Kubernetes Hardening

Name: Kubernetes Hardening
Author: bagelhole

bagelhole/devops-security-agent-skills

99 installs
44 repo stars
Updated May 22, 2026
bagelhole/devops-security-agent-skills

kubernetes-hardening is a Claude Code skill for securing Kubernetes clusters and workloads with Pod Security Standards, security contexts, network policies, and RBAC.

About

A Claude skill for hardening Kubernetes clusters and workloads. A developer uses it to apply Pod Security Standards, restrictive security contexts, network policies, and least-privilege RBAC. It also recommends etcd encryption, audit logging, and service-mesh mTLS to meet security compliance.

Applies Pod Security Standards and restrictive security contexts
Configures default-deny network policies and least-privilege RBAC
Covers etcd encryption, audit logging, and mTLS via service mesh

Kubernetes Hardening by the numbers

99 all-time installs (skills.sh)
Ranked #1,009 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Jul 28, 2026 (Skillselion catalog sync)

At a glance

kubernetes-hardening capabilities & compatibility

Capabilities: security audit · devops
Works with: kubernetes
Use cases: security audit · devops
Pricing: Free

From the docs

What kubernetes-hardening says it does

Implement Kubernetes security contexts, Pod Security Standards, and network policies. Secure cluster components and workloads.

SKILL.md

Secure Kubernetes clusters and workloads.

SKILL.md

npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill kubernetes-hardening

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/bagelhole/devops-security-agent-skills/kubernetes-hardening.svg)](https://skillselion.com/skills/bagelhole/devops-security-agent-skills/kubernetes-hardening)

Installs	99
repo stars	★ 44
Last updated	May 22, 2026
Repository	bagelhole/devops-security-agent-skills ↗

What it does

Harden Kubernetes clusters with Pod Security Standards, network policies, and least-privilege RBAC.

Who is it for?

Teams hardening Kubernetes clusters for security compliance.

Skip if: General Kubernetes operations unrelated to security.

When should I use this skill?

Hardening a Kubernetes cluster, applying Pod Security Standards, or configuring network policies and RBAC.

What you get

A hardened Kubernetes cluster with Pod Security Standards, network policies, and least-privilege RBAC.

Pod Security Standards and security context manifests
Network policies
Least-privilege RBAC roles and bindings

By the numbers

Best practices list 7 hardening measures (PSS, network policies, RBAC, audit logging, etcd encryption, service mesh mTLS

Files

SKILL.mdMarkdownGitHub ↗

Kubernetes Hardening

Secure Kubernetes clusters and workloads.

When to Use This Skill

Use this skill when:

Hardening Kubernetes clusters
Implementing Pod Security Standards
Configuring network policies
Meeting security compliance

Pod Security Standards

# Namespace with restricted policy
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Security Context

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - port: 8080

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader-binding
subjects:
- kind: ServiceAccount
  name: myapp
roleRef:
  kind: Role
  name: app-reader
  apiGroup: rbac.authorization.k8s.io