Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security. Use when securing Kubernetes clusters, implementing network isolation, or enforcing pod security standards.

Kubernetes Security Policies Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes. Purpose Implement defense in depth security for Kubernetes clusters using network policies, pod security standards, and RBAC. When to Use This Skill Implement network segmentation Configure pod security standards Set up RBAC for least privilege access Create security policies for compliance Implement admission control Secure multi tenant clusters Pod Security Standards 1. Privileged (Unrestricted) 2. Baseline (Minimally restrictive) 3. Restricted (Most restrictive) Network Policies Default Deny All Allow Frontend to Backend Allow DNS Reference: See assets/network policy template.yaml RBAC Configuration Role (Namespace scoped) ClusterRole (Cluster wide) RoleBinding Reference: See references/rbac patterns.md Pod Security Context Restricted Pod Policy Enforcement with OPA Gatekeeper ConstraintTemplate Constraint Service Mesh Security (Istio) PeerAuthentication (mTLS) AuthorizationPolicy Best Practices 1. Implement Pod Security Standards at namespace level 2. Use Network Policies for network segmentation 3. Apply least privilege RBAC for all service accounts 4. Enable admission control (OPA Gatekeeper/Kyverno) 5. Run containers as non root 6. Use read only root filesystem 7. Drop all capabilities unless needed 8. Implement resource quotas and limit ranges 9. Enable audit logging for security events 10. Regular security scanning of images Compliance Frameworks CIS Kubernetes Benchmark Use RBAC authorization Enable audit logging Use Pod Security Standards Configure network policies Implement secrets encryption at rest Enable node authentication NIST Cybersecurity Framework Implement defense in depth Use network segmentation Configure security monitoring Implement access controls Enable logging and monitoring Troubleshooting NetworkPolicy not working: RBAC permission denied: Related Skills k8s manifest generator For creating secure manifests gitops workflow For automated policy deployment

k8s-security-policies