Kubernetes Security

Security auditing, RBAC management, and policy enforcement using kubectl-mcp-server tools.

When to Apply

Use this skill when:

• User mentions: "security", "RBAC", "permissions", "policy", "audit", "secrets"

• Operations: security review, permission check, policy enforcement

• Keywords: "who can", "access control", "compliance", "vulnerable"

Priority Rules

Priority Rule Impact Tools

1 Check cluster-admin bindings first CRITICAL get_cluster_role_bindings

2 Audit secrets access permissions CRITICAL Review role rules

3 Verify network isolation HIGH get_network_policies

4 Check policy compliance HIGH kyverno_* , gatekeeper_*

5 Review pod security contexts MEDIUM describe_pod

Quick Reference

Task Tool Example

List roles get_roles

get_roles(namespace)

Cluster roles get_cluster_roles

get_cluster_roles()

Role bindings get_role_bindings

get_role_bindings(namespace)

Service accounts get_service_accounts

get_service_accounts(namespace)

Kyverno policies kyverno_clusterpolicies_list_tool

kyverno_clusterpolicies_list_tool()

RBAC Auditing

List Roles and Bindings

get_roles(namespace) get_cluster_roles() get_role_bindings(namespace) get_cluster_role_bindings()

Check Service Account Permissions

get_service_accounts(namespace)

Common RBAC Patterns

Pattern Risk Level Check

cluster-admin binding Critical get_cluster_role_bindings()

Wildcard verbs (*) High Review role rules

secrets access High Check get/list on secrets

pod/exec High Allows container access

See RBAC-PATTERNS.md for detailed patterns and remediation.

Policy Enforcement

Kyverno Policies

kyverno_policies_list_tool(namespace) kyverno_clusterpolicies_list_tool() kyverno_policy_get_tool(name, namespace)

OPA Gatekeeper

gatekeeper_constraints_list_tool() gatekeeper_constraint_get_tool(kind, name) gatekeeper_templates_list_tool()

Common Policies to Enforce

Policy Purpose

Disallow privileged Prevent root containers

Require resource limits Prevent resource exhaustion

Restrict host namespaces Isolate from node

Require labels Ensure metadata

Allowed registries Control image sources

Secret Management

List Secrets

get_secrets(namespace)

Secret Best Practices

• Use external secret managers (Vault, AWS SM)

• Encrypt secrets at rest (EncryptionConfiguration)

• Limit secret access via RBAC

• Rotate secrets regularly

Network Policies

List Policies

get_network_policies(namespace)

Cilium Network Policies

cilium_policies_list_tool(namespace) cilium_policy_get_tool(name, namespace)

Default Deny Template

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all spec: podSelector: {} policyTypes:

• Ingress
• Egress

Security Scanning Workflow

RBAC Audit

get_cluster_role_bindings() get_roles(namespace)

Policy Compliance

kyverno_clusterpolicies_list_tool() gatekeeper_constraints_list_tool()

Network Isolation

get_network_policies(namespace) cilium_endpoints_list_tool(namespace)

Pod Security

get_pods(namespace) describe_pod(name, namespace)

Multi-Cluster Security

Audit across clusters:

get_cluster_role_bindings(context="production") get_cluster_role_bindings(context="staging")

Automated Audit Script

For comprehensive security audit, see scripts/audit-rbac.py.

Related Tools

• RBAC: get_roles , get_cluster_roles , get_role_bindings

• Policy: kyverno_* , gatekeeper_*

• Network: get_network_policies , cilium_policies_*

• Istio: istio_authorizationpolicies_list_tool , istio_peerauthentications_list_tool

Related Skills

• k8s-policy - Policy management

• k8s-cilium - Cilium network security