k8s-security-policiesdescription: Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.--- # Kubernetes Security Policies Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes. ## Purpose Implement defense-in-depth security for Kubernetes clusters using network policies, pod security standards, and RBAC. ## When to Use This Skill - Implement network segmentation- Configure pod security standards- Set up RBAC for least-privilege access- Create security policies for compliance- Implement admission control- Secure multi-tenant clusters ## Pod Security Standards ### 1. Privileged (Unrestricted) ```yamlapiVersion: v1kind: Namespacemetadata:  name: privileged-ns  labels:    pod-security.kubernetes.io/enforce: privileged    pod-security.kubernetes.io/audit: privileged    pod-security.kubernetes.io/warn: privileged``` ### 2. Baseline (Minimally restrictive) ```yamlapiVersion: v1kind: Namespacemetadata:  name: baseline-ns  labels:    pod-security.kubernetes.io/enforce: baseline    pod-security.kubernetes.io/audit: baseline    pod-security.kubernetes.io/warn: baseline``` ### 3. Restricted (Most restrictive) ```yamlapiVersion: v1kind: Namespacemetadata:  name: restricted-ns  labels:    pod-security.kubernetes.io/enforce: restricted    pod-security.kubernetes.io/audit: restricted    pod-security.kubernetes.io/warn: restricted``` ## Network Policies ### Default Deny All ```yamlapiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: default-deny-all  namespace: productionspec:  podSelector: {}  policyTypes:    - Ingress    - Egress``` ### Allow Frontend to Backend ```yamlapiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: allow-frontend-to-backend  namespace: productionspec:  podSelector:    matchLabels:      app: backend  policyTypes:    - Ingress  ingress:    - from:        - podSelector:            matchLabels:              app: frontend      ports:        - protocol: TCP          port: 8080``` ### Allow DNS ```yamlapiVersion: networking.k8s.io/v1kind: NetworkPolicymetadata:  name: allow-dns  namespace: productionspec:  podSelector: {}  policyTypes:    - Egress  egress:    - to:        - namespaceSelector:            matchLabels:              name: kube-system      ports:        - protocol: UDP          port: 53``` **Reference:** See `assets/network-policy-template.yaml` ## RBAC Configuration ### Role (Namespace-scoped) ```yamlapiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata:  name: pod-reader  namespace: productionrules:  - apiGroups: [""]    resources: ["pods"]    verbs: ["get", "watch", "list"]``` ### ClusterRole (Cluster-wide) ```yamlapiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  name: secret-readerrules:  - apiGroups: [""]    resources: ["secrets"]    verbs: ["get", "watch", "list"]``` ### RoleBinding ```yamlapiVersion: rbac.authorization.k8s.io/v1kind: RoleBindingmetadata:  name: read-pods  namespace: productionsubjects:  - kind: User    name: jane    apiGroup: rbac.authorization.k8s.io  - kind: ServiceAccount    name: default    namespace: productionroleRef:  kind: Role  name: pod-reader  apiGroup: rbac.authorization.k8s.io``` **Reference:** See `references/rbac-patterns.md` ## Pod Security Context ### Restricted Pod ```yamlapiVersion: v1kind: Podmetadata:  name: secure-podspec:  securityContext:    runAsNonRoot: true    runAsUser: 1000    fsGroup: 1000    seccompProfile:      type: RuntimeDefault  containers:    - name: app      image: myapp:1.0      securityContext:        allowPrivilegeEscalation: false        readOnlyRootFilesystem: true        capabilities:          drop:            - ALL``` ## Policy Enforcement with OPA Gatekeeper ### ConstraintTemplate ```yamlapiVersion: templates.gatekeeper.sh/v1kind: ConstraintTemplatemetadata:  name: k8srequiredlabelsspec:  crd:    spec:      names:        kind: K8sRequiredLabels      validation:        openAPIV3Schema:          type: object          properties:            labels:              type: array              items:                type: string  targets:    - target: admission.k8s.gatekeeper.sh      rego: |        package k8srequiredlabels        violation[{"msg": msg, "details": {"missing_labels": missing}}] {          provided := {label | input.review.object.metadata.labels[label]}          required := {label | label := input.parameters.labels[_]}          missing := required - provided          count(missing) > 0          msg := sprintf("missing required labels: %v", [missing])        }``` ### Constraint ```yamlapiVersion: constraints.gatekeeper.sh/v1beta1kind: K8sRequiredLabelsmetadata:  name: require-app-labelspec:  match:    kinds:      - apiGroups: ["apps"]        kinds: ["Deployment"]  parameters:    labels: ["app", "environment"]``` ## Service Mesh Security (Istio) ### PeerAuthentication (mTLS) ```yamlapiVersion: security.istio.io/v1beta1kind: PeerAuthenticationmetadata:  name: default  namespace: productionspec:  mtls:    mode: STRICT``` ### AuthorizationPolicy ```yamlapiVersion: security.istio.io/v1beta1kind: AuthorizationPolicymetadata:  name: allow-frontend  namespace: productionspec:  selector:    matchLabels:      app: backend  action: ALLOW  rules:    - from:        - source:            principals: ["cluster.local/ns/production/sa/frontend"]``` ## Best Practices 1. **Implement Pod Security Standards** at namespace level2. **Use Network Policies** for network segmentation3. **Apply least-privilege RBAC** for all service accounts4. **Enable admission control** (OPA Gatekeeper/Kyverno)5. **Run containers as non-root**6. **Use read-only root filesystem**7. **Drop all capabilities** unless needed8. **Implement resource quotas** and limit ranges9. **Enable audit logging** for security events10. **Regular security scanning** of images ## Compliance Frameworks ### CIS Kubernetes Benchmark - Use RBAC authorization- Enable audit logging- Use Pod Security Standards- Configure network policies- Implement secrets encryption at rest- Enable node authentication ### NIST Cybersecurity Framework - Implement defense in depth- Use network segmentation- Configure security monitoring- Implement access controls- Enable logging and monitoring ## Troubleshooting **NetworkPolicy not working:** ```bash# Check if CNI supports NetworkPolicykubectl get nodes -o widekubectl describe networkpolicy <name>``` **RBAC permission denied:** ```bash# Check effective permissionskubectl auth can-i list pods --as system:serviceaccount:default:my-sakubectl auth can-i '*' '*' --as system:serviceaccount:default:my-sa```  ## Related Skills - `k8s-manifest-generator` - For creating secure manifests- `gitops-workflow` - For automated policy deployment