[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FFXVZP54RSBA4YESTPD5QM":3,"skill-same:01M6FFXVZP54RSBA4YESTPD5QM":48},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":21,"linkOnly":22,"markdownContent":23,"markdownBody":23,"frontMatter":24,"refName":25,"commitSha":26,"skillDirectory":27,"forksCount":28,"repositoryHtmlUrl":29,"repositoryHomepageUrl":30,"ownerHtmlUrl":31,"ownerBlogUrl":6,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M6FFXVZP54RSBA4YESTPD5QM","k8s-security",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Frohitg00\u002Fkubectl-mcp-server\u002Fk8s-security\u002FSKILL.md",[],[18,19,20],"security","k8s","k8s security","2026-11-10 10:12:30",false,"# Kubernetes Security\n\nSecurity auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.\n\n## When to Apply\n\nUse this skill when:\n- User mentions: \"security\", \"RBAC\", \"permissions\", \"policy\", \"audit\", \"secrets\"\n- Operations: security review, permission check, policy enforcement\n- Keywords: \"who can\", \"access control\", \"compliance\", \"vulnerable\"\n\n## Priority Rules\n\n| Priority | Rule | Impact | Tools |\n|----------|------|--------|-------|\n| 1 | Check cluster-admin bindings first | CRITICAL | `get_cluster_role_bindings` |\n| 2 | Audit secrets access permissions | CRITICAL | Review role rules |\n| 3 | Verify network isolation | HIGH | `get_network_policies` |\n| 4 | Check policy compliance | HIGH | `kyverno_*`, `gatekeeper_*` |\n| 5 | Review pod security contexts | MEDIUM | `describe_pod` |\n\n## Quick Reference\n\n| Task | Tool | Example |\n|------|------|---------|\n| List roles | `get_roles` | `get_roles(namespace)` |\n| Cluster roles | `get_cluster_roles` | `get_cluster_roles()` |\n| Role bindings | `get_role_bindings` | `get_role_bindings(namespace)` |\n| Service accounts | `get_service_accounts` | `get_service_accounts(namespace)` |\n| Kyverno policies | `kyverno_clusterpolicies_list_tool` | `kyverno_clusterpolicies_list_tool()` |\n\n## RBAC Auditing\n\n### List Roles and Bindings\n\n```python\nget_roles(namespace)\nget_cluster_roles()\nget_role_bindings(namespace)\nget_cluster_role_bindings()\n```\n\n### Check Service Account Permissions\n\n```python\nget_service_accounts(namespace)\n```\n\n### Common RBAC Patterns\n\n| Pattern | Risk Level | Check |\n|---------|-----------|-------|\n| cluster-admin binding | Critical | `get_cluster_role_bindings()` |\n| Wildcard verbs (*) | High | Review role rules |\n| secrets access | High | Check get\u002Flist on secrets |\n| pod\u002Fexec | High | Allows container access |\n\nSee [RBAC-PATTERNS.md](RBAC-PATTERNS.md) for detailed patterns and remediation.\n\n## Policy Enforcement\n\n### Kyverno Policies\n\n```python\nkyverno_policies_list_tool(namespace)\nkyverno_clusterpolicies_list_tool()\nkyverno_policy_get_tool(name, namespace)\n```\n\n### OPA Gatekeeper\n\n```python\ngatekeeper_constraints_list_tool()\ngatekeeper_constraint_get_tool(kind, name)\ngatekeeper_templates_list_tool()\n```\n\n### Common Policies to Enforce\n\n| Policy | Purpose |\n|--------|---------|\n| Disallow privileged | Prevent root containers |\n| Require resource limits | Prevent resource exhaustion |\n| Restrict host namespaces | Isolate from node |\n| Require labels | Ensure metadata |\n| Allowed registries | Control image sources |\n\n## Secret Management\n\n### List Secrets\n\n```python\nget_secrets(namespace)\n```\n\n### Secret Best Practices\n\n1. Use external secret managers (Vault, AWS SM)\n2. Encrypt secrets at rest (EncryptionConfiguration)\n3. Limit secret access via RBAC\n4. Rotate secrets regularly\n\n## Network Policies\n\n### List Policies\n\n```python\nget_network_policies(namespace)\n```\n\n### Cilium Network Policies\n\n```python\ncilium_policies_list_tool(namespace)\ncilium_policy_get_tool(name, namespace)\n```\n\n### Default Deny Template\n\n```yaml\napiVersion: networking.k8s.io\u002Fv1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-all\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress\n  - Egress\n```\n\n## Security Scanning Workflow\n\n1. **RBAC Audit**\n   ```python\n   get_cluster_role_bindings()\n   get_roles(namespace)\n   ```\n\n2. **Policy Compliance**\n   ```python\n   kyverno_clusterpolicies_list_tool()\n   gatekeeper_constraints_list_tool()\n   ```\n\n3. **Network Isolation**\n   ```python\n   get_network_policies(namespace)\n   cilium_endpoints_list_tool(namespace)\n   ```\n\n4. **Pod Security**\n   ```python\n   get_pods(namespace)\n   describe_pod(name, namespace)\n   ```\n\n## Multi-Cluster Security\n\nAudit across clusters:\n\n```python\nget_cluster_role_bindings(context=\"production\")\nget_cluster_role_bindings(context=\"staging\")\n```\n\n## Automated Audit Script\n\nFor comprehensive security audit, see [scripts\u002Faudit-rbac.py](scripts\u002Faudit-rbac.py).\n\n## Related Tools\n\n- RBAC: `get_roles`, `get_cluster_roles`, `get_role_bindings`\n- Policy: `kyverno_*`, `gatekeeper_*`\n- Network: `get_network_policies`, `cilium_policies_*`\n- Istio: `istio_authorizationpolicies_list_tool`, `istio_peerauthentications_list_tool`\n\n## Related Skills\n\n- [k8s-policy](..\u002Fk8s-policy\u002FSKILL.md) - Policy management\n- [k8s-cilium](..\u002Fk8s-cilium\u002FSKILL.md) - Cilium network security\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Frohitg00\u002Fkubectl-mcp-server\u002Fk8s-security",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill k8s-security",{"tool":40,"command":41},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill k8s-security",{"tool":43,"command":44},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill k8s-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Frohitg00\u002Fkubectl-mcp-server\u002Fk8s-security\u002FSKILL.md",true,[],[49,63,73,82,88,95],{"skillNo":50,"name":51,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":59,"publishedAt":21},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[54],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[60,61,62],"model","model hierarchy","model hierarchy skill",{"skillNo":64,"name":65,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":69,"publishedAt":21},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[68],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},[70,71,72],"MCP","zoom","zoom mcp",{"skillNo":74,"name":75,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":21},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[79,80,81,71],"sdk","zoom apps sdk","apps",{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":21},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[84],{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":94,"publishedAt":21},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[93],{"categoryNo":55,"categoryName":56,"taxonomyType":57,"taxonomyTypeDesc":58},[90],{"skillNo":96,"name":97,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":21},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[97]]