Kubernetes Security Policies

Defense-in-depth security for Kubernetes clusters using Pod Security Standards, NetworkPolicy, RBAC, admission control (OPA Gatekeeper), and service mesh policies (Istio). Use this skill whenever the task involves securing pods, restricting network traffic, configuring role-based access, or enforcing compliance controls in a Kubernetes cluster.

When to Use

• Implementing network segmentation between namespaces or tiers (frontend → backend → database)
• Configuring Pod Security Standards (privileged, baseline, restricted) at the namespace level
• Setting up least-privilege RBAC for users and service accounts
• Creating admission control policies with OPA Gatekeeper or Kyverno
• Securing multi-tenant clusters
• Hardening pod security contexts (non-root, read-only FS, dropped capabilities)
• Implementing mTLS and authorization policies with Istio service mesh
• Meeting compliance requirements (CIS Benchmark, NIST CSF)

Do Not Use This Skill When