MR
Mayur Rathi
@sickn33
⭐ 47.3k GitHub stars

kubernetes-hardening

kubernetes-hardening is an code AI skill with a core value of Implement Kubernetes security contexts, Pod Security Standards, and network policies. It helps developers solve real-world problems in the code domain, boosting efficiency, automating repetitive tasks, and optimizing workflows.

Implement Kubernetes security contexts, Pod Security Standards, and network policies.

Last verified on: 2026-10-06

Quick Facts

Category code
Works With Claude
Source sickn33/antigravity-awesome-skills
Stars ⭐ 47.3k
Last Verified 2026-10-06
Risk Level Low
mkdir -p ./skills/kubernetes-hardening && curl -sfL https://raw.githubusercontent.com/sickn33/antigravity-awesome-skills/main/skills/kubernetes-hardening/SKILL.md -o ./skills/kubernetes-hardening/SKILL.md

Run in terminal / PowerShell. Requires curl (Unix) or PowerShell 5+ (Windows).

Skill Content

# Kubernetes Hardening


Secure Kubernetes clusters and workloads.


When to Use This Skill


Use this skill when:

- Hardening Kubernetes clusters

- Implementing Pod Security Standards

- Configuring network policies

- Meeting security compliance


Pod Security Standards


yaml 
# Namespace with restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Security Context


yaml 
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Network Policies


yaml 
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

RBAC


yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader-binding
subjects:
- kind: ServiceAccount
  name: myapp
roleRef:
  kind: Role
  name: app-reader
  apiGroup: rbac.authorization.k8s.io

Best Practices


- Enable Pod Security Standards

- Implement network policies

- Use RBAC with least privilege

- Enable audit logging

- Secure etcd with encryption

- Use service mesh for mTLS

- Regular security scanning


Related Skills


- kubernetes-ops (`kubernetes-ops`) - K8s operations

- container-hardening (`container-hardening`) - Container security


Limitations


- Apply guidance only within authorized scope; test destructive steps in non-production first.

- Docs-only import: upstream scripts and templates not bundled.


Example


bash 
# Read-only first: inventory before any active step.
which <tool> && <tool> --help | head -n 20

> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

🎯 Best For

  • Security auditors
  • DevSecOps teams
  • Compliance officers
  • Claude users
  • Software engineers

💡 Use Cases

  • Auditing dependencies for known CVEs
  • Scanning API endpoints for auth gaps
  • Code quality improvement
  • Best practice enforcement

📖 How to Use This Skill

  1. 1

    Install the Skill

    Copy the install command from the Terminal tab and run it. The SKILL.md file downloads to your local skills directory.

  2. 2

    Load into Your AI Assistant

    Open Claude and reference the skill. Paste the SKILL.md content or use the system prompt tab.

  3. 3

    Apply kubernetes-hardening to Your Work

    Open your project in the AI assistant and ask it to apply the skill. Start with a small module to verify the output quality.

  4. 4

    Review and Refine

    Review AI suggestions before committing. Run tests, check for regressions, and iterate on the skill output.

❓ Frequently Asked Questions

Can this replace a dedicated SAST tool?

AI-based security review is complementary to SAST tools. Use it as a first-pass filter, not a replacement.

Is kubernetes-hardening compatible with Cursor and VS Code?

Yes — this skill works with any AI coding assistant including Cursor, VS Code with Copilot, and JetBrains IDEs.

Do I need specific dependencies for kubernetes-hardening?

Check the install command and Works With section. Most code skills only require the AI assistant and your codebase.

How do I install kubernetes-hardening?

Copy the install command from the Terminal tab and run it. The skill downloads to ./skills/kubernetes-hardening/SKILL.md, ready to use.

Can I customize this skill for my team?

Absolutely. Edit the SKILL.md file to add team-specific instructions, examples, or workflows.

⚠️ Common Mistakes to Avoid

Only scanning surface-level issues

Deep security review requires understanding your app architecture, not just regex patterns.

Skipping validation

Always test AI-generated code changes, even for simple refactors.

Missing dependency updates

Check if the skill requires updated dependencies or new packages.

🔗 Related Skills

007 007ai-engineering-toolkit ai-engineering-toolkitai-security-hardening ai-security-hardeningaudit-skills audit-skillscodebase-cleanup-deps-audit Codebase Cleanup Deps Auditcontainer-security-hardening container-security-hardening