PlugWiki

k8s-security-policies Skill (wshobson): Kubernetes Security

Gives Claude ready YAML for Kubernetes network policies, RBAC, Pod Security Standards and policy enforcement.

Installs
14.9K
on skills.sh
Stars
42.1K
on GitHub
Files
2
besides SKILL.md
Updated
Oct 2026
last repo commit

k8s-security-policies makes Claude write Kubernetes security manifests from a fixed set of examples. It covers Pod Security Standards, NetworkPolicy, RBAC, pod security contexts, OPA Gatekeeper constraints and Istio policies.

The skill writes YAML and suggests kubectl checks. Read each policy before you apply it, since a default-deny network policy can cut off traffic your services need. The folder holds SKILL.md, a network policy template and an RBAC patterns file.

Good for

  • Platform engineers locking down a Kubernetes cluster
  • Teams adding network isolation between services
  • Anyone writing least-privilege RBAC roles

Install k8s-security-policies

Claude Code

  1. 1

    Copy this prompt.

    Install the k8s-security-policies skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install kubernetes-operations@claude-code-workflows

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

The plugin route installs the whole kubernetes-operations plugin: 4 skills and 1 agent (counted from the repo tree). The skills-only routes install just this skill without the agents, commands or hooks, per the README. Pick one route, not both.

From the project README. Source.

What's in the skill

When it loads

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

Sections in SKILL.md

  1. Purpose
  2. When to Use This Skill
  3. Pod Security Standards
  4. 1. Privileged (Unrestricted)
  5. 2. Baseline (Minimally restrictive)
  6. 3. Restricted (Most restrictive)
  7. Network Policies
  8. Default Deny All
  9. Allow Frontend to Backend
  10. Allow DNS
  11. RBAC Configuration
  12. Role (Namespace-scoped)
  13. ClusterRole (Cluster-wide)
  14. RoleBinding
  15. Pod Security Context
  16. Restricted Pod

Key facts

Author
wshobson (repo owner)
Repo
wshobson/agents
Installs on skills.sh
14,949
Repo stars
42,081
License
MIT
Last repo commit
2026-10-30
Files in the skill folder
3 files including SKILL.md

What it includes

  • Namespace labels for privileged, baseline and restricted levels

    Shows enforce, audit and warn labels for each level.

    Pod Security Standards

  • Default deny, frontend to backend, and DNS allow rules

    Starts from a default-deny policy and adds the allowances your pods need.

    Network Policies

  • Role, ClusterRole and RoleBinding examples

    Namespace and cluster scoped examples for least-privilege access.

    RBAC Configuration

  • A restricted pod example

    Shows security settings to put on a pod.

    Pod Security Context

  • A ConstraintTemplate and a Constraint

    Admission control rules written for Gatekeeper.

    Policy Enforcement with OPA Gatekeeper

  • mTLS and authorization policy examples

    Covers PeerAuthentication and AuthorizationPolicy.

    Service Mesh Security (Istio)

  • CIS Kubernetes Benchmark and NIST Cybersecurity Framework

    Short checklists for each framework, such as RBAC authorization and audit logging under CIS.

    Compliance Frameworks

  • kubectl commands for networks and permissions

    Uses kubectl get, describe and auth can-i to inspect policies and permissions.

    Runs code · Troubleshooting

  • Network policy templates, starting with default deny

    A YAML file with templates, including allow DNS.

    assets/network-policy-template.yaml

  • Five RBAC patterns and service account practices

    Read-only access, namespace admin, deployment manager, secret reader and CI/CD access, plus kubectl auth can-i checks.

    references/rbac-patterns.md

From the official docs

Permissions

Medium risk

The skill bundles no scripts, but the policies it writes can block traffic or tighten access once applied. Apply them to a test namespace first and check your kubectl context before running commands.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • Network policies can cut off traffic

    The first template is a default-deny policy for ingress and egress. Test it in a non-production namespace and add the allow rules before you apply it to production. github.com

  • It suggests kubectl commands

    The troubleshooting section uses kubectl get, describe and auth can-i. Claude runs them against whatever cluster your kubectl context points at, so check the context first. github.com

Questions

What does the k8s-security-policies skill do?

It gives Claude YAML examples and checklists for Kubernetes security: Pod Security Standards, network policies, RBAC, pod security contexts, OPA Gatekeeper and Istio.

Does it include PodSecurityPolicy manifests?

No. PodSecurityPolicy appears only in the frontmatter description and the intro line. Every pod security example in SKILL.md is a Pod Security Standards namespace label (privileged, baseline, restricted). Our note, not the skill's: PodSecurityPolicy was removed from Kubernetes in v1.25, so on a current cluster use the labels. Check your cluster version before you apply anything.

How do I install it?

Use the install box above. The folder has 3 files including SKILL.md. The wshobson/agents repo ships it inside its kubernetes-operations plugin, and the README also documents a skills-only route.

Will it change my cluster by itself?

The SKILL.md writes manifests and suggests kubectl commands for inspection. Whether Claude applies a manifest depends on your permission settings, so approve apply commands yourself.

Is it safe to install?

It bundles no scripts, only markdown and one YAML template. The risk is in applying the policies it writes, so test them in a non-production namespace first.

Are there related skills?

Its Related Skills list names k8s-manifest-generator and gitops-workflow. They are optional and the skill does not call them.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/kubernetes-operations/skills/k8s-security-policies

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4
  1. wshobson/agents README · github.com
  2. k8s-security-policies SKILL.md · github.com
  3. k8s-security-policies references/rbac-patterns.md · github.com
  4. k8s-security-policies assets/network-policy-template.yaml · github.com

Updated Nov 2, 2026.