k8s-security

Kubernetes Security

Security auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.

When to Apply

Use this skill when:

• User mentions: "security", "RBAC", "permissions", "policy", "audit", "secrets"
• Operations: security review, permission check, policy enforcement
• Keywords: "who can", "access control", "compliance", "vulnerable"

Priority Rules

Priority	Rule	Impact	Tools
1	Check cluster-admin bindings first	CRITICAL	get_cluster_role_bindings
2	Audit secrets access permissions	CRITICAL	Review role rules
3	Verify network isolation	HIGH	get_network_policies
4	Check policy compliance	HIGH	kyverno_*, gatekeeper_*
5	Review pod security contexts	MEDIUM	describe_pod

Quick Reference

Task	Tool	Example
List roles	get_roles	get_roles(namespace)
Cluster roles	get_cluster_roles	get_cluster_roles()
Role bindings	get_role_bindings	get_role_bindings(namespace)
Service accounts	get_service_accounts	get_service_accounts(namespace)
Kyverno policies	kyverno_clusterpolicies_list_tool	kyverno_clusterpolicies_list_tool()

RBAC Auditing

List Roles and Bindings

get_roles(namespace)
get_cluster_roles()
get_role_bindings(namespace)
get_cluster_role_bindings()

Check Service Account Permissions

get_service_accounts(namespace)

Common RBAC Patterns

Pattern	Risk Level	Check
cluster-admin binding	Critical	get_cluster_role_bindings()
Wildcard verbs (*)	High	Review role rules
secrets access	High	Check get/list on secrets
pod/exec	High	Allows container access

See RBAC-PATTERNS.md for detailed patterns and remediation.

Policy Enforcement

Kyverno Policies

kyverno_policies_list_tool(namespace)
kyverno_clusterpolicies_list_tool()
kyverno_policy_get_tool(name, namespace)

OPA Gatekeeper

gatekeeper_constraints_list_tool()
gatekeeper_constraint_get_tool(kind, name)
gatekeeper_templates_list_tool()

Common Policies to Enforce

Policy	Purpose
Disallow privileged	Prevent root containers
Require resource limits	Prevent resource exhaustion
Restrict host namespaces	Isolate from node
Require labels	Ensure metadata
Allowed registries	Control image sources

Secret Management

List Secrets

get_secrets(namespace)

Secret Best Practices

1. Use external secret managers (Vault, AWS SM)
2. Encrypt secrets at rest (EncryptionConfiguration)
3. Limit secret access via RBAC
4. Rotate secrets regularly

Network Policies

List Policies

get_network_policies(namespace)

Cilium Network Policies

cilium_policies_list_tool(namespace)
cilium_policy_get_tool(name, namespace)

Default Deny Template

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Security Scanning Workflow

1. RBAC Audit

   get_cluster_role_bindings()
   get_roles(namespace)
   

2. Policy Compliance

   kyverno_clusterpolicies_list_tool()
   gatekeeper_constraints_list_tool()
   

3. Network Isolation

   get_network_policies(namespace)
   cilium_endpoints_list_tool(namespace)
   

4. Pod Security

   get_pods(namespace)
   describe_pod(name, namespace)
   

Multi-Cluster Security

Audit across clusters:

get_cluster_role_bindings(context="production")
get_cluster_role_bindings(context="staging")

Automated Audit Script

For comprehensive security audit, see scripts/audit-rbac.py.

Related Tools

• RBAC: get_roles, get_cluster_roles, get_role_bindings
• Policy: kyverno_*, gatekeeper_*
• Network: get_network_policies, cilium_policies_*
• Istio: istio_authorizationpolicies_list_tool, istio_peerauthentications_list_tool

Related Skills

• k8s-policy - Policy management
• k8s-cilium - Cilium network security